Privacy Policy

The controller (Controlling Entity) responsible for the processing described in this Policy is Medina Camps Consulting Company, a company registered in the Kingdom of Saudi Arabia, with its address at Al Madinah, Al Mabuth District, Saudi Arabia. Our commercial registration and tax registration details are shown on our invoices and in the service agreement.

You can contact the person responsible for personal data protection matters about any question relating to personal data, including the exercise of your rights, using the contact details in the section “Contact us”.

This Policy applies to personal data processed through the BusinessEye platform, in particular:

Our marketing website at businesseye.app may be governed by its own privacy notice. Third-party services that you reach through links on our pages (for example social media platforms or map services) are governed by their own policies.

Please do not enter personal data of other persons in the public demonstration mode: content entered there can be seen by anyone who opens the demonstration and is deleted periodically.

• the shop application and the back office at system.businesseye.app;
• the display pages shown on screens at shop entrances (addresses beginning with /s/) and the TV pairing page (/tv);
• the digital menu pages for guests of restaurants and cafés (/m/) and the “Follow us” link pages (/f/);
• the links sent to customers to review and sign contracts and to download signed contracts (/sign/ and /v/);
• the product brochure and the public demonstration mode (/demo);
• the room screens for hotel guests (/r/ and /h/), the car catalogue pages (/c/), and the scripts and interfaces that a shop connects to its own website, telephone system, booking system or hotel system;
• communications with us by email, telephone, WhatsApp or in person, including visits by our field sales staff.

For the data of our customers (the businesses that use BusinessEye), their users, the parties to our contracts and prospective customers, we act as the controller.

Shops decide which content they display, publish and post using BusinessEye. If a shop enters personal data of its own customers, employees or other persons into the service (for example a photograph of a person in a poster or a social media post), the shop is the controller of that data, and we process it on the shop’s behalf and in accordance with its instructions as a processor (Processing Entity). The shop is responsible for having a legal basis for such data and for informing the persons concerned. We will reasonably assist the shop in responding to requests from those persons.

This applies in particular to the data that a shop manages with the CRM, Call Center, Marketing and Room Screens add-ons – its customers, callers, guests, leads and the visitors of its website. The shop must inform these persons, including about the recording, transcription and evaluation of telephone calls and about the measurement of its website, and must obtain their consent where the law requires it.

Depending on how BusinessEye is used, we process the following categories of personal data. We collect only the data that is necessary for the purposes described in this Policy.

We do not intentionally collect sensitive data within the meaning of the PDPL (such as health, genetic, biometric, religious or criminal data). Please do not include such data in content that you upload.

