In short
- We collect what we need to run your workspace, answer your questions and send invoices — nothing more.
- Your project files belong to your organisation. We process them on its behalf and never sell data or use it for advertising.
- We name every service provider that helps us, and why.
- Analytics on our website and marketing emails are optional.
- You can see, correct, export or delete your data. One email is enough.
This summary helps you find your way. The full text below is what applies.
01 Who is responsible #
Track Workflow is responsible (the “controller”) for personal data from our website, from contact and demo requests, and for the accounts, billing and support of our Customers.
Inside a workspace, the Customer decides what is stored and who sees it. For that content we act on the Customer’s behalf (as “processor”) and follow its instructions. If your question is about a project you work on, the organisation that invited you is usually the right first contact; we help it answer.
This policy follows the Saudi Personal Data Protection Law (PDPL) and, for people in the European Union, the General Data Protection Regulation (GDPR).
02 What we collect #
| Data | Examples | Where it comes from |
|---|---|---|
| Contact and demo requests | Name, email, phone, company, your message | You, through the contact form or WhatsApp |
| Account | Name, email, phone, organisation, role, language | You or your workspace administrator |
| Project content | Documents, drawings, photos, 360° captures, reports, comments and approvals | The Users of the workspace |
| Activity and security | Sign-ins, actions in the workspace, IP address, browser and device, times | Recorded automatically while you use the Platform |
| Website use | Pages visited, referring site, approximate location, device | Analytics cookies, only with your consent where required |
Project content can include personal data about other people too, for example workers who appear in site photos. The Customer decides what is uploaded and must have the right to do so.
03 Why we use it #
| Purpose | Legal basis |
|---|---|
| Run the workspace, sign you in and deliver notifications | Performing our contract with the Customer |
| Answer requests and give support | Your request; performing the contract |
| Keep the Platform secure, record activity and prevent misuse | Our legitimate interest in a secure service |
| Send quotations and invoices, keep accounting records | Contract; legal obligations, including tax law |
| Understand how our website is used and improve it | Your consent |
| Send news about Track Workflow | Your consent, which you can withdraw at any time |
We do not make decisions about you based solely on automated processing.
05 Transfers outside your country #
Some of these providers process data outside the Kingdom of Saudi Arabia or outside the European Union. Where that happens, we rely on the safeguards the PDPL and the GDPR provide for, such as standard contractual clauses, and we choose providers with recognised security certifications.
06 How long we keep it #
- Workspace data — while the subscription runs. After it ends we keep it for 30 days so it can be exported, then we delete it.
- Contact and demo requests — up to 24 months after our last exchange, unless they lead to a contract.
- Invoices and accounting records — as long as tax and commercial law requires.
- Backups — overwritten in their normal cycle after deletion.
07 How we protect it #
- Encrypted connections (HTTPS) between your browser and the Platform.
- Each Customer’s workspace kept separate from every other.
- Access controlled by roles and permissions, with a record of activity.
- Our own staff access data only when needed to support you.
- Regular backups.
If a breach affects your personal data, we inform the Customer and, where the law requires, the authority and you, without undue delay.
08 Your rights #
You can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer need or have no right to keep;
- restrict or object to a use, and stop marketing emails at any time;
- withdraw a consent you gave, without affecting what happened before.
Write to info@trackworkflow.com. We may ask you to confirm who you are, and we answer within 30 days. You can also complain to the Saudi Data & AI Authority (SDAIA) or, in the European Union, to the data protection authority of your country.
09 Cookies #
| Cookie | Purpose | Needed? |
|---|---|---|
| Session and security | Keep you signed in and protect forms | Yes — the site does not work without them |
| Google Analytics | Count visits and see which pages help | No — only with consent where required |
| Google reCAPTCHA | Tell people from spam bots on the contact form | Only when you use the form |
You can delete or block cookies in your browser settings at any time.
10 Children #
Track Workflow is a professional service and is not meant for people under 18. We do not knowingly collect their data.
11 Changes to this policy #
When our services or the law change, we update this policy and the date at the top. We tell Customers about important changes by email or in the Platform before they apply.
12 Contact #
Questions or requests about your data: info@trackworkflow.com, or use our contact form. Our Terms & Conditions explain how the Platform may be used.
Questions about this document?
Write to us and someone from our team answers — not a bot.