Privacy Policy for VS-SPEND

Effective Date: October 26, 2026
Last Updated: October 26, 2026

1. Introduction

Vision Solutions SA (“we,” “our,” or “us”) operates the VS-SPEND mobile application (package name: com.fieldprocure.pettycash) (the “App”).

VS-SPEND is an enterprise application designed to support field procurement, petty cash management, expense tracking, purchase order processing, invoice management, and related business operations.

This Privacy Policy explains what personal data and other information we collect, how we use and process it, how we store and protect it, when we disclose it, and how individuals can exercise their applicable privacy rights.

We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the Saudi Arabian Personal Data Protection Law (PDPL) and its Implementing Regulations, where applicable.

By using the App, you acknowledge that you have been provided with this Privacy Policy. Where consent is required by applicable law, we will obtain it separately as appropriate. Use of the App does not replace any legally required consent.

2. Information We Collect

We collect and process information necessary to provide the App’s enterprise procurement and financial management functions. The information collected depends on the user’s role, assigned permissions, and use of the App.

2.1 Account and User Information

We may collect the following information:

Full name.
Corporate email address.
Mobile phone number.
User account identifier and assigned role.
Corporate authentication information necessary for secure sign-in.
Assigned company, branch, project, cost center, and worksite or site location.
Account status, permissions, and approval responsibilities.

This information is used to authenticate users, manage access permissions, assign responsibilities, and support authorized business operations.

2.2 Procurement and Operational Information

When users create, submit, review, approve, or manage procurement transactions, the App may process:

Material, purchasing, and expense requests.
Business justifications and descriptions of requested items.
Item descriptions, quantities, unit prices, and transaction totals.
Supplier and vendor names and related business information.
Purchase orders and goods receipt records.
Supplier invoices and supporting documentation.
Transaction references, approval statuses, and workflow history.
Records of changes, submissions, reviews, and approvals.

This information is processed to support procurement workflows, maintain accurate business records, and facilitate authorized purchasing and inventory operations.

2.3 Financial and Petty Cash Information

The App may process financial and transactional information required for company expense management, including:

Preferred payment methods, such as physical cash or a company card.
Assigned petty cash balances and wallet float balances.
Cash advances, expenses, reimbursements, and transaction history.
Payment references and reconciliation information.
Financial records associated with procurement requests, invoices, and receipts.

The App may display or process company financial information according to each user’s assigned permissions.

We do not intentionally collect full payment card numbers, card security codes, or personal banking credentials through the App unless a specific feature requires such information and the applicable collection is disclosed.

2.4 Documents, Images, and Attachments

Users may upload documents and images associated with business transactions, including:

Receipts and expense evidence.
Supplier quotations.
Delivery notes and goods receipt documents.
Supplier invoices.
Purchase orders and other supporting business documents.

Uploaded documents may contain personal information relating to employees, suppliers, customers, or other individuals. Users should upload only information necessary for the relevant business purpose and should follow their organization’s document-handling policies.

2.5 Device and Technical Information

To operate, secure, and maintain the App, we may collect or process technical information such as:

Device type, operating system, and application version.
Network connectivity and synchronization status.
Technical logs and access timestamps.
Diagnostic information and crash reports.
Error reports and information required to investigate synchronization or connectivity problems.

This information helps us troubleshoot technical issues, maintain service reliability, support secure ERP connectivity, and investigate potential security incidents.

We collect device identifiers, IP addresses, or other persistent identifiers only where they are made available to us and are used by the App or its underlying services for legitimate operational, security, or diagnostic purposes.

2.6 Location and Organizational Site Information

The App may process an assigned worksite, branch, project location, or other organizational location entered by an authorized user or provided through company records.

This does not, by itself, mean that the App collects the device’s GPS coordinates or continuously tracks a user’s physical location. Any collection of precise device location, if implemented, will be subject to the applicable permissions, disclosures, and legal requirements.

3. How We Collect Information

We may collect information through the following methods:

Directly from users: When users sign in, enter information, submit procurement requests, upload documents, or complete transactions.
Through the user’s organization: When authorized company administrators configure accounts, assign roles, or provide organizational, project, branch, or cost center information.
Through the App: When the App generates operational records, synchronization information, security logs, or diagnostic data.
Through enterprise system integration: When information is exchanged with connected enterprise systems, including Odoo, to support authorized business operations.

We aim to collect only the information reasonably necessary for the purposes described in this Privacy Policy and will handle it in accordance with applicable law.