• Account data: name, email address, telephone number, role and permissions within the shop (for example administrator or branch login), branch assignment, and language and display preferences. Passwords are never stored in readable form; we store only a one-way cryptographic hash (bcrypt).
• Business and contract data: trade name, commercial registration number, VAT number, national address, the name and contact details of the owner, the contact person and the signatory, the selected packages and prices, contract dates, and the image of the handwritten signature provided when signing electronically, together with the date and time, IP address and browser information recorded when a contract is signed or a contract amendment is approved.
• Billing data: invoice details, payment status and related accounting records. Payment card data is not collected through BusinessEye.
• Screen and marketing content: posters, logos, photographs, texts, opening hours, prices, menus, designs and social media posts that a shop creates or uploads. This content normally relates to the business but may contain personal data if the shop includes it.
• Field sales data about prospective customers: business name and category, contact person and contact details, address, the location of the shop (GPS coordinates, a point on a map, or the mall and floor), photographs of the shop front or signage, and notes on visits and their outcome. We do not record the movement routes of our staff.
• Technical and usage data: IP address, browser and device type, time of requests, the software version in use, status signals (“heartbeats”) sent by display screens to show that they are running, connection interruptions, and error logs. Error logs are cleaned of passwords, keys and tokens before they are stored.
• Activity logs: records of changes made in the system (who changed what and when, with the previous and the new value), sign-ins, and support access by our staff to a shop’s account. Passwords, keys and images are never recorded as values.
• Social media connection data (only if the Social Media add-on is used): the names, profile pictures and identifiers of connected accounts and the content and status of posts. Access to the social platforms is handled by our service provider Zernio; we never see or store your social media passwords.
• AI requests (only if the AI posters add-on is used): the description, settings and any images submitted to create or adjust a poster, and the usage information needed for limits and billing.
• Guests and visitors of public pages (digital menu, link pages, display pages and contract links): these persons do not need an account. We process only the technical data necessary to deliver the page securely, such as the IP address and browser in server logs. We do not use tracking, profiling or advertising technologies on these pages.
• Two-factor sign-in (if activated): the encrypted secret of your authenticator app, hashed recovery codes, trusted devices, and failed sign-in attempts with the IP address.
• Data of the shop’s own customers (only if the CRM add-on is used): names, telephone numbers and email addresses, identity document numbers where the shop records them (visible only to authorised staff), cases, notes, tasks, contracts, payments, reminders and messages, the team chat, and the attendance, shifts and performance figures of the shop’s staff.
• Call data (only if the Call Center add-on or our call app is used): the calling and called numbers, time, duration and status of calls, the branch and employee, and – where the shop’s telephone system provides a recording – a written transcript, an AI summary and a quality evaluation of the conversation. The audio recording is retrieved from the shop’s telephone system only to create the transcript and is not stored by us; on request it can be played back briefly through our server.
• Marketing measurement data (only if the Marketing add-on is used): visits to the shop’s website with a random visitor identifier, the source of the visit (for example an advertising click identifier or a campaign), bookings and calls reported by the shop, and telephone numbers only in hashed (pseudonymised) form; and the costs, clicks and impressions of the shop’s connected advertising accounts.
• Hotel guest data (only if the Room Screens add-on is used): the guest’s name, language and dates of stay, taken from the hotel’s own system.
• Recordings of conversations with our sales staff: if our staff record a conversation with a prospective or existing customer using a recording device (Pocket), they do so only with the consent of the persons involved; we store the transcript, the summary and the resulting tasks.
• Communications: messages and information you send us by email, telephone, WhatsApp or in person.

We obtain personal data directly from you (for example when an account is created, a contract is signed or content is uploaded), from the shop that created your login, automatically through your use of the service and from display screens, and, for prospective customers, from our field sales staff during a visit to the business and from publicly visible information such as shop signage. We also receive information from our service providers where this is necessary for the service, for example the status of a social media post.

We process personal data only for specified, clear and legitimate purposes and on the following legal bases recognised by the PDPL and its Implementing Regulations:

We do not process personal data for purposes that are incompatible with the purposes for which it was collected.

• Performance of a contract and steps taken before entering into a contract: to create and manage accounts; to provide the shop application, the display screens, the designer, the digital menu, the gallery and booked add-ons; to conclude, sign and amend contracts electronically; to provide equipment; and to provide support.
• Compliance with legal obligations: to issue invoices and keep accounting, commercial and tax records, including the electronic invoicing requirements of the Zakat, Tax and Customs Authority (ZATCA); to keep evidence of contracts; and to respond to lawful requests from competent authorities.
• Legitimate interests, provided that this does not prejudice your rights and interests and does not involve sensitive data: to protect the service against misuse, fraud and attacks (for example by limiting sign-in attempts and by logging); to ensure the operation and quality of display screens and to correct errors; to keep evidence in case of disputes; and to approach businesses as prospective customers in a business-to-business context.
• Consent: where the law requires consent, for example for optional services that you choose to activate or for marketing messages where consent is required. You may withdraw your consent at any time; withdrawal does not affect processing carried out before it.

We use only cookies and similar technologies that are strictly necessary for the service or that remember choices you have made. These include:

We do not use advertising cookies, analytics or tracking cookies, or third-party marketing pixels. You can delete cookies and local storage in your browser settings; some functions (such as staying signed in or working without an internet connection) will then no longer work.

