Who is responsible for your data

This website is operated by the company that operates Invoice And Tax. That company is the controller of the personal data described here: it decides why and how the data is processed. Its full legal name and registration details will be published on this page once confirmed.

Data Wave AI, the technical developer of Invoice And Tax, builds and maintains this website and acts as a processor on the operator's behalf. It processes personal data only on the operator's instructions and for the purposes set out below.

This policy covers the public website and its enquiry channels (forms, email and, when enabled, WhatsApp). It is written with reference to the Personal Data Protection Law of the Sultanate of Oman issued by Royal Decree 6/2022 and its Executive Regulation. Personal data processed inside the Invoice And Tax service by subscribing customers is governed by the separate customer agreement, not by this page.

What we collect

  • Enquiry, demo and contact forms: the details you type in, such as your name, work email, company, phone number if you choose to give it, role, the subject of your enquiry, your message and the page you sent it from.
  • Newsletter: your email address and preferred language. Your subscription only becomes active after you click the confirmation link we email to you (double opt-in).
  • Consent records: what you agreed to, when (timestamp), the version of the wording you were shown and the page where you gave it.
  • Technical and security data: server and security logs such as IP address, browser type, requested address and time. For the content management system (CMS), sign-in events and failed sign-in attempts (username and IP address) are recorded to block password-guessing.
  • Cookies: described in our Cookie Policy.

We do not ask for sensitive personal data, such as health or religious information. Please do not include it, or customer invoice data, in your messages.

Why we use it and on what basis

  • To respond to your enquiry and arrange a demo — taking steps you asked for before any contract, and your consent where the law requires it.
  • To send the newsletter you asked for — your consent, which you can withdraw at any time using the unsubscribe link in every issue.
  • To record and demonstrate consent — our legal obligations.
  • To keep the website and CMS secure — preventing spam, abuse and unauthorised access, which is a legitimate interest of the operator and of visitors.
  • To meet legal obligations — for example responding to lawful requests from competent authorities.

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

How long we keep it

  • Enquiry and lead records: up to 24 months from our last contact with you (a configurable period), after which they are deleted or anonymised.
  • Spam and abusive submissions: purged sooner.
  • Newsletter: until you unsubscribe. Unconfirmed sign-ups are not used for sending.
  • Consent records: for as long as we need to demonstrate that consent was given or withdrawn.
  • Security logs: for a limited period needed to investigate incidents.

Who helps us process it

Personal data is shared only with service providers acting on our instructions:

  • the hosting provider that runs the website and its database;
  • an email-delivery provider, when enabled, to send confirmations and the newsletter;
  • a bot-protection (CAPTCHA) provider, when enabled, to filter automated submissions;
  • analytics or advertising providers only if they are enabled and you consent to them — none is active at present (see the Cookie Policy).

International transfers

The current hosting location is to be confirmed. If a provider stores or accesses personal data outside Oman, we will apply the safeguards required by the Personal Data Protection Law before the transfer takes place, and update this section.

Your rights

Under the Personal Data Protection Law you may ask us to:

  • give you access to, and a copy of, the personal data we hold about you;
  • correct or update inaccurate data;
  • delete your data where there is no longer a lawful reason to keep it;
  • withdraw any consent you have given — this does not affect processing that took place before withdrawal;
  • stop processing your data for direct marketing.

To make a request, email contact@invoiceandtax.com or use the contact page with the subject Privacy request. We may ask you to confirm your identity before acting on a request. If you are not satisfied with our response, you may complain to the competent authority in Oman, currently the Ministry of Transport, Communications and Information Technology.

Enquiries you send through our website forms

When you submit a form on www.invoiceandtax.com (for example contact, demo, quote, partnership, security documentation or integration assessment), we store your submission exactly as you sent it, together with a reference number, the time, the page you used and the campaign tags in the link, in our website's database in our own hosting environment.

To make sure your enquiry is answered quickly, we send an internal notification about it to our authorised staff:

  • by email to our company mailbox, containing the details of your enquiry so we can reply; and
  • by WhatsApp, when enabled, to our company's WhatsApp Business number, through the official WhatsApp Business Platform (Meta Platforms). This message contains only the reference number, the type of form, the time and a link to our secured back office (and, if we choose the "summary" setting, your name and company). It never contains your message, email address, phone number or attachments.

We use these notifications only to handle your enquiry. We do not send you marketing messages by WhatsApp. If you give us a phone number and tick the box allowing us to contact you on WhatsApp, a member of our team may contact you on WhatsApp about your enquiry only.

Access to enquiries is limited to authorised staff with individual accounts; every access is logged. Delivery records (whether a notification was sent, delivered or read) are kept with the enquiry and deleted with it, within the retention periods described in this policy. You can ask us to access, correct or erase your enquiry at any time using the contact details below.

How we protect it

  • encryption in transit (HTTPS) for all pages and forms;
  • access to enquiry records restricted by role to the people who need it;
  • multi-factor authentication for staff who sign in to the CMS, and automatic lock-out after repeated failed sign-in attempts;
  • rate limiting on forms, and logging of security-relevant events;
  • no third-party scripts, fonts or embeds load by default.

More about how the Invoice And Tax service itself is secured is on our Security page.

Children

This website is intended for businesses and professionals. It is not directed at children, and we do not knowingly collect their personal data.

Changes to this policy

When this policy changes, we will publish the new version here with its version number and effective date shown at the top of the page. Significant changes affecting newsletter subscribers will also be notified by email.