Privacy Policy

1. Introduction and Scope

Bayanatech Information Technology Establishment respects individuals’ privacy and is committed to processing personal data lawfully, fairly, and transparently in accordance with the laws applicable in the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations. This Policy explains how personal data is collected, used, retained, shared, and protected when using Tameer for Enterprise Management, its website, applications, cloud services, and related services.

This Policy applies to visitors to the Tameer website, Customers, Account Administrators, Users, self-service application users, establishment representatives, and every person whose data is processed through services managed by Bayanatech. It may also apply to the Customer’s employees, customers, suppliers, contractors, and others when the Customer uploads their data to Tameer.

This Policy shall be read together with the Tameer Terms and Conditions of Use, the subscription agreement or quotation, and any specific data processing agreement. In the event of a conflict, the specific provision shall prevail within the matter it expressly regulates, subject to mandatory legal provisions.

2. Definitions

Bayanatech: Bayanatech Information Technology Establishment, the entity that operates and provides Tameer.

Tameer or the System: The cloud platform, its applications, interfaces, components, and current or future services provided by Bayanatech under the Tameer name.

Customer: The natural or legal person that subscribes to Tameer or enters into an agreement to benefit from it.

User: Any person authorized by the Customer or Bayanatech to access the System.

Personal Data: Any data, regardless of its source or form, that may specifically identify an individual or make the individual identifiable, directly or indirectly.

Data Subject: The individual to whom the Personal Data relates.

Processing: Any operation performed on Personal Data, including collection, recording, storage, organization, alteration, retrieval, use, sharing, transfer, or destruction.

Controller: The entity that determines the purposes and means of Processing Personal Data.

Processor: The entity that processes Personal Data for and on behalf of the Controller.

3. Roles of Bayanatech and the Customer

Bayanatech acts as a Controller for data whose processing purposes it determines, such as account creation, subscription, billing, communications, support, operations, security, usage records, and management of the Customer relationship.

Bayanatech generally acts as a Processor when Tameer processes data concerning employees, customers, suppliers, contractors, or other parties that the Customer or its Users upload to the System to carry out the Customer’s instructions and provide the contracted services.

The Customer acts as the Controller for the data of its personnel and other parties that it collects, uploads, or processes through Tameer. The Customer is responsible for establishing a lawful basis, providing required notices, obtaining consent when required, defining permissions, and responding to Data Subject requests.

Bayanatech does not use Customer Data processed on the Customer’s behalf for independent purposes that are inconsistent with the Customer’s instructions or the provision of the service, unless otherwise required by law.

4. Categories of Personal Data We May Process

Depending on the services and features enabled by the Customer, the data we process may include the following categories:

Identity and contact data: Name, national identity or residency number when needed, job title, email address, mobile number, address, and establishment representative details.

Account and authentication data: Username, account identifier, roles and permissions, verification codes, and login records. We do not view passwords in readable form, and authentication data is processed under the applicable security controls.

Establishment and subscription data: Establishment name, commercial registration, tax number, branches, Plan, subscription status, invoices, payments, support records, and communications.

Customer, supplier, and project data: Contact details, contracts, quotations, projects, tasks, correspondence, documents, files, and business-related records.

Financial and accounting data: Entries, accounts, invoices, amounts, and transfer or payment details to the extent required to manage the service. Bayanatech does not retain complete bank card details when they are processed directly by an independent payment provider.

Human resources data: Employee information, contracts, salaries, leave, permissions, advances, assigned assets, evaluations, attendance, and self-service data, depending on the features enabled by the Customer.

Location and biometric data: Geolocation data or identifiers resulting from integration with attendance or biometric devices when these features are enabled and to the extent necessary for the stated purpose.

Usage and device data: Internet Protocol address, device type, browser, operating system, login times, pages or functions used, error and security logs, and session identifiers.

Integration and cloud-service data: Service-provider account identifier, associated email, authorization tokens, file and folder names, metadata, and content to the extent needed to perform the operation requested by the User.

Communications and support data: The content of support requests, inquiries, feedback, and files voluntarily submitted by the User.

5. Sources and Methods of Data Collection

We collect data directly from the Customer or User when an account is created, a subscription is purchased, forms are completed, the System is used, or support is contacted.

We may receive data from the Customer’s Account Administrator or an authorized User, from systems and devices connected to Tameer by the Customer, or from an external service provider selected by the User, such as Google Drive, Microsoft OneDrive, or Dropbox.

Certain technical data is collected automatically when the website or applications are used to protect and operate the service, analyze failures, and improve performance.

If the Customer provides data concerning other persons, the Customer represents that it has the authority and lawful basis required to provide and process that data through Tameer.

