1. Who we are
[Registered company name], Commercial Registration No. 7010XXXXXX, national address: [National address], provides the Keif platform. In this policy, “Keif”, “we” and “us” refer to it.
This policy applies to the processing of personal data in connection with:
- The website keif.app.
- Trial and contact requests sent to us.
- The Keif platform for running workplace coffee corners, including the employee app, the barista app and the dashboard at go.keif.app.
We process personal data in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, its Implementing Regulations, and the Regulation on Personal Data Transfer outside the Kingdom. For any question about personal data, contact us at legal@keif.app.
2. Our role in processing
Our legal role depends on the type of data:
- When we are a controller: we are the controller of website visitor data, trial and contact request data, and data about representatives of customer organizations with whom we deal to enter into, perform and manage the contract.
- When we are a processor: the customer organization (the employer) is the controller of the data it enters into the platform, or that is generated in it, about its employees and users, because it decides what data is entered and for what purpose. We process that data on its behalf and for its benefit, under our agreement with it and its documented instructions.
If you are an employee of an organization that uses the Keif platform, your employer’s privacy policy is the primary reference for how your data is processed on the platform. Please direct your request to your employer first; we assist them in responding to it.
3. Definitions
The following terms have the meanings set out below and are interpreted in accordance with the Law:
- The Law
- The Personal Data Protection Law, its Implementing Regulations, and the rules issued under it.
- Personal data
- Any data, whatever its source or form, that may lead to identifying an individual specifically, or that makes it possible to identify them directly or indirectly.
- Processing
- Any operation carried out on personal data by any means, including collection, recording, saving, indexing, organizing, formatting, storage, modification, updating, consolidation, retrieval, use, disclosure, transfer, publication, sharing, linking, blocking, erasure and destruction.
- Controller
- The entity that determines the purpose and manner of processing personal data.
- Processor
- The entity that processes personal data for the benefit of and on behalf of the controller.
- Data subject
- The individual to whom the personal data relates.
- Destruction
- Any action taken on personal data that makes it impossible to view or recover it, or to identify the individual to whom it relates.
- The Authority
- The Saudi Data and Artificial Intelligence Authority (SDAIA), as the competent authority supervising the application of the Law.
4. Data we collect
We limit collection to the minimum data needed for the purposes set out in this policy. By source, this is:
A. When you visit the website
- Technical data recorded automatically in server logs, such as IP address, browser and device type, and the time and page of the request.
- The website language, stored in an essential cookie (see the Cookies section).
B. When you submit a trial request
- Required data: organization name, full name, mobile number, official email address, approximate number of employees, and organization type (startup, company or government entity).
- Optional data: approximate number of coffee corners, and an option to indicate that the organization has information-security requirements before the trial.
If the required data is not provided, we cannot review or respond to the request. Leaving the optional data blank does not affect this.
C. When you contact us
- What you provide in your correspondence with us by email, through our WhatsApp support channel, or through the contact form on the website, such as your name, email address or other contact details, and the subject and content of your message.
D. When the platform is used (data entered by the customer organization or generated during use)
- Organization profile: logo, names, country, city and username prefix.
- Account administrator: email address, mobile number and password.
- Employee data added by the account administrator manually or by file import, or by us on the customer organization’s instructions during account setup: name, username, building, floor, office, extension number, description, and account status (active or inactive).
- Locations and corners: buildings, floors and public places such as meeting halls and reception; corners with their menus, authorized employees and delivery places; and a barista account for each corner (name, username, email address and extension number).
- Orders: items, quantities, options and notes; delivery location (office or place); order status and timestamps; and cancellation reasons.
- Service requests: calling the barista with a reason, and table-cleaning requests.
- Notifications sent to app users, whether immediate or scheduled.
- Reports derived from usage data, such as most requested products, orders per corner, order completion rate, and most active users.
- A log of operations performed in the dashboard.
- Sign-in data: passwords are not stored as plain text; they are stored after being transformed with a hashing function, and password-reset codes are sent by email.
The data listed above does not include any sensitive data, such as health or genetic data, biometric data that identifies a person, data relating to racial or ethnic origin or to religious, intellectual or political belief, or security and criminal data. We ask customer organizations not to enter such data in free-text fields such as descriptions and notes.
5. Purposes and legal bases
We process personal data only for a specific and clear purpose and on a valid legal basis, as follows:
- Operating and securing the website, preventing misuse and diagnosing faults: based on our legitimate interest, without prejudice to the rights and interests of the data subject.
- Remembering the website language: based on our legitimate interest in showing the website in the appropriate language for you; this is limited to the language code.
- Reviewing a trial request, communicating about it and arranging the trial: based on our legitimate interest in responding to the request you submitted on behalf of your organization and communicating with you about it.
- Entering into and performing the contract with the customer organization, and account management, invoicing and support: based on our legitimate interest in entering into and performing the contract and communicating with the customer organization’s representatives, and on the requirements of the laws in force, such as accounting and tax requirements.
- Providing the platform services to the customer organization and its users (managing orders, corners, notifications, reports and the operations log): as a processor, under our agreement with the customer organization and its instructions. The customer organization is responsible for having a legal basis to process its employees’ data.
- Protecting accounts, verifying identity at sign-in and resetting passwords: based on our legitimate interest in protecting network and information security and, for the accounts of a customer organization’s users, within the scope of our agreement with that organization.
- Meeting legal obligations, responding to requests from competent authorities, and protecting rights in disputes: as required by the laws in force in the Kingdom.
Where we rely on legitimate interest, we confirm that the purpose does not breach any law, that our interest is balanced against the data subject’s rights, and that the processing is within what the data subject would reasonably expect. We do not rely on legitimate interest to process sensitive data.
