This policy explains what personal data Lynx Solutions Company collects when you visit this website or use Sawwy, why, who we share it with and the rights you have under the Saudi Personal Data Protection Law (PDPL).
1. Two kinds of data
- Account data: details about you and your business that you give us to open and pay for a workspace. For this data we are the controller.
- Business data: what you and your staff enter into Sawwy, such as your customers, suppliers, employees, invoices and stock. You decide what goes in and why; we process it on your behalf and only on your instructions.
2. What we collect
- Contact and sign-in details: name, work email, mobile number, password (stored only as a secure hash), language.
- Business details: business name, workspace address, VAT and commercial registration numbers, national address.
- Billing records: plan, invoices and payment status. Card details are entered with our payment provider; we receive only the card brand, last four digits and expiry.
- Usage and device data: sign-in times, IP address, browser and device type, and error logs, used to keep accounts secure and fix problems.
- Messages you send us through the contact form, email or WhatsApp.
We do not sell personal data, and we do not use your business data to advertise to you or anyone else.
3. Why we use it
- To provide the service you signed up for and keep it running (performing our contract with you).
- To bill you and issue tax invoices, and keep records the law requires (legal obligation).
- To keep accounts secure, prevent fraud and improve the service (our legitimate interests, balanced against your rights).
- To send product news or offers, only if you agree; you can unsubscribe at any time (consent).
5. Where data is kept
Your workspace is hosted in the Kingdom of Saudi Arabia. If an add-on you choose relies on a provider outside the Kingdom, we transfer only what that feature needs and only under the safeguards the PDPL and its regulations require.
6. How long we keep it
- Account data: for as long as you have a workspace, then up to 90 days after it closes.
- Billing records and our tax invoices to you: for the period Saudi tax and commercial law requires.
- Business data: deleted within 90 days of your workspace closing, after the 30-day export window.
- Backups: overwritten on a rolling cycle of no more than 35 days.
7. How we protect it
Every workspace is kept separate from others. Data is encrypted in transit and at rest, access by our staff is limited to those who need it and is logged, and we test backups regularly. Cashier accounts cannot see costs, purchases or reports, and this is enforced on our servers, not only on screen.
If a breach affects your personal data, we will tell you and the competent authority as the PDPL requires.
8. Your rights
Under the PDPL you can ask us to:
- tell you what personal data we hold about you and how we use it;
- give you a copy of it in a readable format;
- correct it if it is wrong or incomplete;
- delete it when we no longer need it;
- stop using it for something you had consented to.
Email privacy@lynx.sa. We reply within 30 days. If the request is about business data a customer of ours holds about you (for example a shop that sold to you), we will pass it to that business, because they control that data.
If you are not satisfied with our answer you can complain to the Saudi Data and AI Authority (SDAIA).
10. Children
Sawwy is a business tool and is not meant for anyone under 18.
11. Changes and contact
We will post any change here with a new date, and email account managers about important changes.
Questions or requests: privacy@lynx.sa, or Lynx Solutions Company, Jeddah, Saudi Arabia.