6. Purposes of Processing

Depending on the nature of the relationship and service, we use Personal Data for the following purposes:

Creating accounts, verifying identity or capacity, and securely managing permissions and access.

Providing Tameer services, operating its modules and features, and carrying out operations requested by the Customer or User.

Managing subscriptions, billing, payments, renewals, and the contractual relationship.

Providing technical support, training, configuration, and resolving failures and inquiries.

Protecting the System, accounts, and data; preventing fraud and misuse; and investigating security incidents.

Sending operational and security notices and alerts concerning the account or service.

Complying with legal, accounting, tax, and electronic-invoicing obligations and responding to competent authorities.

Operating integrations enabled by the User, including cloud storage, email, messaging, maps, payment, and government services.

Measuring performance, improving the User experience, and developing features using aggregated or de-identified data where appropriate.

Sending informational or marketing materials where a lawful basis or required consent exists, with an appropriate opt-out mechanism.

7. Lawful Bases for Processing

We process data when an appropriate lawful basis is available. This may include performing a contract to which the Data Subject is a party, taking steps at the Data Subject’s request before entering into a contract, complying with a legal obligation, protecting the legitimate interests of Bayanatech or the Customer without prejudicing the Data Subject’s rights, or obtaining the Data Subject’s consent where consent is required.

Where Processing is based on consent, the Data Subject may withdraw that consent through the mechanism described in this Policy. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal, subject to any legal or contractual obligation requiring specified Processing to continue.

8. Sensitive Data and Employee Data

Tameer may provide features involving sensitive or highly private data, such as biometric, location, salary, or health information included in leave requests. Such data is processed only when the Customer enables the relevant feature and only to the extent necessary for the stated purpose.

Before using attendance, geolocation, biometric-device integration, or self-service features, the Customer must inform employees and other affected persons of the nature and purpose of Processing, define permissions, and obtain any express consent or other lawful basis required by law.

The Customer should not upload sensitive data that is unnecessary for the service or for which it has no lawful basis to process.

9. Cloud Storage Integrations

When a User chooses to link a cloud storage account, the User is redirected to the service provider to complete authorization. Bayanatech does not request or retain the password for the User’s Google, Microsoft, or Dropbox account.

We may process the account identifier, associated email, access and refresh tokens, permission scopes, and file or folder metadata and content only to the extent needed to display, select, upload, download, update, or link files to a project in accordance with the operation requested by the User and the permissions approved by the User.

Authorization tokens are used to perform authorized operations and are stored using appropriate safeguards. The User may disconnect the integration from Tameer or revoke the application’s access through the service provider’s settings. Revocation may cause integration features to stop functioning.

Bayanatech does not sell cloud storage User Data, use file content for advertising, or transfer such data to another party except to provide the function requested by the User, for lawful security or legal purposes, or after express consent where required.

Tameer’s use and transfer of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Microsoft and Dropbox services are also subject to the terms and policies of each service provider.

The User is responsible for ensuring that files selected, uploaded, or shared do not contain data that the User has no right to process or transfer.

10. Data Sharing and Disclosure

Bayanatech does not sell Personal Data. We may share the minimum necessary data with the following categories where a need and lawful basis exist:

Hosting, cloud computing, backup, cybersecurity, and technical-support providers.

Payment, telecommunications, email, messaging, maps, analytics, and cloud-storage providers, according to the service enabled by the Customer.

Consultants, auditors, and professional service providers bound by confidentiality.

Governmental, judicial, or regulatory authorities where disclosure is legally required or necessary to fulfill a lawful request.

A legal successor to Bayanatech in the event of a merger, acquisition, or reorganization, subject to applicable rights and safeguards.

Service providers processing data on our behalf are required to follow agreed instructions, maintain confidentiality and protection, and not use the data for unauthorized independent purposes.

11. Transfers Outside the Kingdom

Certain hosting, support, or integration services may require data to be processed outside the Kingdom of Saudi Arabia. Cross-border transfers or disclosures are conducted only in accordance with the Personal Data Protection Law and related regulations, after assessing the need and risks and implementing appropriate safeguards.

An external service provider, such as Google, Microsoft, or Dropbox, may be independently responsible for certain Processing carried out within its platform under its own terms and privacy policy.

12. Data Retention and Destruction

We retain Personal Data for as long as necessary to fulfill the purposes described in this Policy and provide the service during the subscription, and thereafter for periods required by legal, accounting, or tax obligations, dispute resolution, or protection of rights.

