ProfoundOS legal
Privacy & Data Protection Policy
Effective 20 September 2026
This Policy explains how Profound WLL processes personal data through ProfoundOS. It is intended to align with Bahrain Law No. 30 of 2018 issuing the Personal Data Protection Law (“Bahrain PDPL”), its implementing decisions and other applicable Bahrain requirements.
1. Scope and roles
For workspace registration, administration, security, support and service communications, Profound WLL may determine why and how limited account and operational data is processed. For personal data entered by a Customer into its workspace, the Customer normally acts as the data controller or business owner and Profound WLL acts as its data processor or service provider, processing that data on the Customer's documented instructions and to provide the service.
2. Data we process
We may process workspace and Admin details such as names, business contact information, company details and requested business profile; user identifiers, verified email addresses, roles and authentication records; customer, supplier, employee and other business records entered by the Customer; products, sales, invoices, payments, stock, purchases, jobs and accounting records; and security, device, browser, IP, diagnostic, audit and operational log data. We do not ask customers to enter data that is unnecessary for their configured business use.
3. Purposes and authorization
Data is processed to create and administer workspaces, authenticate users, execute requested business functions, maintain records and backups, provide support, deliver transactional emails, secure and troubleshoot the service, prevent abuse, meet legal obligations and improve reliability. Processing is carried out under the Customer's instructions, the service agreement, consent where required, legal obligations, and other grounds authorized by the Bahrain PDPL and applicable law.
4. Customer responsibilities
Customers decide what business data to enter and who may use their workspace. They are responsible for notices, permissions, lawful grounds, data accuracy, user access, retention instructions and responding to individuals whose data they control. Profound WLL does not sell Customer Data or use it for unrelated advertising.
5. Security
ProfoundOS uses measures appropriate to the service and risk, including password hashing, access controls, company-scoped authorization, encrypted HTTPS transport in production, controlled administrative access, audit and operational logging, protected configuration of credentials, and database backup procedures. No internet service can guarantee absolute security, and customers must also secure their users, devices, networks and credentials.
6. Service providers and subprocessors
Profound WLL may use hosting, database, email delivery, backup and technical-support providers to operate ProfoundOS. They receive only the access reasonably needed for their services and are required through applicable terms or arrangements to protect the data they process. Profound WLL remains responsible for its processor obligations where applicable.
7. International and cloud processing
Cloud infrastructure or service providers may process or store data outside the Kingdom of Bahrain. Such international processing is undertaken on the Customer's instructions and subject to the permissions, safeguards, contractual controls, consents or regulatory approvals required by the Bahrain PDPL. Customers should raise location or transfer requirements before submitting regulated data.
8. Retention and deletion
Account and Customer Data is retained while the workspace is active and thereafter only as reasonably needed for termination handling, security, dispute resolution, legal, accounting or regulatory obligations. On a valid termination request, production data will be deleted or returned as applicable, while residual copies may remain in protected backups until their normal rotation or required legal-retention period ends.
9. Rights and requests
Individuals may have rights under the Bahrain PDPL to request access, correction, blocking or deletion, withdraw consent where processing depends on consent, or object in circumstances recognized by law. Requests concerning data in a Customer workspace should normally be directed first to that Customer as controller. Profound WLL will reasonably assist the Customer and will handle requests for data it controls after verifying identity and legal entitlement.
10. Email communications
ProfoundOS sends operational messages such as email verification, password reset and workspace-review notifications. These are service communications rather than marketing. Any optional commercial email will be handled according to applicable requirements and available preferences.
11. Security incidents
Profound WLL will investigate a confirmed security incident affecting personal data, take reasonable containment and remediation steps, preserve appropriate records, and cooperate with affected Customers. Notifications to Customers, data subjects or the competent Bahrain authority will be made where and within the period required by applicable law, taking account of the nature and risk of the incident.
12. Changes and contact
This Policy may be updated as the service or legal requirements change. Material changes will be communicated through a reasonable service channel. Privacy requests may be directed to Profound WLL, Kingdom of Bahrain, at +973 77933777. Privacy contact email and registered-office details: [to be configured in the applicable service communication or order form].