Version 1.2 · Effective 2026-10-09
Effective date: 13 September 2026
Version: 1.0
FACCILIS Enterprise Solutions L.L.C-FZ, a limited liability company formed under the regulations of the Meydan Free Zone, Dubai, United Arab Emirates (formation no. 2653583, licence no. 2653583.01), registered at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. ("Faccilis", "we", "us").
We operate Convenio (the "Service"), a cloud platform for planning and managing employee attendance at business and professional events, available at https://convenio.faccilis.com.
Questions about this policy: legal@faccilis.com.
The same platform involves us in two distinct capacities, and your rights depend on which one applies.
| Data | Our role | Who is in charge |
|---|---|---|
| Data your employer entered into the Service about you — your account, your teams, the events you are invited to, attendance, costs, feedback | Processor | Your employer (the "Company") is the controller. It decides what is entered, who sees it, and how long it is kept |
| Data we handle for our own purposes — enquiries sent to us, support requests, the waiting list, billing records, security and server logs, use of our public website | Controller | We are |
If you are an employee of a Company that uses Convenio and you want to access, correct or delete data held in the Service, contact your employer. We act on the Company's instructions and cannot act on those requests ourselves. How we handle personal data as a processor is set out in our Data Processing Agreement, published at https://convenio.faccilis.com/dpa.
The rest of this policy concerns the data for which we are the controller.
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Account identity data — name, work email address, role, Company | To create and operate accounts, authenticate users, send service messages | Performance of a contract; legitimate interest in operating the Service |
| Enquiries and support requests — name, email, the content of your message | To answer you and keep a record of the exchange | Legitimate interest in responding to those who contact us |
| Waiting list — name and email left when registration is closed | Only to tell you when registration reopens. Deleted afterwards | Your request (consent) |
| Billing records — the Company's subscription, plan, amounts and invoices | To run our business and meet accounting and tax obligations | Legal obligation; legitimate interest |
| Technical and security data — IP address, browser and device information, server, job and authentication logs | To keep the Service available and secure, diagnose faults, prevent abuse | Legitimate interest in the security and continuity of the Service |
We do not sell personal data, use it for advertising or profiling, or build behavioural profiles of visitors. We do not knowingly collect data about children: the Service is offered to organisations only, not to consumers, and is not intended for anyone under 18.
Special categories of data (health, biometric, political, religious, trade-union and similar) must not be entered into the Service. It is not designed for them.
Paid subscriptions are sold through Paddle — Paddle.com Market Limited (England and Wales, company no. 8172165) outside the United States, Paddle.com Inc. in the United States — which acts as merchant of record and is the seller towards the customer. Paddle collects and processes the payer's details, including card data, as an independent controller, under its own privacy policy. We never receive or store card data. What reaches us is the subscription status, the plan, the amount, and the identifiers Paddle assigns.
Our payment provider's script (Paddle.js) is loaded on our public website and inside the application. It runs the checkout and supports payment recovery when a payment fails, and it may set cookies of its own — see Paddle's privacy policy. We do not use it for advertising or to profile visitors.
Apart from that, we use cookies and browser storage that are strictly necessary to run the Service: keeping you signed in, protecting the session, and remembering interface preferences such as a chosen filter or a dismissed message. We do not use advertising cookies and we do not share browsing data with advertising networks. If we introduce analytics or any non-essential cookie, this page will be updated and, where required, consent will be requested before it is set.
We use a small number of providers, each bound by a written contract limiting them to our instructions:
| Provider | Role | Where data is processed |
|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, authentication and file storage | Data at rest in the European Union |
| Lovable Labs Incorporated (USA) | Application hosting and delivery; AI gateway for the in-product help assistant | No regional commitment; front end served from a global network |
| AhaSend B.V. (Netherlands) | Transactional email | EEA (Germany, Finland, Bulgaria, Norway) |
| Zoho Software Trading L.L.C (Dubai, UAE) | Support ticketing | Zoho's EU data centre (Amsterdam, Dublin secondary) |
| Microsoft Corporation | Our own business email and office tools | Tenant region: United Arab Emirates |
| Paddle (see §4) | Payments, invoicing, tax — as independent controller | Per Paddle's own policy |
The current list of sub-processors for data we process on behalf of our customers, with the same detail, is maintained in Annex 3 of the DPA.
We also disclose personal data where we are legally required to do so, and to our professional advisers where necessary. If our business is reorganised or sold, data may transfer with it, subject to this policy.
Customer Data is stored at rest in the European Union. Some of the providers above are established outside the European Economic Area and access data from there — in particular the United States, Singapore and the United Arab Emirates. Those transfers rely on the European Commission's Standard Contractual Clauses, together with the additional measures described in the DPA. A copy of the clauses applying to a specific transfer is available on request to legal@faccilis.com.
Where the GDPR applies, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. You also have the right to complain to a supervisory authority in the EU member state of your residence or workplace.
To exercise any of these rights in respect of data for which we are the controller, write to legal@faccilis.com. We answer within one month. We may ask for information to confirm your identity, and we will not disclose someone else's data to you.
Where the data belongs to a Company's tenant, we forward the request to that Company and tell you we have done so — it is the Company, not us, that decides.
We apply the technical and organisational measures described in Annex 2 of the DPA, including tenant isolation enforced at database level, encryption in transit and at rest, multi-factor authentication available to every user and enforceable by a Company, separate staging and production environments with no real personal data in staging, audit logging of administrative actions, and access to production data restricted to the personnel who need it.
No system is perfectly secure. If a personal data breach affects data for which we are the controller and is likely to result in a high risk to you, we will notify you without undue delay.
The current version is always published at https://convenio.faccilis.com/privacy. We will announce material changes to Company Admins by email or in-app notice before they take effect. The version and effective date at the top of this page tell you which text applies.
legal@faccilis.com — privacy and data protection info@faccilis.com — general enquiries FACCILIS Enterprise Solutions L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
We have not appointed a Data Protection Officer, as none is required under Article 37 GDPR.