4. How We Use Information

We use the information described in this Policy for legitimate enterprise and operational purposes, including:

Authenticating users and managing authorized access.
Managing field procurement and material requests.
Recording and tracking petty cash transactions and expenses.
Processing purchase orders, goods receipts, supplier invoices, and supporting documents.
Supporting invoice matching, transaction reconciliation, and financial reporting.
Maintaining accurate transaction records and account balances.
Synchronizing authorized records with Odoo and other approved enterprise systems.
Supporting organizational segregation of duties and multi-level approval workflows.
Maintaining operational, security, and audit logs.
Diagnosing application errors and resolving synchronization issues.
Preventing unauthorized access, misuse, fraud, and other security incidents.
Meeting applicable legal, regulatory, accounting, and recordkeeping obligations.
Responding to legitimate requests from authorized organizational administrators and users.

We will not process personal data for purposes incompatible with the purposes for which it was collected unless permitted by applicable law and, where required, after providing appropriate notice or obtaining consent.

5. Legal Basis for Processing

Where the Saudi Personal Data Protection Law applies, we process personal data on an applicable legal basis permitted under that law and its Implementing Regulations.

Depending on the circumstances, the applicable basis may include consent, the performance of a contract or fulfillment of contractual obligations, compliance with a legal obligation, or another lawful basis available under applicable law.

The applicable basis depends on the type of information, the purpose of processing, the relationship between the parties, and the relevant legal requirements.

Where consent is the applicable legal basis, individuals may withdraw their consent subject to applicable law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing that may continue under another valid legal basis.

Where certain information is necessary for account authentication, transaction processing, or an organization’s required business workflow, failure to provide that information may prevent the relevant feature or service from functioning.

6. Data Sharing and Disclosure

We do not sell or rent personal data to third parties. We disclose or make information available only where necessary for the purposes described in this Policy, where authorized, or where permitted or required by applicable law.

6.1 Enterprise Resource Planning Integration

VS-SPEND integrates with Odoo to support authorized procurement, accounting, inventory, and transaction-management processes.

Relevant account, procurement, financial, and supporting transaction information may be transmitted to or synchronized with the organization’s connected Odoo environment.

The information exchanged depends on the integration configuration, the transaction, and the permissions assigned to the user.

6.2 Service Providers and Technical Partners

We may use authorized hosting providers, infrastructure providers, technical support providers, or other service providers where necessary to operate, secure, maintain, or support the App.

Such providers may process information on our behalf or on behalf of the relevant organization, subject to applicable contractual, confidentiality, and data protection requirements.

The actual service providers and their roles depend on the App’s deployed infrastructure and configuration.

6.3 Organizations and Authorized Users

Information may be made available to authorized personnel within the relevant organization, including administrators, finance teams, procurement teams, auditors, and designated approvers, according to their assigned responsibilities and access permissions.

6.4 Legal and Regulatory Requirements

We may disclose information where reasonably necessary to comply with applicable laws, regulations, court orders, or lawful requests from competent authorities, or to protect the rights, security, and legitimate interests of the company, its customers, or other individuals, to the extent permitted by law.

6.5 Business Transfers

If a merger, acquisition, restructuring, or transfer of business assets occurs, relevant information may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

6.6 International Transfers

If personal data is transferred to, accessed from, or processed in a country outside Saudi Arabia, we will comply with applicable requirements governing transfers of personal data outside the Kingdom, including any required safeguards, assessments, or authorizations.

7. Data Storage, Security, and Retention

7.1 Data Storage

Information may be stored in the App’s associated databases, enterprise systems, document storage services, servers, or cloud infrastructure, depending on the deployment configuration.

The geographical locations in which data is stored or processed depend on the hosting arrangements used by Vision Solutions SA and the relevant organization.

We will maintain information about applicable hosting locations and service providers and handle any storage or transfer of personal data in accordance with applicable legal requirements.

7.2 Data Security

We implement and maintain appropriate technical, organizational, and administrative safeguards designed to protect information against unauthorized access, alteration, loss, misuse, disclosure, or destruction.

Depending on the system configuration and applicable risk, safeguards may include access controls, role-based permissions, authentication controls, secure data transmission, logging, backups, and monitoring of technical or security events.

No electronic system or transmission method can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we take reasonable measures to protect information and address identified risks.

Users must protect their login credentials, use the App only as authorized, and report suspected unauthorized access or security incidents through the appropriate support channel.

