Privacy Policy

We collect the following data for the purpose of providing and improving our services:

• Identity & Contact Data: Name, email address, phone number, job title, and company name.
• Account Data: Encrypted passwords and login details for the systems we create for the client.
• Operational Data: Workflow records, Zoho data, and details of connected e-commerce stores.
• Usage & Technical Data: IP address, browser type, and cookies that are automatically collected when visiting the site to improve performance.

Your personal data is processed based on the following foundations:

• Explicit Consent: Granted by the user when agreeing to this policy or when voluntarily providing us with their data.
• Contractual Necessity: To process data necessary for executing the consulting or automation contract concluded with you.
• Regulatory Compliance: To fulfill legal obligations imposed on the company by the Ministry of Commerce, the Saudi Authority for Intellectual Property, or the Ministry of Investment.
• Legitimate Interest: When necessary to improve information system security or detect fraud, provided this does not override the rights of the data subject.

We use your personal data for the following purposes:

• Customizing and setting up Zoho One systems and automating your operational processes.
• Managing e-learning platforms (LMS), tracking learner progress, and generating reports.
• Communicating with you to provide technical support, answer your inquiries, and send project updates.
• Sending marketing materials or awareness about our new technical solutions, subject to obtaining your prior consent and providing an easy unsubscribe option.

Flovate applies advanced technical, administrative, and organizational measures to protect your data from unauthorized access, leakage, or damage, including:

• Using the HTTPS protocol for encryption when data is transmitted through the site.
• Storing sensitive data on protected cloud servers that comply with the highest national cybersecurity standards.
• Restricting data access permissions to designated employees only (Principle of Least Privilege).
• Conducting periodic vulnerability checks and adhering to National Cybersecurity Authority controls.

The company does not sell your personal data to any third party. Data may be shared in very limited cases, including:

• Supporting technical service providers (such as Zoho or website hosting) for the sole purpose of executing the contracted service, with strict confidentiality agreements binding them.
• Government or judicial authorities upon an official legal request or to protect the vital interests of the Kingdom.
• In the case of a merger or acquisition, where data is transferred to the new entity with the same protection levels maintained.

Data may be shared with trusted service providers such as Zoho or when legally required.

Due to the nature of the cloud services provided by Flovate (such as Zoho One), some data may be processed or stored in centers outside Saudi Arabia. In such cases, the company is committed to ensuring that the host country provides a level of protection equivalent to the PDPL, or by using Standard Contractual Clauses approved by SDAIA to ensure data security.

Under the Saudi Personal Data Protection Law, the client enjoys the following rights:

• Right to Know: To know the legal basis for collecting their data and its purpose.
• Right to Rectification: To request updating, completing, or correcting their personal data.
• Right to Erasure: To request deletion of their personal data upon completion of the processing purpose, unless there is a legal basis for retaining it.
• Right to Withdraw Consent: The client may withdraw their consent to data processing at any time, and this does not affect the legality of processing that took place prior to withdrawal.

To exercise any of these rights, you may contact the Data Protection Officer via email: connect@flovate.ai

Flovate retains personal data for as long as necessary to achieve the processing purposes outlined in this policy, or for the periods required by regulations and laws (such as retaining accounting records for 10 years). When the need for the data has ended, it is securely destroyed in a way that prevents its recovery or the identification of its subject.