FLEXITAMREEN — PRIVACY POLICY (PDPL)

1) What this Policy covers

This Policy explains how we collect, use, disclose and protect personal data when you use FlexiTamreen as a Member, Employer contact or Partner Facility.

2) Data we collect

• Identification & contact: name, work email, phone, employer, department (if provided).
• Eligibility & plan: enrolment status, plan tier, activation/termination dates.
• Usage events: check-in timestamps, Facility identifier, city/country; (no continuous location tracking).
• Account & device: login records, audit logs, technical identifiers (e.g., IP address) for security.
• Support communications: content of messages you send to us.
• Payments & invoicing (employer-level): billing contact details and transaction records.

3) Why we process your data (purposes & legal bases)

• Provide the service (create accounts, validate eligibility, process check-ins) — contract performance.
• Operate dashboards & reporting (Employer enrolment/plan tiers; no per-employee visit counts) — legitimate interests.
• Security & fraud prevention (audit logs, misuse detection) — legitimate interests.
• Customer support & communications — contract performance / legitimate interests.
• Legal & tax compliance (including local VAT where applicable) — legal obligation.
• Marketing with consent (where required) — consent; you can withdraw at any time.

4) How we share data

• Partner Facilities: to confirm check-in validity we may display your name and active-status indicator at the time of check-in.
• Employer: we provide enrolment and plan-tier information; we do not provide per-employee visit counts.
• Service providers: secure vendors for hosting, analytics, and communications under data-processing agreements.
• Legal/Compliance: where required by law or to exercise/defend legal claims. We do not sell personal data.

5) International transfers

Your data may be stored or processed inside or outside Bahrain. When transferring abroad, we implement appropriate safeguards consistent with PDPL (e.g., contractual protections with processors).

6) Retention

• Account & eligibility data: life of Employer agreement + 24 months.
• Check-in logs: 24 months from event date.
• Invoices & financial records: as required by applicable law (e.g., up to 10 years).
• We may retain minimal records to comply with legal obligations or resolve disputes.

7) Your rights (PDPL)

You may access, rectify, erase, restrict processing, and object where applicable. To exercise rights, contact info@flexitamreen.com. We will verify your identity and respond within statutory timelines.

8) Security

We use administrative, technical and organisational measures (encryption in transit, access controls, logging, least-privilege) to protect personal data.

9) Children

The service is intended for adults employed by participating Employers. It is not intended for minors below the legal age for gym access.

10) Cookies & similar tech

We use essential cookies for login and session security, and (where consented) functional/analytics cookies to improve the service. See our Cookie Notice (link).

11) Changes to this Policy

We may update this Policy; material changes will be posted in-app/on our website and, where feasible, notified to Employers.