Retention periods vary according to the type of data, the nature of the relationship, the purpose of Processing, and legal requirements. When the lawful need ends, data is destroyed or de-identified by appropriate means unless retention is required by law, a decision of a competent authority, or an existing dispute.

The Customer is responsible for exporting the copies of its data that it requires before its subscription ends, in accordance with the agreement, Terms of Use, and features available in the System.

Limited copies of data may remain temporarily within backup cycles or security logs until replaced or destroyed under the approved operational schedule, with use restricted to recovery, security, and compliance purposes.

13. Data Protection and Information Security

Bayanatech applies reasonable technical and organizational measures appropriate to the nature of the data and risks, designed to prevent unauthorized access, loss, alteration, disclosure, or unlawful use.

These measures may include permission management, authentication, event logging, security updates, communications protection, operational backup, failure and incident monitoring, and access controls for operating environments.

No electronic transmission or storage method guarantees absolute security. The Customer and User must therefore maintain the confidentiality of login details, use appropriate verification methods, keep devices updated, and notify us immediately of suspected unauthorized access.

If a Personal Data breach occurs, Bayanatech takes the necessary measures to investigate, contain, remediate, and notify in accordance with applicable legal requirements and its role as Controller or Processor.

14. Rights of the Data Subject

Subject to applicable legal conditions and exceptions, the Data Subject has the following rights:

The right to be informed of the lawful basis and purpose for collecting and processing the Data Subject’s data and the parties to whom it may be disclosed.

The right to access Personal Data and obtain a copy in a clear and readable format where legally and technically available.

The right to request correction, completion, or updating of inaccurate data.

The right to request destruction of data when the purpose of Processing ends or in other cases prescribed by law.

The right to withdraw consent where consent is the basis for Processing, unless another lawful basis permits Processing to continue.

The right to submit a complaint to the competent authority in accordance with legal procedures.

If the requested data is controlled by a Tameer Customer, we may refer the request to or cooperate with the relevant Customer because that Customer determines the purposes and instructions of such Processing.

15. Exercising Rights and Submitting Requests

A privacy request may be submitted by email to info@bayanatech.com.sa or through approved support channels within Tameer. The request should describe the action sought and include information needed to verify identity and identify the relevant account or establishment.

We may request reasonable additional information to verify the identity or capacity of the requester. Such information will be used only for verification and fulfillment of the request. A request may be refused or restricted where permitted by law, with reasons provided where required.

We process requests within applicable statutory periods. A request may require coordination with the Customer if the Data Subject’s information is stored within an establishment account subscribed to Tameer.

16. Cookies and Similar Technologies

The Tameer website may use cookies and similar technologies necessary to operate the website, maintain sessions, apply language or appearance settings, protect forms, and measure performance when analytics tools are enabled.

Website forms use Google reCAPTCHA to help prevent automated messages and misuse. Google may process technical data under its own Privacy Policy and Terms of Service.

Users can manage cookies through browser settings, but disabling necessary cookies may affect login or certain website and service functions. If non-essential or marketing cookies are used, consent choices will be presented in accordance with applicable requirements.

17. Children’s Data

Tameer is a service intended for establishments and professional Users and is not directed to children. A child’s data should not be uploaded to the System unless there is a legitimate purpose and lawful basis and the special legal requirements and safeguards have been implemented.

18. Responsibilities of the Customer and User

The Customer must collect and use data lawfully, define permissions according to need, review them periodically, provide appropriate notices to Data Subjects, and avoid uploading data that exceeds the need or for which it has no lawful basis.

The User must not share login details or verification codes, link a cloud storage account that the User is not authorized to use, or send Personal or sensitive data through channels not designated for that purpose.

The Customer must contact us without delay upon discovering inaccurate data, unauthorized disclosure, or a request from a Data Subject concerning information stored in Tameer.

19. Updates to the Privacy Policy

Bayanatech may update this Policy when laws, services, Processing methods, or security requirements change. The date of the latest update will be published at the top of the page, and Customers will be notified of material changes through the website, System, or email when appropriate or required.

An update takes effect on its publication date or the date specified in the notice. Updates do not affect rights acquired by a Data Subject under applicable law.

20. Contact and Complaints

Controller and service provider: Bayanatech Information Technology Establishment.

Product: Tameer for Enterprise Management.

Website: www.bayanatech.com.sa.

Contact email: info@bayanatech.com.sa.

Approved support channels within Tameer may also be used. If a complaint is not resolved, the Data Subject may submit it to the competent authority in accordance with the Personal Data Protection Law and its procedures.

21. Governing Language

This Policy is published in Arabic and may be made available in English for convenience. In the event of a difference in interpretation, the Arabic version shall prevail unless otherwise required by law.