Privacy Policy

1. Who we are

This Privacy Policy explains how OmniPrime Development ([Full legal name of the business — to be completed], [Company number / Licensed Dealer (Osek Murshe) number — to be completed], [Registered business address in Israel — to be completed]) ("OmniPrime", "we") processes personal data in connection with OmniDesk (the "Service") and our websites.

It is designed to comply with the Israeli Protection of Privacy Law, 5741-1981, as amended (including Amendment No. 13), the Protection of Privacy Regulations (Data Security), 5777-2017, and the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, as well as, where applicable, the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended ("CCPA").

Privacy enquiries: info@primels.co.il or +972 55 502 7988. Privacy Protection Officer: [Name of the Privacy Protection Officer / DPO — to be appointed].

2. Our two roles

• Controller ("database owner"): for the personal data of our customers' account holders, administrators and billing contacts, of people who apply for or buy a subscription, and of visitors to our websites.
• Processor ("holder"): for personal data our customers enter into their own Workspaces (for example their contacts, leads and employees). Our customers decide how that data is used; we process it only on their instructions under the Data Processing Agreement. Requests about such data should be sent to the relevant customer.

3. Personal data we collect

• Account data: name, business email address, phone number, job title, department, role and password (stored only as a salted cryptographic hash).
• Company / application data: company name, tax or registration number, address, contact details, notes you submit, and verification documents requested during the 48-hour review.
• Billing data: plan, invoices, payment status and limited payment-card metadata returned by our payment provider. Full card numbers are handled only by the payment provider.
• Usage and security data: sign-in events, IP address, browser/user agent, actions performed (audit logs), error and performance telemetry.
• Communications: support requests and the emails we send you (for example invitations and password resets).

4. Why we use it (purposes and legal bases)

You are not under a legal obligation to provide personal data, but without account and company data we cannot provide the Service.

• To create and operate accounts and Workspaces, authenticate users and provide the Service — performance of a contract.
• To verify new customers, prevent fraud and abuse, and secure the Service (including audit logging and lock-out after failed sign-ins) — legitimate interests and legal obligations.
• To process payments, issue tax invoices and keep accounting records — performance of a contract and legal obligations under Israeli tax law.
• To send service and transactional emails (invitations, password resets, billing and security notices) — performance of a contract. These are not marketing messages.
• To send marketing communications only with your prior consent, as required by section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982; you can withdraw consent at any time.
• To improve and develop the Service using aggregated or de-identified information — legitimate interests.

5. Who we share it with

We do not sell personal data and do not share it for cross-context behavioural advertising. We share it only with:

• Microsoft Azure (hosting, databases, caching, monitoring and email delivery via Azure Communication Services).
• Our payment provider PayMe, to process subscription payments.
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Authorities, where required by law, court order or to protect rights and safety.
• A successor entity in a merger, acquisition or sale of assets, subject to this Policy.

6. Where it is stored and international transfers

Service data is hosted primarily in Microsoft Azure's Israel Central region. Some processing (for example email delivery and telemetry) may take place in the European Union / European Economic Area, which Israel recognises as providing an adequate level of protection.

Any other transfer of personal data outside Israel is made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001 and, for data originating in the EEA or UK, with the GDPR (Israel benefits from an EU adequacy decision), using contractual safeguards where required.

7. How long we keep it

• Account and company data: for the life of the subscription and then up to 90 days to allow export and orderly deletion.
• Billing and accounting records: at least 7 years, as required by Israeli tax law.
• Security and audit logs: for the period configured for the Workspace and in any case no longer than necessary for security, dispute resolution and legal compliance.
• Applications that do not become customers: up to 12 months.

8. How we protect it

We apply security measures appropriate to the sensitivity of the data and in line with the Data Security Regulations, including: encryption in transit (TLS) and at rest; isolation of each customer's data at application and database level (row-level security); role-based access with department-level restrictions; least-privilege administrative access; hashed passwords and account lock-out; immutable audit logging of create, update and delete operations; monitoring; backups; and documented incident-response procedures.

If a severe security incident occurs, we will notify the Privacy Protection Authority and affected customers as required by law, and support our customers in meeting their own notification obligations.

9. Your rights

To exercise a right, contact info@primels.co.il or +972 55 502 7988. We will respond within the time required by law (under Israeli law, generally within 30 days). We may need to verify your identity. You may also contact the Israeli Privacy Protection Authority.

• Israeli law: the right to inspect personal data about you held in a database (section 13), to request correction or deletion of inaccurate, incomplete, unclear or outdated data (section 14), and to ask to be removed from direct-mailing lists (section 17F).
• GDPR (where applicable): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent; and the right to complain to your supervisory authority.
• CCPA (where applicable): to know, delete and correct personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA.

10. Cookies

We use only cookies that are strictly necessary to operate the Service. See the Cookie Policy.

11. Children

The Service is intended for businesses and is not directed at children under 18. We do not knowingly collect their personal data.

12. Changes

We will post any changes to this Policy on this page and, for material changes, notify Administrators in advance.