Privacy Policy

1. Introduction

This Privacy Policy explains how TopNote (Ktechclans) ("TopNote", "we", "us", or "our") collects, uses, discloses, and protects your information when you use the TopNote ZATCA E-Invoicing System and related websites, applications, and services (collectively, the "Service").

We are committed to protecting your privacy and to processing personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its implementing regulations, as well as the requirements of the Zakat, Tax and Customs Authority (ZATCA). By using the Service, you agree to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

• Account & business information: business name, commercial registration and VAT registration numbers, address, contact person, email, and phone number.
• Transaction & invoicing data: invoices, customer records, product and pricing data, tax details, and QR-code data required to generate ZATCA-compliant e-invoices.
• Payment information: subscription and billing details. Card payments are processed by licensed third-party payment providers; we do not store full card numbers.
• Usage & technical data: device type, browser, IP address, log data, and how you interact with the Service.
• Communications: messages you send us via WhatsApp, email, or support channels.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service and generate ZATCA-compliant tax invoices;
• Set up your account, list your items, and deliver onboarding and technical support;
• Process subscriptions, payments, and renewals;
• Improve, secure, and troubleshoot the Service;
• Communicate with you about updates, offers, and service notices;
• Comply with legal, tax, and regulatory obligations, including ZATCA requirements.

4. E-Invoicing & ZATCA Data

To deliver a compliant e-invoicing (Fatoora) experience, the Service processes invoice and tax data and, where you use Phase 2 (Integration), transmits required invoice data to ZATCA's platform in the formats mandated by the Authority. This processing is necessary to meet your legal obligations under Saudi e-invoicing regulations. You remain the controller of your business and customer records; TopNote processes this data on your behalf to enable compliance.

5. Legal Basis for Processing (PDPL)

We process personal data where: (a) it is necessary to perform our contract with you; (b) it is necessary to comply with a legal obligation, such as tax and e-invoicing laws; (c) you have given consent; or (d) it is necessary for our legitimate interests in operating and securing the Service, balanced against your rights.

6. Cookies & Tracking

We use essential cookies to keep you signed in and to remember preferences such as your chosen language. We may use limited analytics to understand how the Service is used and to improve it. You can control cookies through your browser settings; disabling essential cookies may affect functionality.

7. Data Sharing & Disclosure

We do not sell your personal data. We may share information with:

• ZATCA and government authorities, where required for e-invoicing compliance or by law;
• Service providers (e.g., cloud hosting, payment processing) who act on our instructions under confidentiality obligations;
• Professional advisors or regulators, where necessary to comply with legal requirements or protect our rights.

8. Data Security

We apply bank-grade security measures, including encryption in transit and at rest, access controls, and regular backups, to protect your data against unauthorized access, alteration, or loss. While no system is completely immune to risk, we work continuously to safeguard your information.

9. Data Retention

We retain your information for as long as your account is active and as required to provide the Service. Invoice and tax records are retained for the periods required by Saudi tax and e-invoicing regulations. When data is no longer required, we securely delete or anonymize it.

10. Data Storage & Transfers

We aim to store data on infrastructure appropriate for the Kingdom of Saudi Arabia. Where any transfer outside the Kingdom is necessary, we do so in line with the PDPL and apply appropriate safeguards to protect your data.

11. Your Rights

Subject to applicable law, you have the right to: be informed about how your data is processed; access your data; request correction of inaccurate data; request deletion; object to or restrict certain processing; and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below.

12. Children's Privacy

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Significant changes may be communicated to you directly.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• WhatsApp / Phone: +966 59 201 7834
• Email: Hi@ktechclans.com
• Website: Ktechclans.com