Effective date: 11 November 2026
1.1 Penny. These Business Terms and Conditions (the “Terms”) are entered into with Penny Software Arabia for Information Technology Company, a limited liability company registered in the Kingdom of Saudi Arabia with unified national number 7006326446, with its registered address at Office 20, 2nd Floor, King Abdul-Aziz Street, An Nafal District, Riyadh, Kingdom of Saudi Arabia (“Penny”, “we”, “us”). Where an Order expressly names Penny Software W.L.L as the contracting party, that company is “Penny” for that Order, and the Order will state the governing law, forum and tax treatment that apply. Penny Software Holding Limited does not contract with Users under these Terms.
1.2 Definitions. In these Terms:
“Additional Agreement” means any written agreement signed by Penny and a Member that supplements these Terms.
“Authorised User” means an individual a Member or Supplier permits to use its account.
“Buyer” means a Member using Penny Community to purchase.
“Customer Data” means data, including personal data, that a Member or its Authorised Users submit to or generate on the Platform, excluding Vendor Business Data to the extent licensed under clause 6.
“Data Processing Addendum” or “DPA” means Part B of the Legal Documents.
“Legal Documents” means these Terms, the DPA, the Privacy Policy, the Cookie Policy and the Sub-processor List, as published at penny.co/legal-section.
“Member” means an organisation subscribing to the Procurement Management Solution.
“Member Confidential Data” means a Member’s prices, quotations, bids, contract terms, purchase orders, invoices, spend volumes, budgets, internal evaluations and ratings, and the fact that a given vendor supplies that Member.
“Order” means an Enrolment Application, order form or Additional Agreement accepted by Penny.
“Partner” means a third party that provides a Value-Added Service.
“Penny Community” means the Platform’s business-to-business network described in clause 4.2, including vendor profiles, recommendations, the supplier directory, the public website and any white-labelled instance.
“Penny Group” means Penny Software Arabia for Information Technology Company, Penny Software W.L.L (Kingdom of Bahrain, registration no. 151350-1) and Penny Software Holding Limited (Abu Dhabi Global Market, registered no. 000003577), and any entity controlling, controlled by or under common control with them.
“Platform” means penny.co, app.penny.co, Penny’s applications, APIs and any white-labelled instance.
“Recommended Vendor” has the meaning in clause 8.9.
“Services” means the Platform and all services Penny provides through it.
“Supplier” means an organisation that registers on the Platform to offer goods or services, or that a Member registers and that accepts these Terms under clause 6.6.
“User” means any Visitor, Member, Buyer, Supplier or Authorised User.
“Value-Added Services” has the meaning in clause 7.1.
“Vendor Business Data” means a vendor’s legal and trade name, commercial registration and VAT numbers, address, activity categories, certifications, public contact details, and the name, title, business email and business phone of its contact persons.
“Visitor” means anyone accessing the Platform without an account.
1.3 Interpretation. “Including” means including without limitation. Headings are for convenience only.
2.1 Acceptance. These Terms bind a User when it signs an Order, clicks to accept, registers an account, or uses the Services. Whoever accepts on behalf of an organisation confirms that they are authorised to bind it. Electronic acceptance has the same effect as a signature.
2.2 One set of documents. The Legal Documents are incorporated into these Terms by reference and are accepted by a single acceptance of these Terms or of an Order. No separate signature is required for any of them. Penny will, on request, countersign a copy of the DPA for a Member’s records without changing its content.
2.3 Precedence. If documents conflict, the following order applies: (a) the DPA, on any matter of personal data protection; (b) an Order or Additional Agreement, only where it expressly states that it overrides a specific provision of these Terms; (c) these Terms; (d) the Privacy Policy and Cookie Policy.
2.4 Changes. Penny may update the Legal Documents. Penny will give at least thirty (30) days’ notice of any material change by email to the account’s registered address and in the Platform. A User that objects may terminate the affected Services before the change takes effect, and will receive a pro-rata refund of prepaid unused fees. Continued use after the effective date is acceptance. Changes required by law may take effect sooner where the law requires.
2.5 Records. Penny keeps a record of each acceptance, including the accepting entity, the individual, the date and time, and the version accepted, and will provide it to the User on request.
2.6 Language. The Legal Documents are published in Arabic and English. If they conflict, the Arabic version prevails.
3.1 Eligibility. The Services are for businesses only. To open an account, a User must be a legal entity validly registered in its country of incorporation, provide a current commercial registration and, where applicable, a VAT registration certificate, and act through an authorised representative.
