Data processing terms
How OraBlink processes the personal data inside the records a customer company enters, as its processor under the Saudi Personal Data Protection Law (PDPL).
The parties and their roles
The customer company is the controller of the report and company data it enters into OraBlink. OraBlink Company, Commercial Registration 7054814541, Dammam, Kingdom of Saudi Arabia, is its processor for that data. For the account and sign in data of users, OraBlink Company is the controller, as the Privacy notice describes.
What is processed and why
- Data: the records the customer enters (bills, sites, suppliers, emissions, evidence, report answers) and any personal data in them, such as names and e-mail addresses of supplier contacts, colleagues and people named in uploaded documents.
- Purpose: only to provide the service the customer subscribed to: store the records, calculate, prepare the customer's reports and show them to the people the customer gives access.
- Duration: the subscription term and 90 days after it ends, then the data is deleted; nightly backups are kept 14 days.
OraBlink's commitments
- Process the data only on the customer's instructions, given through the service and the subscription agreement, and for no other purpose.
- Allow access only to the people who run the service, bound to confidentiality.
- Keep the security measures in place: passwords stored only as a one way hash, two step sign in required for approving, locking, publishing and managing the team, encrypted connections, a tamper evident audit log of every change, and separation of each company's data.
- Help the customer answer requests from data subjects (PDPL Article 4) and give the information the customer needs to show compliance.
- Tell the customer without undue delay of a personal data breach affecting its data, so the customer can notify SDAIA within 72 hours as the Implementing Regulations (Article 24) require.
- At the end of the subscription, let the customer download its data and delete it 90 days after the end.
Sub processors
| Sub processor | What it does | Where |
|---|---|---|
| LightNode (lightnode.com) | Hosting of the service and its data | Riyadh II data centre, Kingdom of Saudi Arabia |
| Google (smtp-relay.gmail.com) | Relays the e-mails the service sends: recipient's name and e-mail address and the message text | Outside the Kingdom |
Customer data is stored and processed in the Kingdom. The only transfer outside the Kingdom is the one above, made as PDPL Article 29 and the Regulation on Personal Data Transfer outside the Kingdom allow.
Contact
Notices under these terms, data subject requests and breach reports: privacy@orablink.com.
Go to OraBlink