Your information, handled with care.

Scope and who this notice covers

This notice applies to the Enfinity public website, sales and marketing interactions, product demonstrations, support communications and Enfinity-operated cloud services, unless a product-specific notice or a written customer agreement says otherwise. It applies to visitors, prospective customers, customer contacts, authorized users, suppliers and event participants.

Enfinity operates across Kuwait, the UAE and the wider GCC. Privacy requirements can vary by location, sector and the role we play in a processing activity. We apply this notice alongside the applicable customer agreement, data processing terms and mandatory local requirements. If there is a conflict, the customer agreement or applicable law takes precedence.

Information we collect

We collect information you choose to give us, such as your name, business contact details, company, role and the details you share when you request a demo, support or information. When an organization uses Enfinity, we may process account, user, configuration, workflow and support information on that organization’s behalf.

We may also receive business contact information from a customer, implementation partner, referral source or event organizer where that information is shared for a legitimate business purpose. We ask organizations that provide personal information to ensure they have the appropriate authority to do so.

• Contact and enquiry information
• Account, administrator and authorized-user information
• Organization configuration, activity and support records processed in a customer tenant
• Security, audit, access and diagnostic records needed to operate and protect the services
• Website technical information, such as device, browser, IP address, referral source, pages requested and timestamps
• Communications and preferences, including survey responses, meeting notes and marketing choices

Sensitive and special-category information

Some Enfinity applications can be configured by customers to hold employment, payroll, attendance, identity or other sensitive business records. Enfinity does not require visitors to submit sensitive personal information through the public website. Customers are responsible for determining what information they place in their tenant, for configuring access appropriately and for ensuring a lawful basis for processing.

Where we process sensitive information for a customer, we do so only as necessary to provide the service, secure the environment, resolve support requests or comply with documented instructions and applicable law. Customer-specific data processing terms may contain additional safeguards and procedures.

How we use information

We use information to respond to requests, provide and improve our services, administer accounts, protect the platform, meet legal obligations and communicate relevant service information. We do not sell personal information or use customer-tenant information for unrelated advertising.

• Responding to a request, booking a demonstration or preparing a proposal
• Provisioning, operating, maintaining and supporting Enfinity services
• Authenticating users, preventing fraud and investigating security events
• Managing subscriptions, commercial relationships and service communications
• Understanding aggregate service performance and improving usability, reliability and accessibility
• Meeting accounting, recordkeeping, regulatory and legal obligations

Our legal basis and role

For direct website, prospect and business-contact interactions, Enfinity generally determines the purpose and means of processing and acts as the controller. We process information where it is necessary to respond to a request, perform or prepare a contract, meet a legal obligation, protect legitimate interests such as security and service improvement, or where consent is required and obtained.

For information in a customer tenant, the customer normally determines the purposes and means of processing and acts as the controller. Enfinity acts as a processor or service provider under the customer’s documented instructions. Data subjects should direct requests relating to their employee, customer or other organization-held records to that organization first.

Our role when your organization uses Enfinity

Your organization controls how its tenant is configured, who is invited, what data is entered, which integrations are enabled and how long records are retained. Administrators should use role-based access, review permissions regularly, protect credentials and train authorized users on appropriate handling of business data.

Enfinity personnel access customer-tenant information only when reasonably necessary to provide contracted services, support, security, legal compliance or another purpose permitted by the customer agreement. Access is subject to authorization, role controls and operational procedures.

Sharing and international transfers

We share information only with service providers and partners that help us run, secure or support Enfinity; with your organization and authorized users; or where disclosure is required by law. We require relevant service providers to protect information, use it only for approved purposes and apply security measures appropriate to their role.

Information may be processed in locations where Enfinity, our customers or approved providers operate. Where information is transferred across borders, we assess the transfer and use appropriate contractual, technical and organizational safeguards. Customers remain responsible for assessing whether a chosen configuration, integration or transfer meets their own legal and sector-specific requirements.

Retention and security

We retain information only for as long as needed for the purposes described here, our contractual obligations and applicable law. Retention periods depend on the type of information, customer instructions, the service configuration, dispute or audit needs, and statutory obligations. At the end of a customer relationship, information is handled according to the applicable agreement and documented retention or deletion process.

We use administrative, technical and physical measures designed to protect information. These may include identity and access management, least-privilege controls, encryption in transit and where appropriate at rest, environment monitoring, logging, backup and recovery procedures, vulnerability management and staff confidentiality obligations. No system can be guaranteed completely secure; we continually evaluate and improve our controls.

Marketing, communications and links

We may send business communications about Enfinity, events, product education and relevant services where permitted by law. You can opt out of marketing communications using the unsubscribe option in the message or by contacting us. Service, security, billing and account communications may still be sent where necessary for the relationship or service.

Our website may link to third-party websites, social media platforms or customer-selected integrations. Their privacy practices are governed by their own notices. Please review those notices before providing information to a third party.

Your choices and contact

Depending on applicable law, you may have rights to request access, correction, deletion, restriction or a copy of your personal information, or to object to certain processing. You may also withdraw consent where processing is based on consent, without affecting processing already carried out before withdrawal.

To make a request or ask a privacy question, contact Enfinity through our Contact page and identify the relationship or service involved. We may need to verify your identity and authority before responding. Requests involving a customer tenant will normally be referred to the relevant customer controller. We may retain a limited record of a request and our response for compliance and audit purposes.

Changes to this notice

We may update this notice to reflect changes to our services, privacy practices or applicable requirements. We will post the updated version here and change the “Last updated” date. Where a change is material, we will provide additional notice where required.