Legal
Privacy Policy
Effective date: 25 April 2025
1. Who we are
Alkfo ("الكفو") operates the platform available at alkfo.com — a multi-tenant SaaS product that enables businesses in the Kingdom of Saudi Arabia to accept QR-based orders, manage operations, and issue ZATCA-compliant e-invoices.
For the purposes of Saudi Arabia's Personal Data Protection Law (PDPL, Royal Decree M/19 of 1443H) and this Policy, Alkfo acts as the data controller for information collected directly from business operators and visitors to our marketing website, and as a data processor for personal data of end-customers (customers) processed on behalf of business operators.
Contact us at support@alkfo.com for any privacy-related enquiry.
2. Data we collect and why
2.1 Business operators (subscribers)
| Category | Purpose | Legal basis (PDPL) |
|---|---|---|
| Name, email, phone number | Account creation, support, billing communications | Contractual necessity |
| Business name, VAT number, address | ZATCA invoicing, tenant configuration | Legal obligation / contractual necessity |
| Payment card details | Subscription billing (processed by our payment provider; we do not store raw card data) | Contractual necessity |
| Usage logs, feature interactions | Platform improvement, troubleshooting, security | Legitimate interest |
| IP address, browser/device info | Fraud prevention, service security | Legitimate interest |
2.2 Customers (end-customers of businesses)
When you place an order at a business powered by Alkfo, that business is the data controller for your personal data. We process it solely on their instructions. Data collected may include your name, phone number, location or delivery address, and order history.
2.3 Website visitors
When you browse alkfo.com we do not use third-party analytics cookies or tracking services. All platform analytics are collected through our first-party backend systems for business intelligence purposes only.
2.4 Order notifications and Alkfo Pager
If you follow an order in the Alkfo Pager app, its App Clip or your browser, we process a notification token and the order it belongs to so we can send you that order's updates. The details, including who receives it and how long it is kept, are in the Alkfo Pager privacy policy.
3. How we share your data
We do not sell personal data. We share data only in these circumstances:
- Service providers: Cloud infrastructure, payment processors, email delivery, and analytics vendors acting as data processors under contractual obligations consistent with the PDPL.
- ZATCA: Tax-related invoice data is transmitted to the Saudi Arabian Tax and Customs Authority as required by the e-invoicing regulations (Phase 2).
- Legal requirements: We will disclose data when required by applicable Saudi law, a court order, or a valid governmental request.
- Business transfers: If Alkfo is acquired or merges with another entity, your data may be transferred as part of that transaction, subject to equivalent protections.
4. International transfers
Our primary infrastructure is located in the Kingdom of Saudi Arabia. Some sub-processors (e.g., email delivery, analytics) may operate outside the KSA. Where such transfers occur, we ensure they are covered by appropriate contractual safeguards and are permitted under PDPL regulations.
5. Data retention
- Operator account data: Retained for the duration of the subscription plus 3 years, or as required by law.
- Financial and invoice records: Retained for 10 years as required by ZATCA e-invoicing regulations and the Saudi Companies Regulations.
- Customer order data: Retained per the business operator's instructions and their own retention policy.
- Website analytics: Aggregated and anonymised after 24 months.
6. Cookies
We use cookies to operate the platform and improve your experience. For full details, including how to manage your preferences, see our Cookie Policy.
7. Your rights
Under Saudi Arabia's PDPL, you have the right to:
- Know what personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data, subject to legal retention obligations.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with the National Data Management Office (NDMO).
To exercise any of these rights, contact us at support@alkfo.com. We will respond within 30 days.
8. Data security
We implement industry-standard technical and organisational measures including encryption in transit (TLS 1.2+) and at rest, role-based access controls, regular security reviews, and audit logging. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we commit to prompt notification of any breach that affects your rights.
9. Children
Our platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, please contact us and we will promptly delete it.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified to registered operators by email at least 14 days before taking effect. The "Effective date" at the top of this page always reflects the current version. Continued use of the platform after the effective date constitutes acceptance of the updated Policy.
11. Contact
Alkfo — Privacy Team
Kingdom of Saudi Arabia
support@alkfo.com