Where we ask for your consent to a particular processing activity, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it. We do not use data for purposes incompatible with the purpose for which it was collected. We do not use your personal means of contact to send advertising or marketing material without your prior consent, and we provide a clear and easy way to stop receiving it at any time.
7. Transfers outside the Kingdom
Some personal data may be processed or stored outside the Kingdom of Saudi Arabia. This includes messages sent through WhatsApp, which is a service provided by a third party, and may include some of the technical service providers we use. Personal data is transferred outside the Kingdom, or disclosed to an entity outside the Kingdom, only in accordance with the Law and the Regulation on Personal Data Transfer outside the Kingdom, including the following requirements:
- The transfer must not prejudice national security or the vital interests of the Kingdom, and must be limited to the minimum data necessary.
- The transfer must be to a country or organization with an adequate level of protection, or must be made under an approved appropriate safeguard, such as standard contractual clauses, binding common rules or certificates of accreditation.
- A risk assessment must be carried out where the Law requires one.
For platform data that we process on behalf of a customer organization, we also comply with what we agree with that organization on this matter.
You can contact us at legal@keif.app to ask about the entities outside the Kingdom to which your data may be transferred.
8. Retention and destruction
We keep personal data only for as long as necessary to achieve the purpose for which it was collected, and then destroy it, or keep it after removing everything that could identify the individual specifically, according to the following criteria:
- Server logs: as long as needed for operation, security and fault diagnosis.
- Trial requests that do not lead to a contract: as long as needed to follow up on and respond to the request, after which they are destroyed, unless your organization asks us to keep them for later contact.
- Customer organization and representative data: for the term of the contract, and then for any period required by law, such as accounting and tax requirements.
- Platform data we process on behalf of a customer organization: in accordance with our agreement with it; on termination, we return or destroy the data according to its instructions, unless a law requires us to keep it.
Data may be kept after its purpose has ended where a law requires it, or where it relates to a case pending before a judicial authority, limited to that need and its duration.
9. Data security
We take reasonable organizational, administrative and technical measures, consistent with recognized practice, to protect personal data against unauthorized access, disclosure, alteration, loss or damage. These include:
- Limiting access to data to those whose duties require it.
- Storing passwords after transforming them with a hashing function, without keeping the plain text.
- Working with service providers whose terms include confidentiality and appropriate security commitments.
- Reviewing and updating these measures in proportion to the nature of the data and the risks.
However, no method of electronic transmission or storage is completely secure.
If a leak, damage or unlawful access to personal data occurs and we are the controller, we notify the Authority no later than seventy-two hours after becoming aware of the incident where it may harm the personal data or data subjects or conflict with their rights or interests, and we notify affected data subjects without undue delay where it may harm their data or conflict with their rights or interests, as required by the Law.
If the incident concerns data we process on behalf of a customer organization, we notify that organization without undue delay and provide the information available to us so that it can meet its obligations as controller.
10. Your rights
The Law gives you the following rights in relation to your personal data:
- Right to be informed: to be told the legal basis for, and the purpose of, collecting your data, which this policy is intended to provide.
- Right of access: to view the personal data we hold about you.
- Right to obtain your data: to obtain a copy of your personal data in a readable and clear format.
- Right to request correction: to ask for your data to be corrected, completed or updated.
- Right to request destruction: to ask us to destroy your personal data that is no longer needed, unless there is a legal basis for keeping it.
You may also withdraw your consent at any time where the processing is based on consent.
To exercise any of these rights, email us at legal@keif.app. We may ask for reasonable information to verify your identity before acting on the request, to protect your data. We respond within thirty days of receiving the request. This period may be extended by a further thirty days if the request requires unexpected effort or where there are multiple requests, in which case we will tell you in advance and explain why. We do not charge a fee for these requests.
We may decline a request in whole or in part in the cases permitted by the Law, and will tell you the reason.
If your data was registered on the platform by your employer, please direct your request to your employer as the controller. If your request reaches us directly, we will refer it to your employer and assist them in responding under our agreement with them.
12. Children
Keif services are intended for organizations and their staff and are not directed at children. We do not knowingly collect children’s data. If we learn that a child’s data has been collected without a legal basis, we will destroy it. Where a data subject lacks full legal capacity, their legal guardian may exercise their rights under the Law on their behalf.
13. External links and services
The website or platform may link to external services, such as WhatsApp as a support channel. Those services have their own terms and privacy policies, and we do not control how they process data, so we recommend reviewing their policies before using them.
14. Changes to this policy
We may amend this policy from time to time to reflect changes to our services or to legal requirements. We update the “last updated” date at the top of this page with each change, and we notify customer organizations of material changes by appropriate means before they take effect.
This policy should be read together with the Terms of Service that govern the use of Keif services.
15. Contact and complaints
For any question, request or concern about your personal data or this policy, contact us:
- Email: legal@keif.app
- Address: [Registered company name], [National address]
We encourage you to contact us first so we can look into your concern and work to resolve it. You also have the right to lodge a complaint about the application of the Law with the Saudi Data and Artificial Intelligence Authority (SDAIA), within any time limits and following the procedures set by the Implementing Regulations, through its official channels, including the Personal Data Protection Platform (opens in a new tab).
16. Governing language
This policy is issued in Arabic and English. If there is any difference between the two versions, the Arabic text prevails.
Contact about this document
For any question or request about this document, you can contact us by email.
- legal@keif.app
- Commercial registration
- 7010XXXXXX
- Address
- [Registered company name], [National address]