What we process and why
The personal data in your workspace (for example employees, customers, suppliers and their contacts, bank details and the people who use Naarvin) for the time you use Naarvin, only to provide, secure and support the service you chose.
Your instructions
We process the data only on your documented instructions: these terms, your settings in Naarvin and what your authorized people do in it. If we believe an instruction breaks the law, we will tell you. We will not use your data for any other purpose, sell it or use it to train AI models.
Our people
Only people who need it to run or support the service can reach your data, they are bound to confidentiality, and their access to production is recorded.
Security
- Each organization's data separated at the database level, and access limited to the companies each person may see.
- Encryption in transit and at rest; connection credentials and keys sealed and never shown again.
- Two-factor sign-in, single sign-on, confirmation before sensitive actions and approvals no one can give themselves.
- A tamper-evident audit log of every change.
- Names and identifiers masked before they reach the AI when your organization switches it on, and external AI that can be switched off entirely.
- Regular security testing and dependency scanning.
Sub-processors
You authorize the sub-processors in our current sub-processor list, which we send on request to [email protected]. Each is bound by written terms that protect the data at least as well as this agreement. We will email your organization's owners at least 30 days before a new sub-processor starts processing your data; if you object on reasonable grounds and we cannot address it, you may end the service and we will refund fees paid for the time after it ends. We remain responsible to you for our sub-processors.
Transfers outside the Kingdom
Our hosting and some sub-processors are outside the Kingdom of Saudi Arabia, as the sub-processor list shows. We transfer personal data only as the PDPL and its transfer regulation allow, with appropriate safeguards and no more data than each service needs, and we will help you with any transfer risk assessment you must make.
Helping you
We help you answer requests from the people whose data you hold (access, copies, correction, destruction), with records of processing and with impact assessments, mostly through Naarvin's own export, edit and delete functions.
Breaches
If we become aware of a breach affecting your personal data, we will tell you without undue delay and within 48 hours of confirming it, with what we know about its nature, the data and people affected, its likely effects and what we are doing. This lets you notify SDAIA within 72 hours and inform affected people where the PDPL requires it.
Deletion and return
You can export your data at any time. When the service ends, or when you ask, we delete your workspace and everything in it within 2 working days and overwrite backups within 90 days, keeping only the audit log, the record of the deletion and what the law requires us to keep. On request we confirm the deletion in writing.
Audits
We will give you the information you reasonably need to show compliance with this agreement, and answer a reasonable security questionnaire once a year, or after a breach.
Order of precedence
If this agreement and the terms of service differ on personal data, this agreement applies. A signed data processing agreement between us takes precedence over this page.