The map services used by our field sales staff are provided by Google and may use their own cookies in accordance with Google’s policies.

• a secure, signed session cookie that keeps you signed in;
• cookies that store your selected language and display theme;
• a cookie indicating that a device is used by our own staff (it grants no access rights);
• local storage and a service worker in your browser for interface settings (for example which sections are open), for the role of a device as a display screen, for temporarily cached pages and images so that screens keep working without internet, and for a queue of changes made offline until they can be sent.

We do not sell or rent personal data. We disclose personal data only to the extent necessary and only to the following recipients, who are bound by contractual obligations of confidentiality and data protection:

Within a shop’s account, the shop’s administrators can see the changes made by their own team in the shop’s history.

• Vercel – hosting and operation of the application;
• Supabase – hosting of the database;
• OpenAI and Google (Gemini) – generation of AI posters and images, and (OpenAI) transcription and evaluation of call recordings, writing suggestions and translations for social media, and summaries and suggestions in the CRM, only for shops that use these functions and only with the content submitted for that purpose;
• Zernio – connection to and publication on social media, only for shops that use the Social Media add-on; the social platforms selected by the shop (such as Instagram, TikTok, X, Facebook, Google Business Profile or Snapchat) receive the published content and process it under their own terms and policies;
• Resend – delivery of emails, for example signed contracts;
• advertising platforms (Google Ads, Meta, TikTok and Snap) – only if a shop connects its advertising accounts: we retrieve costs and figures and, if the shop enables it, report bookings made by telephone or in a branch, identified by a click identifier or a hashed telephone number;
• the shop’s own telephone system or telephone provider, booking system and hotel system (for example Zaaer) – exchange of call events, recordings, customer and guest data on the shop’s instruction;
• Pocket (HeyPocket) – recording and transcription of conversations of our own sales staff, only with consent; its servers are located in the United States;
• Telegram – internal notifications to our own staff about business events (for example a new customer); these notifications contain no more than the name of the business and summary information, and no data of the shop’s own customers;
• Google (Google Maps Platform) – maps and address lookup for our field sales staff;
• our accounting and customer relationship management system – issuing invoices and credit notes, electronic invoicing and bookkeeping;
• PDF documents such as contracts and the brochure are generated on our own servers; no third party receives these documents for that purpose;
• professional advisers (such as lawyers and auditors) who are bound by confidentiality, and competent public authorities and courts where required by law.

Some of our service providers process data on servers located outside the Kingdom of Saudi Arabia (for example in India, the European Union or the United States). We transfer personal data outside the Kingdom only in accordance with the PDPL and the Regulation on Personal Data Transfer outside the Geographical Boundaries of the Kingdom, and in particular:

• where the transfer is necessary to perform the agreement with you or to provide the service you have requested, or the recipient is in a country or is an organisation that provides an adequate level of protection as determined by SDAIA;
• otherwise, subject to appropriate safeguards such as standard contractual clauses, binding contractual obligations or other mechanisms recognised by SDAIA;
• limited to the minimum personal data necessary for the purpose;
• provided that the transfer does not affect national security or the vital interests of the Kingdom; and
• after assessing the risks of the transfer where the Regulation requires such an assessment.

We keep personal data only for as long as necessary for the purposes described in this Policy or as required by law. We then destroy it or anonymise it so that it can no longer identify a person. In particular:

• day-to-day activity logs (for example changes to screen status, posters and designs, sign-in events and internal notification logs): 90 days;
• technical error logs: up to 14 days;
• contracts, signatures, contract amendments and their evidence, invoices and accounting records: for the period required by the applicable commercial, accounting, tax and electronic invoicing laws, and in any case not less than ten (10) years from the end of the relevant contract or financial year, and longer where necessary to establish or defend legal claims;
• account data and screen content: for the duration of the service agreement and thereafter for as long as necessary to complete the termination, to provide a data export on request and to handle claims, subject to the statutory retention periods above;
• data about prospective customers who did not become customers: until you ask us to delete it or until it is no longer needed for business development, after which we delete it;
• records of AI usage: for as long as necessary for usage limits, billing and accounting;
• content entered by visitors in the public demonstration mode: deleted automatically after 30 days without changes;
• call transcripts and evaluations: for the period set by the shop, at most ten (10) years; audio recordings are not stored by us;
• marketing visits and contacts: about 400 days; reported bookings and advertising costs for as long as the shop uses the add-on;
• hotel guest data: deleted one day after departure;
• CRM data: for the duration of the service agreement as managed by the shop, which can export or anonymise the data of a person at any time.