7.3 Data Retention

We retain information only for as long as necessary to fulfill the purposes described in this Policy, subject to applicable legal, regulatory, contractual, accounting, audit, and business recordkeeping requirements.

Different categories of information may be retained for different periods. For example:

Account information: For the duration of the user’s authorized access and any additional period necessary for account administration, security, or legal obligations.
Procurement and financial records: For the period required by applicable accounting, audit, contractual, and legal requirements.
Uploaded documents: For the period necessary to support the relevant transaction and applicable recordkeeping obligations.
Technical and security logs: For the period necessary for troubleshooting, security monitoring, investigations, and compliance.

The actual retention periods are determined by the applicable organizational retention schedule, legal requirements, and system configuration.

7.4 Data Deletion and Destruction

When personal data is no longer required and there is no lawful reason to retain it, we will take appropriate steps to delete, destroy, or anonymize it in accordance with applicable law and established retention procedures.

Deletion from the App may not immediately remove records from connected enterprise systems, legally required accounting records, or protected backup systems. Where retention is legally required or otherwise permitted, the relevant information may be retained for the applicable period and protected from unauthorized use.

8. Your Privacy Rights

Subject to applicable law and any relevant limitations, individuals may have the right to:

Be informed about the collection and processing of their personal data.
Request access to personal data held about them.
Request a copy of their personal data in an appropriate, readable format.
Request correction, completion, or updating of inaccurate or incomplete personal data.
Request destruction of personal data when the applicable legal conditions are satisfied.
Withdraw consent where processing is based on consent, subject to applicable law.
Exercise any additional rights available under applicable data protection legislation.

To exercise these rights, submit a request using the contact details in Section 13. Please identify the request clearly and provide sufficient information to enable us to locate the relevant records and verify your identity where necessary.

We may need to coordinate with the organization that administers your account, particularly where the information relates to company transactions, procurement records, financial records, or audit requirements.

We will review and respond to requests within the time limits required by applicable law. Certain requests may be restricted or declined where a lawful exception applies, including where information must be retained to meet legal or regulatory obligations.

9. Account Access, Deactivation, and Deletion Requests

VS-SPEND may use company-managed accounts that are created, assigned, or administered by an authorized organization.

Users who wish to deactivate their access or request deletion of personal data may contact their organization’s administrator or use the contact details provided in this Policy.

Where account deletion is applicable and required by law or the relevant app distribution platform, we will provide an appropriate request process and handle the request in accordance with applicable requirements.

Deleting or deactivating an App account may not automatically delete business transactions, financial records, audit trails, or information held in the organization’s connected ERP system. Such records may need to be retained for legal, accounting, security, or operational reasons.

Where information must be retained, we will limit its continued processing to the purposes permitted by applicable law.

10. Children’s Privacy

VS-SPEND is designed for authorized business users and is not intended to be directed at children.

We do not knowingly seek to collect personal data directly from children through the App. If we become aware that personal data has been collected in circumstances that violate applicable law, we will assess the situation and take appropriate action.

11. Third-Party Services and External Links

The App may connect to enterprise systems or services operated by third parties, including Odoo environments and infrastructure or hosting providers.

The privacy practices of those services may be governed by their own privacy policies, contractual arrangements, and applicable laws.

Where users access a third-party service directly, they should review the relevant provider’s privacy information. This Policy applies to the processing activities for which Vision Solutions SA is responsible and does not replace the privacy policies of independent third-party providers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our data processing activities, service providers, business operations, or applicable legal requirements.

When we make changes, we will update the “Last Updated” date and publish the revised version through an appropriate channel.

Where required by applicable law, we will provide additional notice or obtain consent before implementing changes that require it.

We encourage users to review this Policy periodically to remain informed about how their information is handled.

13. Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy or the processing of personal data, please contact us using the following details:

Company: Vision Solutions SA

Privacy and Support Email: eng.rayan@vsolution.com.sa

IT Support Email: it@vsolution.com.sa

Website: https://vsolution.com.sa

Please include “VS-SPEND Privacy Request” in the subject line of your email to help us direct your request appropriately.

We may request additional information where reasonably necessary to verify your identity, identify the relevant account, or process your request securely.

14. Applicable Law

This Privacy Policy is intended to be interpreted in accordance with applicable data protection laws and regulations, including the Saudi Arabian Personal Data Protection Law and its Implementing Regulations, where applicable.

Nothing in this Policy limits any rights individuals may have under applicable law.

End of Privacy Policy