Policies & Terms

1. The entity and the scope of this policy

Think Tech Establishment (the “Establishment” or “ThinkTech”) is committed to protecting the personal data it processes through its website, the ThinkTech Engine portal, and its digital products and services. This policy applies to all visitors, users and customer representatives. Users are responsible for checking the website regularly for any updates or amendments to this policy, and updates take effect as soon as they are published on the website.

2. Controller and processor roles

1. As a “controller”: The Establishment is the controller of data relating to creating and managing platform accounts, managing subscriptions and billing, fulfilling its statutory and compliance obligations, and operational and legitimate communication, where it determines the purposes and means of the processing.
2. As a “processor”: The Establishment is the processor of the data of business and corporate customers that is uploaded to or processed within the products. This processing is carried out on the instructions of the customer (the original controller) and within the limits of the data processing agreement and the permissions and authorizations granted.

3. Data that may be collected

By its nature, and for the operation of its usual services, the platform does not request any “sensitive data”; processing is limited to the ordinary business data needed to provide the service. The customer bears statutory responsibility for any data it may upload or enter into the products, while the Establishment is committed to applying technical and organizational controls to protect that data and to process it in accordance with the customer’s instructions and the applicable regulations. The categories of data include the following:

1. Account and professional identity data: such as name, business name, email address, phone number, responsibilities and permissions.
2. Contract, subscription and billing data: such as payment and transaction records needed to evidence statutory and tax rights and obligations.
3. Service usage data and technical logs: such as network (IP) addresses, session and device identifiers, and security logs to ensure safe operation.
4. Operational business data: such as data, contacts, documents and customer service records that the customer uploads itself in order to use the products’ features.
5. External integration data: data that the user permits to be retrieved or linked through external applications, following explicit and specific authorization.

4. Purposes of processing and legal bases

Data is used to provide the contracted services, manage accounts and technical support, carry out billing and collection, protect systems, and comply with the laws and regulations applicable in the Kingdom of Saudi Arabia. Depending on the purpose, the Establishment relies on the following legal bases:

• Performance of the contract or agreement.
• Compliance with statutory provisions and requirements.
• Pursuing a legitimate interest without prejudice to the rights of the data subject.
• Obtaining explicit consent in cases where this is required by law.

5. Artificial intelligence and confidentiality

The Establishment does not use customers’ data, confidential content or business data to train general-purpose AI models or models shared between customers. AI functions and smart solutions are limited to providing the operational service directly to the customer, within the limits of its account and permissions and according to the contracted plan. The Establishment also subjects outputs and operations that have an impact to human review and approval mechanisms, and alerts users that AI outputs must be reviewed and checked before they are relied on professionally.

6. Hosting and data storage location

The Establishment is committed to hosting, storing and processing all sensitive data and customers’ operational data, databases, files, backups and operational logs containing personal data within the geographical borders of the Kingdom of Saudi Arabia.

The Establishment may use supporting technical service providers outside the Kingdom for limited purposes, such as delivering email messages and loading the website’s fonts, limited to the minimum data needed to perform the service. No personal data may be transferred or made available outside the Kingdom except in accordance with the regulatory controls and requirements issued by the competent authorities in the Kingdom (SDAIA).

7. Disclosure and data sharing

The Establishment undertakes never to sell or rent personal data. Data is disclosed or shared only to the minimum extent necessary to provide the service, with approved service providers (such as electronic payment providers, telecommunications providers and security servers) or with external platforms that the customer chooses to connect itself, subject to binding data processing agreements that preserve privacy and confidentiality.

8. Data retention periods and secure destruction

The Establishment retains data only for as long as necessary to achieve the legitimate purposes set out in this policy, to meet the statutory, financial and tax obligations applicable in the Kingdom, or to protect an established right. When the purpose or the contract ends and there is no statutory requirement to retain the data, it is destroyed or made non-identifiable in a secure and reliable manner. The end of a subscription does not mean the deletion of records that must be kept by law.

9. Data subjects’ rights and how to exercise them

Under the law, data subjects have the right to be informed and to view, access their data, obtain a copy of it, correct it, or request its destruction and deletion.

• All formal requests relating to privacy and data rights should be sent to the dedicated legal affairs email address: legal@thinktechsa.com.
• The Establishment handles and fulfils the request within (30) calendar days of verifying the identity and capacity of the requester, subject to any applicable statutory extensions, of which the requester will be notified.

10. Security, incidents and the competent authority

The Establishment applies appropriate organizational and technical measures (including encryption, access control, operational isolation and audit logs). In the event of any security incident or data leak, the Establishment is committed to notifying the Saudi Data and Artificial Intelligence Authority (SDAIA) and the affected individuals in accordance with the statutory requirements and deadlines.

11. Google Gmail Integration in WASL

ThinkTech allows users of WASL to connect their Google Gmail account so they can send emails to their customers directly from within WASL, at the user's request and according to their permissions within their organization.

1. Data and permissions used: WASL requests only the minimum permissions needed for this integration: identifying the connected Google account and its email address, and sending emails on the user's behalf using the gmail.send scope. This integration does not request permission to read the inbox, view received messages, or search, modify or delete messages.
2. How we use the data: Google account data, authorization tokens and the content of messages written by the user are used only as needed to send email from within WASL. This includes messages the user sends manually, and scheduled reports the user chooses to send automatically through their connected mailbox. Data received from Google APIs is never used for advertising or retargeting, never sold, and never used for any purpose unrelated to the service the user authorized.
3. Data protection and sharing: Authorization tokens for Google accounts are encrypted and managed by ThinkTech's secure Integration Hub, with access restricted to approved permissions. Data received from Google is not shared with third parties except as necessary to provide the functionality the user approved, for legitimate security purposes, or to comply with legal requirements. No human may read this data except with the user's explicit consent, or in the exceptional cases permitted by Google's policies.
4. Data retention and deletion: WASL keeps a copy of sent messages (recipient, subject, content and send time) in the customer's conversation history within the organization's account, for as long as the organization keeps that history. The organization can delete it at any time; the matching encrypted backups are deleted automatically within 35 days. WASL keeps no received messages, because it never reads the mailbox.
5. Disconnecting and access control: An authorized user can disconnect the Gmail account from WASL settings at any time. On disconnection, WASL stops sending from the account, and the authorization tokens are revoked at Google and deleted from the Integration Hub. Users can also manage connected-app permissions from their Google account security settings.
6. Google API Limited Use Disclosure: ThinkTech's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

12. Policy updates

This policy may be updated when laws or services change, stating the effective date and notifying users of material changes by appropriate means. Amendments are not used to justify new processing that requires separate consent without that consent being obtained.