3.2 Information. Each User must provide accurate, complete and current information and keep it updated. Changes apply to new transactions; transactions already made on earlier information remain valid. Penny may request supporting documents when an account is opened and periodically afterwards, including to re-check commercial registration and VAT documents. The User must provide the documents requested within fourteen (14) days of Penny’s request. Penny may suspend an account whose information cannot be verified, or whose User does not respond within that period.
3.3 Credentials and authority. Users must keep login credentials confidential and are responsible for all activity under their accounts. Any action taken on the Platform through a User’s account, including an approval, a quotation, an order or an acceptance, is treated as the act of that User and binds it, unless the User had already notified Penny of unauthorised access to that account. Users must notify Penny promptly at info@penny.co of any suspected unauthorised access.
3.4 Member accounts. A Member may hold an administrator account able to create sub-accounts with different access rights. The features, capacity and user limits of each package are stated in the Order.
3.5 Refusal and suspension. Penny may refuse a registration, or suspend an account, where there are reasonable grounds to believe that information is false, that these Terms or applicable law have been breached, or that suspension is needed to protect the Platform or other Users. Penny will give reasons and, where practicable, prior notice.
3.6 Inactive accounts. Penny may close an account that no Authorised User has signed in to for twelve (12) consecutive months, after giving the account’s registered contact at least thirty (30) days’ notice. Signing in during the notice period keeps the account open. This clause does not apply to a Member during a paid subscription term. On closure, clause 15.3 applies to the account’s data.
4.1 Procurement Management Solution. A cloud-based source-to-pay solution through which Members manage purchase requests, sourcing events (RFx), purchase orders, receiving, invoices, payments, budgets, supplier management, spend analytics and local content reporting, as described in the Order.
4.2 Penny Community. Penny’s business-to-business network through which Buyers discover vendors, compare products, request quotations and purchase, and through which Penny recommends vendors (clause 6). Penny Community may appear as a supplier directory inside the Procurement Management Solution, as a public website, or as a white-labelled platform under a Member’s brand. Penny Community is open to Buyers and vendors worldwide; specific features, such as the payment gateway and invoicing under Schedule A-1, may be available only in particular countries, as stated in the Platform.
4.3 AI features. Some features use artificial intelligence, including without limitation document OCR and data extraction, the Penny chatbot and AI assistant, price and supplier benchmarking, supplier suggestions, content drafting and risk alerts. Outputs are suggestions; Users remain responsible for reviewing them and for their own procurement decisions. AI outputs, including OCR extractions, chatbot answers, benchmarks and recommendations, are generated automatically and may be inaccurate, incomplete or out of date. To the extent permitted by applicable law and subject to clause 14.3, Penny gives no warranty as to the accuracy, completeness or suitability of any AI output and is not responsible or liable for any decision made, action taken or loss suffered in reliance on it. Benchmarking uses aggregated and anonymised data under clause 10.4 and never discloses another Member’s Confidential Data. AI features may use third-party AI model providers listed in Part E. Penny will require them to process content submitted to AI features only to return results to the User, not to use it to train their own models, and to delete it within 30 days. Users should not submit sensitive personal data to AI features. Penny does not currently use Customer Data to train AI models. Penny may in future use a Member’s Customer Data to improve recommendations and other AI features only if the Member opts in through its Order or the Platform settings, and the Member may withdraw that opt-in at any time. Where the Platform allows, Members may disable AI features for their workspace.
4.4 Availability and support. Service levels, support and maintenance are those stated in the Order. Penny may change or improve features, but will not materially reduce the core functionality of a paid package during its subscription term, except as clause 9.6 provides, and will not materially reduce the overall level of security protecting Customer Data during a subscription term. Penny backs up Customer Data regularly and maintains recovery procedures in line with any recovery objectives stated in the Order.
4.5 Territory. The Services are available to organisations worldwide, subject to clause 5.4 and any feature restrictions stated in the Platform. Users are responsible for their own compliance with local law. Penny remains responsible for complying with the laws that apply to Penny and to its provision of the Services.
4.6 Trials and early-access features. Penny may offer a Service or feature as a trial, pilot or beta, and will label it as such. To the extent permitted by law, it is provided “as is”: the warranty in clause 13.2 and any service levels do not apply to it, and Penny may change or withdraw it at any time. A trial ends on the date Penny states or, if none is stated, thirty (30) days after it starts. Clauses 10 and 14.3 continue to apply.
