Privacy and Data Protection Policy

Article 1: Preamble and Scope

This Policy is issued by CODE Communications and Information Technology Company (the "Company"), the owner and operator of the SAVOXX Cloud Communications Platform, and shall apply to all clients and end users who interact with the Platform in any manner whatsoever.

The SAVOXX Platform now includes integrated omnichannel communication capabilities via third-party social media APIs, including but not limited to Meta platforms (Facebook Pages, Instagram Business Accounts, and WhatsApp Business Accounts). By integrating these channels, clients authorize the Company to facilitate API-mediated communications with such platforms in accordance with this Policy.

The Company is committed to compliance with the Personal Data Protection Law promulgated by Royal Decree No. M/19 of 1443 AH (the "Law") and its Implementing Regulations, as well as all related regulations issued by the Communications, Space and Technology Commission (CST) and the Human Rights Commission of the Kingdom of Saudi Arabia.

Your use of the SAVOXX Platform constitutes your express consent to the provisions of this Policy in their entirety. Should you object to any provision hereof, you must refrain from using the Platform and notify the Company in writing.

Article 2: Definitions

The following terms, as used in this Policy, shall have the meanings set forth opposite each:

Article 3: Data We Collect

3.1 — Data Provided by the Client

The Company collects the following data voluntarily provided by the Client or required by virtue of the contractual relationship:

• Identification Data: trade name, commercial registration number, national address, and official correspondence email
• Authorized Representative Data: name, mobile number, email address, and job title
• Billing Data: invoice and payment information in accordance with the requirements of the Zakat, Tax and Customs Authority (ZATCA)
• Regulatory Compliance Data: information required by the Communications, Space and Technology Commission for the activation of DID lines
• Social Media Account Authorization: API credentials and tokens necessary to connect and authenticate integrated Social Media Channels, securely stored and encrypted

3.2 — Automatically Generated Data

The Platform automatically generates the following data upon use of the Service:

• Call Records: calling and called numbers, call duration, timestamps, and call status
• Call Recordings: retained for a period not exceeding thirty (30) days unless the Client requests an extension pursuant to a separate paid agreement
• Social Media Messages and Interactions: messages, replies, and interactions received through integrated Social Media Channels, processed and stored within SAVOXX for unified management and client access
• Technical Usage Data: IP addresses, device and browser types, session durations, and error logs
• Performance Data: aggregated service statistics and reports attributed to the Client rather than to individuals

3.3 — Prohibited Data

The Company undertakes not to collect, and does not accept through its Platform, the following data. The Client shall not input or request the processing of:

• Credit card numbers or direct bank account details through the Platform
• Sensitive health, genetic, biometric, political, or religious data
• Data of children under the age of eighteen (18)
• Any data that contravenes the laws and regulations in force in the Kingdom of Saudi Arabia
• Social media data obtained without the consent of the originating individuals or in violation of the third-party platform's terms of service

Article 4: Purposes of Data Processing

The Company processes Personal Data exclusively for the following lawful purposes:

1. Provision of Platform Services: subscription activation, DID number management, delivery of functional VoIP communications, and facilitation of omnichannel social media integration
2. Contractual Relationship Management: issuance of invoices, payment follow-up, and operational communications with the Client
3. Regulatory Compliance: fulfillment of the requirements of the Communications, Space and Technology Commission, the Zakat, Tax and Customs Authority, and other regulatory bodies
4. Technical Support: diagnosis and resolution of faults and improvement of service performance across all integrated communication channels
5. Security and Protection: detection of unauthorized use, fraud prevention, and protection of the communications infrastructure
6. Development and Improvement: analysis of aggregated usage patterns to enhance the service experience — without identifying individuals

The Company does not use Personal Data for advertising purposes on behalf of third parties, nor does it sell or lease data to any party. The Company does not share Personal Data with Social Media Channels beyond what is necessary for the Client to facilitate its own communications through those channels via APIs.

Article 7: Data Retention Periods

The Company retains data for the periods set forth below, following which such data shall be securely deleted or anonymized in accordance with documented procedures:

Article 14: Third-Party Platform Policies

The SAVOXX Platform integrates with third-party Social Media Channels. The Company does not control the data handling practices of these third-party platforms. Clients should review the privacy policies and terms of service of each Social Media Channel they choose to integrate:

The Company's responsibility is limited to securing the API connection and protecting data while it resides within the SAVOXX infrastructure. Once data is transmitted to or from integrated Social Media Channels, the respective third-party provider's privacy policies apply.

Article 16: Contact and Data Protection Office

For any inquiry or request relating to this Policy or the exercise of your rights, you may contact us through:

Your request shall be processed within thirty (30) days of receipt. In complex cases, the period may be extended by no more than sixty (60) days, and you shall be notified accordingly.