Privacy Policy and Confidentiality of Information

1. Definitions

For the purpose of this Privacy Policy, the following terms shall have the meanings below:

• Zahy / Zahy Platform
  Refers to the e-commerce, POS, and digital commerce enablement platform owned by Time Solution Information Technology, including the website, application, merchant dashboard, POS system, online stores, integrations, and any current or future digital services offered under the Zahy brand.
• Time Solution Information Technology
  Refers to the legal entity that owns and operates Zahy Platform, registered in Saudi Arabia under Commercial Registration No. 1009102240 and Unified Number 7041787636.
• Merchant
  Refers to any individual or legal entity that registers on Zahy to create an online store, use POS services, manage products, orders, customers, payments, inventory, or conduct commercial activity through the platform.
• Online Store
  Refers to the online store, sales page, storefront, or digital sales channel created or managed by a Merchant through Zahy.
• Customer / Consumer
  Refers to any person who purchases a product or service from a Merchant using an online store, POS system, payment link, or any sales channel powered by Zahy.
• User
  Refers to any person who uses Zahy in any capacity, including merchants, customers, visitors, staff users, administrators, or service providers.
• Third-Party Service Provider
  Refers to any external provider connected to Zahy, including payment gateways, shipping companies, SMS providers, cloud service providers, ERP/Odoo providers, marketing tools, analytics tools, KYC providers, or any technical or operational service provider.

2. Information Collected by Zahy

Zahy may collect, store, and process different types of information, including but not limited to:

2.1 Merchant Information

This may include: Name, email address, mobile number, national ID or Iqama number, address, commercial registration details, VAT certificate, tax number, freelance certificate where applicable, authorized signatory details, bank account or IBAN details, and any documents required for verification, onboarding, KYC, payment activation, or compliance purposes.

2.2 Store and Business Information

This may include: Store name, business activity, business description, products or services offered, branches, POS locations, inventory data, payment settings, shipping settings, invoices, subscription details, packages, add-ons, and operational data related to the store.

2.3 Customer Information

This may include: Customer name, mobile number, email address, delivery address, order details, invoice details, purchase history, shipping information, and communication records related to orders or support.

2.4 Login and Usage Information

This may include: Username, encrypted passwords, login records, IP address, device type, browser type, operating system, access times, dashboard activity logs, staff permissions, and account security information.

2.5 Payment and Transaction Information

This may include: Order values, payment status, invoices, receipts, settlements, refund records, failed or successful transactions, payment disputes, chargebacks, and information received from payment gateways. Zahy does not directly store sensitive cardholder data unless such storage is handled through a licensed payment provider and in accordance with applicable security standards.

2.6 Cookies

Zahy may use cookies and similar technologies to improve user experience, remember preferences, analyze usage, improve performance, personalize content, support security, and develop services.

3. Purpose of Collecting and Using Information

Zahy may collect and use information for the following purposes:

• To create and activate merchant accounts.
• To verify merchant identity and business information.
• To conduct KYC and compliance checks.
• To provide e-commerce store and POS services.
• To manage products, orders, customers, payments, inventory, and reporting.
• To enable payment gateways and settlement services.
• To integrate with shipping companies, ERP/Odoo systems, accounting tools, and other third-party services.
• To provide customer support and technical assistance.
• To send alerts, notifications, invoices, confirmations, and service updates.
• To improve platform performance and user experience.
• To analyze store performance, sales, and operational activity.
• To comply with applicable laws and regulations in Saudi Arabia.
• To detect, prevent, and investigate fraud, misuse, illegal activity, or security incidents.
• To protect the rights of Zahy, merchants, customers, and third parties.
• To send operational, marketing, or promotional communications where legally permitted.

4. Store Revenue, Product, and Service Information

Due to the nature of Zahy as an e-commerce and POS platform, Zahy may have access to certain operational information related to merchants’ stores, such as: Sales volume, Number of orders, Transaction values, Payment status, Products or services offered, Store performance, Inventory data, Branch and POS activity, Refunds, cancellations, and returns, Complaints or support tickets related to the store. This information is used for operational, analytical, support, compliance, and platform improvement purposes.

5. Customer Information of Merchants

Zahy may process customer information to the extent necessary to operate the platform and support merchants, including order processing, payment handling, invoicing, delivery coordination, customer service, and reporting. The Merchant remains responsible for its direct relationship with its customers, including compliance with applicable laws, customer communication, refund policies, exchange policies, shipping policies, and privacy disclosures within its own store.

6. Sharing of Information

Zahy is committed to maintaining the confidentiality of user information and does not share information except where necessary for service delivery, legal compliance, or legitimate business purposes. Information may be shared with: Payment gateways, Banks, Shipping companies, SMS providers, Cloud providers, ERP systems, fraud prevention providers, and Governmental authorities when required by law.

7. Security and Confidentiality of Information

Zahy applies reasonable technical, administrative, and organizational measures to protect user information, including: Electronic security systems, Restricted access permissions, Encrypted passwords, Login monitoring, and Internal access controls. However, users acknowledge that the internet cannot be guaranteed to be 100% secure. Users are responsible for maintaining the confidentiality of their login credentials.

8. Data Breach Notification

If a security breach occurs that results in unauthorized access, loss, leakage, or unlawful modification of personal data, Zahy will take necessary measures to address the breach and reduce its impact. Where legally required, Zahy may notify the relevant authorities and affected users in accordance with applicable laws and regulations in Saudi Arabia.

9. Third-Party Services

Zahy may provide integrations, links, or services operated by third parties. Zahy is not responsible for the privacy policies or security measures of third-party providers. Users should review the terms and privacy policies of those providers before using their services.

10. Integration with External Systems

When a Merchant activates an integration (e.g. Odoo, shipping, marketing tools), the Merchant authorizes Zahy to process, transfer, or synchronize the required data between Zahy and the external system for the specific purpose of operating that integration.

11. User Rights Regarding Personal Data

• 11.1 Right to Access: Users may request access to their personal data stored by Zahy.
• 11.2 Right to Obtain a Copy: Users may request a copy of their personal data.
• 11.3 Right to Correction: Users may request correction of inaccurate or incomplete data.
• 11.4 Right to Deletion: Users may request deletion of their personal data where it is no longer needed, unless Zahy is required to retain it for legal reasons.
• 11.5 Right to Withdraw Consent: Users may withdraw consent at any time.

12. Data Retention

Zahy retains data for as long as necessary to fulfill the purposes for which it was collected, or as required by law, compliance obligations, dispute resolution, or protection of legal rights.

13. Marketing and Operational Communications

Zahy may use user contact information to send service notifications, security alerts, platform updates, invoices, technical support messages, and promotional offers. Users may unsubscribe from marketing communications.

14. User Responsibility for Data

Users are responsible for providing accurate information and for protecting their login credentials, managing account permissions, and ensuring secure use of the platform.

15. Relationship with Zahy Terms and Conditions

This Privacy Policy forms an integral part of Zahy’s Terms and Conditions. The Terms and Conditions govern the rights and obligations, while this Privacy Policy explains data handling.

16. Updates to this Privacy Policy

Zahy may update or amend this Privacy Policy from time to time. Continued use of Zahy after such update shall constitute acceptance of the revised Privacy Policy.