We implement appropriate organisational, administrative and technical measures to protect personal data against unauthorised access, disclosure, alteration, loss and destruction, including:

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential and for informing us immediately of any suspected misuse.

• encryption of data in transit (HTTPS/TLS);
• storage of passwords only as one-way hashes, and encryption of stored service credentials (AES-256);
• strict separation of data between shops, enforced on the server, and role-based permissions within each shop;
• protection against password guessing and other misuse through rate limiting, security headers and origin checks;
• immediate invalidation of sessions when a password is changed or “sign out on all devices” is used;
• logging of changes and of support access by our staff to customer accounts;
• access to personal data by our staff only where necessary for their tasks and subject to confidentiality obligations.

Subject to the PDPL and its Implementing Regulations, you have the right to:

These rights may be restricted in the cases provided for by law, for example where we are required to keep data for tax or accounting purposes, to protect the rights of others, or to establish or defend legal claims.

• be informed of the legal basis and the purpose of the processing of your personal data, which this Policy serves to do;
• access your personal data held by us;
• obtain a copy of your personal data in a readable and clear format;
• request the correction, completion or updating of your personal data;
• request the destruction of your personal data that is no longer needed, unless we are required or permitted by law to keep it;
• withdraw your consent at any time where processing is based on consent;
• object to and stop receiving direct marketing communications at any time.

Please send your request using the contact details in the section “Contact us”. We may ask you to verify your identity before acting on a request. Requests concerning content controlled by a shop will be forwarded to that shop or handled in coordination with it.

We will respond within thirty (30) days of receiving a complete request. Where the Implementing Regulations permit an extension of this period, we will inform you of the extension and the reasons for it. Exercising your rights is free of charge, except where the law permits a reasonable fee.

Shop administrators can correct most account and content data themselves in the application.

If you believe that your personal data has been processed in breach of the PDPL, please contact us first so that we can try to resolve the matter. You also have the right to submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) in accordance with the procedures and time limits set by the Authority.

We do not sell personal data and do not use it to build advertising profiles. We do not make decisions that produce legal or similarly significant effects for you based solely on automated processing. Artificial intelligence is used only at the request of the shop: to create poster content and texts, and, where booked, to summarise and evaluate calls and to suggest next steps in the CRM. These are suggestions for people; the shop decides.

If a personal data breach occurs, we will notify SDAIA within seventy-two (72) hours of becoming aware of it where required by the Implementing Regulations. We will notify the affected persons without undue delay where the breach may cause harm to them or to their data, and will inform them of the measures they can take to protect themselves. Where we act as a processor for a shop, we will inform the shop without undue delay.

BusinessEye is a service for businesses and is not directed at persons under eighteen (18) years of age. We do not knowingly collect personal data of children. Shops must not upload personal data of children without the consent of their legal guardian where required by law.

We may update this Policy from time to time, for example when our services or the law change. The effective date is shown at the top of this Policy. Where reasonably possible, we will inform shops of material changes in the application or by email before they take effect.

This Policy is issued in Arabic and English. The Arabic version is the authoritative version; in the event of any inconsistency in wording or meaning between the two versions, the Arabic version prevails.

For any questions about this Policy or the processing of your personal data, please contact Medina Camps Consulting Company:

• Address: Al Madinah, Al Mabuth District, Saudi Arabia
• Email: info@businesseye.app
• Telephone: +966 57 314 9047
• Website: businesseye.app