5.1 Licence. Subject to these Terms, Penny grants each User a non-exclusive, non-transferable, revocable licence to access and use the Services for its internal business purposes during the term.
5.2 Restrictions. Users must not: (a) copy, modify, reverse engineer or create derivative works of the Platform, except where the law expressly permits; (b) access the Platform to build a competing product; (c) resell or frame the Platform without Penny’s written consent; (d) upload malware, or test or breach Platform security; (e) scrape or bulk-extract data, including Penny Community data, other than through features Penny provides; (f) harass, spam or mislead other Users or third parties; (g) use other Users’ personal data except to perform transactions on the Platform; or (h) use the Services unlawfully or in breach of sanctions.
5.3 Conduct. Users must act professionally and in good faith, comply with applicable laws, and respect the Islamic values, cultural sensitivities, morals and traditions of the Kingdom.
5.4 Anti-bribery and sanctions. Neither Penny nor any User will offer, give or accept any bribe or improper advantage in connection with the Services or any transaction on the Platform. Penny and each User confirm that they are not subject to sanctions that prohibit their dealings with each other. Each User is responsible for ensuring that its counterparties are not subject to such sanctions, and Penny may suspend any account or transaction it reasonably believes breaches applicable sanctions.
5.5 Fair sourcing. Suppliers must prepare each quotation or bid independently. A Supplier must not agree or coordinate prices, terms or participation with another bidder, or share the contents of its bid with one, except in a joint bid disclosed to the Buyer, and must not seek a Buyer’s non-public information about other bids. A quotation submitted through the Platform is a binding offer for the validity period it states. If the Buyer accepts it through the Platform within that period, the Supplier must honour it. Penny may suspend an account or remove a bid where it reasonably believes this clause has been breached, and may report suspected breaches to the competent authority.
6.1 Licence from Members. Each Member grants Penny a non-exclusive, royalty-free, worldwide licence to use Vendor Business Data entered on the Platform by the Member or its Authorised Users to create, verify, enrich and maintain vendor profiles in Penny Community, and to display and recommend those vendors to other Members. The licence survives termination of these Terms only for company-level information (legal and trade name, registration and VAT numbers, address, activity categories and certifications). Personal data of vendor contact persons is used only for these purposes, kept for the periods in the Privacy Policy, and remains subject to the individual’s rights to object and to request deletion.
6.2 Member Confidential Data. Penny will not disclose a Member’s Confidential Data to any other Member or third party, except in aggregated and anonymised form from which neither the Member nor its transactions can be identified. Penny will not disclose to other Members that a vendor supplies a particular Member, and will show usage counts only where at least three Members use that vendor.
6.3 Private vendors. A Member may designate any vendor as “Private” in the Platform. Penny will not recommend a Private vendor to other Members on the basis of that Member’s data. Designation does not affect a vendor’s own profile if the vendor has registered independently.
6.4 Member warranty. Each Member warrants that it has the right to provide Vendor Business Data to Penny for the purposes of this clause 6, and that it has informed its vendors’ contact persons, or authorises Penny to inform them, that such data is shared with Penny.
6.5 Vendor registration. A vendor may register on the Platform directly, or a Member may register it. When a Member registers a vendor, Penny may create a Penny Community profile for that vendor and will send the vendor’s contact person a notification of the registration that names the registering Member and explains how the data is used in Penny Community, including a link to the Privacy Policy and how to correct, restrict or delete the profile. Until the vendor accepts these Terms under clause 6.6, Penny will display only Vendor Business Data and will not send promotional communications to the vendor’s contact persons without their consent.
6.6 Acceptance by vendors. A vendor that registers directly accepts these Terms on registration. A vendor registered by a Member, or already registered on the Platform, will be asked to accept these Terms on its first interaction with a Member through the Platform (for example responding to an RFQ, submitting a quotation or receiving a purchase order). On acceptance it becomes a Supplier bound by these Terms, including the vendor charges in clause 8.9 and, if it receives payments through the payment gateway, clause 8.7.
6.7 Opt-out. A vendor may opt out of Penny Community at any time through the Platform or by writing to info@penny.co. Opting out removes its public profile and recommendations but does not affect any Member’s own vendor record.
6.8 No endorsement. Recommendations are based on available data and are not an endorsement or guarantee of any vendor. Members remain responsible for their own due diligence. Recommendations are based on criteria such as category, location, ratings, compliance status and transaction history. Where a vendor’s placement or recommendation is influenced by a payment or commission, Penny will label it as “Sponsored”.
