Privacy policy

This policy explains what personal data the SIPS platform processes, why, and for how long. The Platform is a business tool: the people concerned are the staff of the pharmacies and suppliers that use it, and the Operator's own team. It is written to reflect what the software actually does; the retention periods below are the ones the Platform enforces automatically.

1. Controller

The entity named on the Legal notice page is the controller of the personal data processed on the Platform. Requests concerning personal data are made through the support desk.

2. Data we process

Category	Examples	Purpose
Account	Name, work e-mail, phone, role, company, language, avatar, sign-in login	Sign-in, access control, notifications
Security	Sign-in history (date, IP address, browser), failed attempts per IP address and per login, active sessions	Protecting accounts, detecting abuse
Activity	Actions taken on requests, bids, orders, payments, settings, exports — with date, IP address and browser	Audit trail required to operate a marketplace
Business	Requests, bids, orders, payment references, uploaded proofs, batch details	Running the procurement workflow
Point of sale	Sales and till sessions of a pharmacy, cashier name	Stock levels, reorder suggestions, anomaly alerts for the pharmacy
Support and chat	Tickets, messages and attachments, in-app notifications	Helping users and keeping a record of what was agreed

No data is collected from third parties, and the Platform does not build profiles or make automated decisions about a person.

3. Why we may process it

• To perform the agreement with the pharmacy or supplier the person works for.
• To comply with legal obligations (commercial and tax records, pharmaceutical traceability).
• For the Operator's legitimate interest in keeping the Platform secure and auditable.

4. Who sees what

• Suppliers see the products, quantities and delivery cities of a grouped request; pharmacy names are disclosed only on award, to the winning supplier, for the orders it must deliver.
• Pharmacies see the winning supplier's identity and the awarded prices for their own orders.
• The Operator's administrators see the full workflow, including payments and payouts, to run and audit it.
• No personal data is sold, and none is shared with advertisers.

5. Hosting and sub-processors

Every component of the Platform — the web application, the back office, the databases, the cache, uploaded files and the backups — runs on servers operated by the Operator and located in the Kingdom of Saudi Arabia. Personal data is not transferred outside the Kingdom.

Processor	Role	Data involved
Back office (Odoo, self-hosted)	Accounts, companies, products, point of sale; runs on the Operator's own servers, no data goes to the software vendor	Account, business and point-of-sale data
Transactional e-mail	Sent by the back office's mail server on the Operator's behalf: invitations, password resets, status alerts, unread chat digests	Name, e-mail address, the subject of the alert
Backups	Daily encrypted copies of the databases and uploaded files, kept for a short rolling period so the service can be restored after an incident	All of the above

6. Retention

Personal data is deleted automatically, every day, once it has outlived the period below. Business and accounting records are kept for the statutory period required by Saudi commercial and tax law and are never part of that purge.

Data	Kept for
Account (name, contact details, role, avatar)	While the account is active; archived when it is deactivated, deleted on request
Activity log	24 months
Sign-in history	24 months
Failed sign-in and rate-limit counters	30 days
In-app notifications	12 months
Chat messages	24 months
Sign-in sessions	8 hours; expired sessions are removed daily
Support tickets	While the account exists (record of what was agreed)
Orders, bids, payment and fee records	Statutory commercial and tax retention period

7. Your rights

In accordance with the Saudi Personal Data Protection Law, a person may access, correct, and where applicable delete their personal data, and may object to certain processing. On this Platform:

• Access and portability: signed-in users download a complete copy of their personal data (JSON) from the “My data” section of their profile settings; each download is recorded in the activity log.
• Correction: name, phone, e-mail, login, password, photo and language are edited directly from the profile settings; company details are corrected by the Operator on request.
• Deletion: requested through the contact given on this page. The account is deactivated and its personal data removed by the Operator after identity verification; records that the law requires the Operator to keep (orders, payments, fee documents) are retained for the statutory period.
• A person who believes their rights were not respected may lodge a complaint with the Saudi Data & AI Authority (SDAIA).

8. Cookies

The Platform uses only the cookies needed to keep a user signed in, protect forms against forgery, and remember the chosen language and display preferences. There are no advertising or third-party tracking cookies.

9. Changes

This policy may be updated. The version date is shown at the top of the page.