Privacy Policy

1 Who we are

Sadeem Cloud is a managed Odoo hosting and ERP implementation provider. We operate through two legal entities. The entity responsible for your information is the one named on your quotation, contract or invoice.

In this policy, "Sadeem", "we", "our" and "us" refer to the relevant entity above. "You" refers to any visitor, prospective client, client or authorised user of our services.

2 Scope of this policy

This policy applies to:

• The sadeem.cloud website and all of its subdomains.
• The Sadeem hosting control panel and the Odoo instances we manage.
• Our support channels, including the helpdesk, email and WhatsApp.
• Our marketing communications and events.
• Our professional services: implementation, configuration, custom development, migration, training and consulting.

This policy does not apply to third party websites you reach through links on our site, nor to how Odoo S.A., Zoho or any other vendor handles data under their own agreements with you.

3 Information we collect

3.1 Information you give us

• Name, job title and company name.
• Email address, phone number and WhatsApp number.
• Country and city.
• Billing and tax details, such as commercial register number and VAT number.
• The content of your messages, demo requests, quotation requests and support tickets.
• Information contained in job applications, when you apply through our careers pages.

3.2 Information collected automatically

• IP address and approximate location derived from it.
• Browser type and version, operating system and device type.
• Referring page, pages visited, date and time of visit and time spent on each page.
• Diagnostic data and error logs.

3.3 Service and infrastructure data

• Server, application and access logs for the instances we manage.
• Resource usage such as CPU, memory, storage and bandwidth.
• Backup metadata, such as timestamps, size and status.
• Support tickets, their attachments and any remote session records.

3.4 Payment information

We do not store card numbers on our systems. Card details are transmitted directly between you and payment providers that comply with PCI DSS. For bank transfers we keep only the details required for accounting and reconciliation.

3.5 What we do not collect

We do not knowingly collect sensitive categories of personal data (such as health data, religious belief or biometric data) through our website, our sales process or our support channels. Please do not send us such data unless it is strictly required for a service you have contracted.

4 How we use information

We use the information described above for the following purposes, on the following legal bases:

We do not use your personal data for automated decision making that produces legal effects for you.

5 Cookies and tracking

We use strictly necessary cookies to keep your session active, to protect the site and to remember your language and preferences. These cannot be switched off without breaking parts of the site.

Subject to your consent, we also use analytics and marketing cookies to understand how the site is used and to measure our campaigns. You can refuse or delete cookies at any time from your browser settings.

Full details, including the categories and providers we use, are in our Cookie Policy.

6 When we share information

We share information only with the following categories of recipients, and only to the extent needed:

• Infrastructure providers that host our platform: OVH, Hetzner, Oracle Cloud, Contabo and Amazon Web Services.
• Network and security providers, such as Cloudflare, for content delivery and protection against attacks.
• Business software providers we use to operate Sadeem, including Odoo S.A., Zoho and our email and messaging providers.
• Payment providers and banks, for the purpose of collecting fees.
• Professional advisors such as accountants, auditors and lawyers, under a duty of confidentiality.
• Public authorities, where a valid legal request or a tax obligation requires disclosure.

Each provider is engaged under a written agreement that limits their use of the information to the service they supply to us.

7 Hosting region and international transfers

Sadeem operates from Saudi Arabia and Egypt, and runs infrastructure in data centers located inside the Kingdom of Saudi Arabia, in Europe and in the wider Middle East.

Clients who need their data to remain inside the Kingdom can be provisioned on our Saudi region. The hosting region of your instance is stated in your service order, and it is never changed without prior written notice to you.

Where personal data is transferred outside your country, we rely on the transfer safeguards permitted by the applicable law, including contractual commitments with each provider and, where relevant, the conditions set by the competent data protection authority.

8 How long we keep data

You may ask us to delete data earlier where no legal obligation requires us to keep it.

9 Your business data

For the data our clients store inside their own hosted databases, such as their customers, employees, invoices and documents, the client is the data controller and Sadeem acts as a processor.

• We process that data only on the client's documented instructions.
• We never use it for our own purposes and never sell it.
• Our staff access it only when needed to diagnose or resolve an issue, using individual internal credentials rather than your password, with actions recorded in a separate audit trail.
• Each client runs in a dedicated, isolated database. Cross database access is not permitted.

A data processing agreement covering this relationship is available on request from [email protected].

10 Security

In summary, we protect information using:

• A dedicated, isolated database for every client.
• Hardened Linux servers with regular security patching.
• Encrypted SSH key access, limited to a small number of trusted engineers.
• 256-bit TLS encryption in transit and encrypted internal traffic between servers.
• Firewalls, intrusion prevention and DDoS mitigation at the network edge.
• Daily backups replicated across at least two data centers on two continents, with a recovery point objective and recovery time objective of 24 hours.

The full technical description is published on our Data Privacy page.

No system can be guaranteed to be perfectly secure. If a breach affects your personal data, we will notify you and the competent authority within the periods set by the applicable law.

11 Your rights

Depending on where you are located, you may have the right to request access to your personal data, to correct it, to delete it, to restrict or object to how we process it, to receive it in a portable format, and to withdraw consent that you previously gave.

• Saudi Arabia: the Personal Data Protection Law and its regulations, supervised by the Saudi Data and Artificial Intelligence Authority.
• Egypt: Personal Data Protection Law No. 151 of 2018 and its executive regulations.
• European Union and United Kingdom: the General Data Protection Regulation, where it applies to our processing.

To exercise a right, write to [email protected] with the subject "Data request". We reply within 30 days. We may ask you to confirm your identity before we act, so that we do not disclose data to the wrong person.

You also have the right to lodge a complaint with the competent supervisory authority in your country.

12 Children

Our services are designed for businesses and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13 Changes to this policy

We may update this policy to reflect changes in our services, our providers or the law. The version number and effective date at the top of this page always show the current version.

When a change materially affects your rights, we notify active clients by email at least 14 days before it takes effect.

14 How to contact us

For any question about this policy, about your data, or to exercise one of your rights:

Related documents: Terms and Conditions, Cookie Policy, Data Privacy, Sadeem Source-Available License.