6.9 Roles. Penny processes personal data within Vendor Business Data for Penny Community as an independent controller under the Privacy Policy, not under the Member’s instructions.
7.1 Offer. Penny may make available to Suppliers and Members, directly or through third-party providers (“Partners”), optional services that complement the Platform, such as payment and collection services, logistics, compliance and certification services, business tools and financing (“Value-Added Services”). The services on offer may change over time and are described in the Platform. Value-Added Services are offered only where the Partner holds every licence required to provide them in the relevant jurisdiction, and only in a manner that does not require Penny to be licensed.
7.2 Penny’s role. Where a Value-Added Service is provided by a Partner, Penny’s role is limited to marketing and introducing that service and transmitting information the User authorises. The Partner is solely responsible for providing the service and for holding any licence it requires. In particular, where a Value-Added Service is a financial service, Penny does not provide financing, credit or insurance, does not conduct any credit assessment, underwriting, pricing or approval on the Partner’s behalf, and is not the Partner’s agent. Penny is not licensed by the Saudi Central Bank or any other financial regulator, does not carry out any regulated financial activity, and does not advise on, recommend, rank or negotiate the terms of any financial product. Penny does not guarantee any Partner decision or the performance of any party.
7.3 Partner terms. Each Value-Added Service provided by a Partner is governed by that Partner’s terms, which the User must accept before use. Penny is not a party to them.
7.4 Fees and commissions. Penny may receive fees or commissions from Partners. Penny will disclose the existence of any such fee to the Member or Supplier concerned before it activates the service.
7.5 Supplier authorisation. When a Supplier requests or activates a Value-Added Service, it authorises Penny to share with the selected Partner its Vendor Business Data, its know-your-customer documents, and its transaction data on the Platform (purchase orders, invoices, approval and payment status, and payment history), solely to evaluate, provide and administer that service. Penny records each authorisation, and the Supplier may withdraw it for future sharing at any time.
7.6 Member authorisation. Where a Value-Added Service requested by a Supplier requires confirmation of its dealings with a Member (for example payment, collection or financing services), the Member authorises Penny to confirm to the Supplier’s chosen Partner the existence, amount, approval status and expected payment date of purchase orders and invoices issued by the Member to that Supplier. Penny will not disclose any other Member Confidential Data to Partners. No obligation of the Member to pay a Partner, or to acknowledge any assignment of receivables, arises from these Terms; any such obligation arises only under a separate agreement signed by the Member.
7.7 Communications. Penny may send in-Platform notices about Value-Added Services. Promotional emails, SMS or calls will be sent only to individuals who have opted in. Each will identify Penny as the sender and contain a simple means to unsubscribe.
8.1 Licences and documents. Each Supplier must hold, and maintain throughout its use of the Platform, all licences required to supply its goods or services in the countries where it supplies them, and provide copies to Penny or a Buyer on request.
8.2 Supplier profile. A Supplier’s business name, specialisms, products and specifications are visible to other Users and may appear in Penny catalogues and marketing material.
8.3 Product Content licence. The Supplier grants Penny, the Penny Group and their service providers a non-exclusive, royalty-free, worldwide licence, for as long as the content is on the Platform and for archived marketing material already published, to reproduce, display, translate, adapt and distribute its name, trademarks and logos and all product names, descriptions, images and specifications it provides (“Product Content”), to operate and promote Penny Community. The Supplier warrants that its Product Content is accurate and does not infringe any third-party right.
8.4 Product policy. Suppliers must only list products they have a legal right to sell and must comply with applicable laws and standards on product safety, testing, labelling, packaging and pricing. Penny may remove any listing in its reasonable discretion, including in response to an intellectual property complaint. Suppliers will remove listings Penny asks them to remove within twenty-four (24) hours. Penny will tell the Supplier the reason for any removal, allow it to respond or appeal by writing to info@penny.co within fourteen (14) days, and may suspend Suppliers who repeatedly infringe.
8.5 Contract of sale. Each Penny Community transaction is a contract between the Buyer and the Supplier only. Penny is not the seller, buyer, biller or trader in that transaction. Subject to clause 5.5, the Supplier’s terms on delivery, warranty, returns and cancellation apply unless the Buyer and Supplier agree otherwise through the Platform.
8.6 Invoicing on the Supplier’s behalf. The Supplier authorises Penny to issue tax invoices, advance invoices, credit notes and payment receipts in the Supplier’s name for direct purchases and accepted orders on the Platform, in compliance with ZATCA e-invoicing requirements and Schedule A-1. The Supplier remains responsible for the accuracy of the tax treatment and data it provides.
