Flowtel Website Privacy Policy
Version 1.1 — effective 7 October 2026. This policy explains how we handle data from Flowtel website visitors and contact and demo requests.
1. Who we are and scope
This policy explains how TAZAMUN For Information Technology — شركة تزامن لتقنية المعلومات handles personal data associated with the Flowtel marketing website, flowtelpms.com, and demo and contact requests received through it. Tazamun is the controller of this data. Flowtel is a product owned by Tazamun and carries its trademark.
The policy concerns website visitors, representatives of hotels and hotel operating companies, and people contacting us about Flowtel. It does not cover guest, employee or transaction data processed within customers’ use of the Flowtel PMS and ERP product; separate arrangements and notices govern that processing according to the customer relationship.
2. Company and contact details
| Item | Details |
|---|---|
| Legal name in Arabic | شركة تزامن لتقنية المعلومات |
| English name | TAZAMUN For Information Technology |
| Commercial registration | 4030410121 |
| Address | Al Safa Administrator Tower, 10th floor, Al Masjid Al Haram Rd, Al Aziziyah Dist, Makkah KSA |
| General enquiries and privacy requests | [email protected] |
| Unified telephone number | 920014506 |
| Privacy request handling | Customer Service |
3. Data we handle
We collect information you provide in the request form or during follow-up, and create limited records to manage the request and protect the service:
| Category | Examples and whether you need to provide them |
|---|---|
| Identity and contact | Your name, organization name and organization type are required in the form. One valid email address or phone number is sufficient; providing both is your choice. |
| Organization’s needs | Number of hotels and rooms, preferred hosting for the Flowtel product, and details you write about your needs; these fields are optional. |
| Request context | Form language, area of interest, originating website page, receipt time, request reference and the associated privacy notice version. |
| Follow-up | Request status, relevant follow-up notes, update time and the status of the internal notification to our team. |
| Service protection | The network address used when processing a submission, a derived identifier to limit abusive requests, and identifiers to prevent duplicate records. The raw network address is not stored in the demo request record itself. |
| Marketing subscription, when enabled | Contact details needed for your selected channel, consent preferences and time, the notice version, and withdrawal or renewal records. |
Without the required information, the form cannot be submitted or we may be unable to respond. Leaving optional details blank does not prevent a request. This form does not request guest data, health information, national identity documents or payment information; please do not include them in the details field.
4. Purposes and grounds for processing
| Purpose | Processing ground |
|---|---|
| Responding to your request, arranging a demo, discussing your needs and a quotation, and following up on that request | Your specific consent for this purpose when submitting the request after a clear notice. |
| Sending Flowtel news and offers by email or WhatsApp | Separate, optional marketing consent for the channels you choose. |
| Protecting the service against abuse and duplicate submissions | A legitimate interest in service security, with regard to your rights. |
| Meeting an applicable legal obligation or handling a legal proceeding involving the data | The ground applicable to the particular obligation or proceeding. |
Responding to your request is separate from a marketing subscription. Visiting the website, reading this policy or submitting a demo request does not subscribe you to marketing. Processing grounds reference.
5. Marketing and communication preferences
Submitting a demo request or contacting us does not subscribe you to marketing messages. If subscription to Flowtel news and offers by email or WhatsApp becomes available, it will be optional and require separate consent for each channel you select. Declining marketing does not affect your demo request. You can withdraw consent through the unsubscribe method in a message or by emailing [email protected]; we stop marketing messages after withdrawal without unjustified delay. Direct marketing reference.
6. Who can access the data?
Authorized Tazamun staff have access according to their responsibilities, such as request follow-up, customer service and system administration. An internal notification containing the request reference, organization and area of interest may pass through our team’s email service; contact and request details remain accessible to authorized staff through the administration panel.
Depending on site operations, we use providers for hosting, databases, email and backups; a WhatsApp service may be used if that marketing channel is enabled. Managing campaigns internally does not mean that no technical provider processes data. We limit use to the purposes described here; we do not sell contact data or market it for other organizations.
Disclosure to a competent authority may take place where an applicable legal requirement calls for it, limited to what is needed. Disclosure reference.
7. Processing locations and service providers
Depending on the services used to operate the website, technical providers may handle hosting, databases, email and backups. Data may be processed in Saudi Arabia or abroad according to a service and its provider. Where personal data is transferred outside Saudi Arabia, we apply the applicable legal transfer requirements and safeguards, and limit sharing to what is needed for the purposes in this policy. Personal Data Transfer Regulation.
8. Retention and destruction
Tazamun has approved the following operational limits, with earlier destruction where the need for the data ends:
| Category | Retention period |
|---|---|
| Demo and contact requests that do not lead to a contract | Up to 12 months from submission or the requester’s last substantive contact about the request, whichever is later, while follow-up still justifies retention. |
| Inactive marketing subscription data | Up to 24 months from consent, its renewal or the person’s last explicit positive marketing-related interaction, whichever is later, while consent remains valid. |
Sending a campaign or detecting an email opening does not automatically restart the period. A service enquiry does not renew marketing consent. Data that is no longer needed is removed; complete request notes are not moved into marketing records merely to extend retention.
Where a request leads to a contract, relationship records, contracts and invoices follow their separate purposes and applicable retention obligations. Specific data may need to be retained for a legal obligation or pending legal proceeding. Retention reference: Article 18.
9. Cookies and analytics
If you agree to optional analytics, the website uses Google Analytics 4 from Google to measure page visits, referral sources, demo request clicks, and successful submissions. We do not load Google's analytics tool before your consent. You can decline or change your choice at any time using Analytics settings. When you withdraw consent, we stop measurement and delete analytics cookies that this site can remove. We send a known page path without URL parameters, a referring site's origin without its path or parameters, the page language, and event type. We do not send your name, contact details, form contents, or request reference. Google may process visit data and set analytics cookies after consent, and processing may occur outside Saudi Arabia subject to the transfer safeguards described in this policy. Operational services may use cookies or technical storage needed for their functions.
10. Your rights and how to make a request
Subject to applicable provisions, you may ask how your data is processed, access it and obtain a readable copy, correct, complete or update it, request destruction of data no longer needed, and withdraw consent for processing based on it. Rights reference.
Email [email protected], describing your request and the contact details you used. Customer Service handles requests and may ask for limited information to verify your identity; do not send an identity document initially. Withdrawing consent to process a demo request may affect our ability to continue its follow-up.
We handle rights requests without delay and within 30 days. A permitted extension of no more than a further 30 days may apply where its conditions are met, with advance notice and reasons. Marketing opt-outs do not wait for this period. Rights procedure reference.
You may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform, without having to exhaust our internal contact process first.
11. Data protection
We restrict access to request data to authorized staff according to their duties and check inputs to limit misuse. We use appropriate technical and organizational measures to protect data and review them according to risk and the nature of the service.
12. Policy updates
We review this policy when processing purposes or services change, and show the version and effective date when it is updated. We communicate material changes as appropriate and seek new consent where the processing requires it. Continued browsing alone is not marketing consent or acceptance of a new processing purpose.