8.7 Payment gateway and fee deduction. Penny may make available a payment gateway operated by one or more licensed payment service providers. The licensed provider alone receives, safeguards, processes and settles funds; Penny does not receive, hold, control, transmit or safeguard any User’s funds, and payments never pass through Penny’s accounts. A Supplier that receives payments through the gateway: (a) must first accept these Terms and the provider’s terms, including the provider’s identity and KYC checks; (b) authorises Penny to share order details, product information and invoice amounts with the provider for that purpose; and (c) instructs and authorises the provider to deduct the applicable service, vendor and payment fees published at penny.co/service-fees from each payment before settling the balance to the Supplier, and to remit Penny’s fees to Penny. The provider is responsible for settlement, refunds, chargebacks and payment complaints under its terms. Penny will show the fees deducted on each remittance statement.
8.8 Supplier Code of Conduct. Each Supplier must:
(1) complete through the Platform, using the payment methods available on the Platform, every transaction initiated through the Platform (including through RFQs, offers, calls or chat), and every subsequent transaction with a Buyer it met through the Platform;
(2) provide accurate information to Penny and Buyers;
(3) not manipulate ratings, feedback or reviews, or harm other Suppliers’ listings;
(4) communicate with Buyers only through Platform messaging, and only as needed to fulfil orders or provide customer service; marketing messages to Buyers are prohibited;
(5) use Buyer information only to fulfil orders, not share it with third parties, and delete it once the order is complete and any legal retention period has expired;
(6) not divert Buyers to other websites or otherwise circumvent the Platform; and
(7) not operate more than one selling account without a legitimate business need.
8.9 Recommended vendors and vendor charges. A vendor is a “Recommended Vendor” for a Buyer when the Buyer finds it through Penny Community, or Penny recommends it to the Buyer, and the vendor was not already registered as a vendor by the Buyer’s organisation before that discovery or recommendation. Transactions between a Buyer and its Recommended Vendor, including later repeat transactions, are Penny-referred, and the vendor is subject to the vendor charges published at penny.co/service-fees unless an Order states otherwise. Vendors that a Buyer’s organisation registered itself are not subject to these charges for transactions with that Buyer. Penny will show the applicable charges to the vendor before it accepts its first referred opportunity, and the charges apply only once the vendor has accepted these Terms (clause 6.6). Members must not request or encourage a Recommended Vendor to move the relationship off the Platform to avoid these charges.
8.10 Consequences. Breach of this clause 8 may result in removal of listings, suspension of the Supplier’s access to the payment gateway, or suspension or termination of the account.
A1.1 Appointment. By accepting these Terms, a Supplier that uses invoicing on the Platform expressly appoints Penny to issue tax invoices, simplified tax invoices, credit and debit notes and payment receipts in the Supplier’s name for transactions on the Platform. The Supplier remains the supplier for VAT purposes and is responsible for declaring and paying the VAT shown.
A1.2 Verification. Before Penny issues invoices for a Supplier, the Supplier must provide its VAT registration certificate, and Penny will verify the VAT number. The Supplier must notify Penny promptly of any change to its VAT registration or details.
A1.3 Compliance. Invoices are issued through a ZATCA-compliant e-invoicing solution, in the Supplier’s name and VAT number, with all mandatory fields, a separate sequential numbering series for each Supplier, and clearance or reporting to ZATCA as the e-invoicing rules require.
A1.4 Tax treatment. Penny issues invoices based on the prices, tax category, rate and any exemption the Supplier sets on the Platform and on accepted orders. The Supplier is responsible for that tax treatment and must review invoices issued in its name.
A1.5 Corrections and duplicates. Corrections are made only by credit or debit notes issued through the Platform that reference the original invoice. The Platform includes controls to prevent more than one invoice being issued for the same order. The Supplier must not issue a separate invoice outside the Platform for a transaction invoiced through it.
A1.6 Records. Copies of all invoices and notes are available to the Supplier in the Platform and are retained for the period required by law. The Supplier remains responsible for keeping its own records.
A1.7 Ending the appointment. The Supplier may end the appointment on thirty (30) days’ written notice, and it ends automatically when the Supplier’s account closes. Invoices already issued remain valid.
A2.1 Scope. This Schedule applies where Penny provides the Platform or Penny Community to a Member under the Member’s own brand.
A2.2 Branding and content. The Member is responsible for its brand, content and any terms it presents to its users on the instance. Penny’s Legal Documents remain linked on the instance and apply to Penny’s own processing and services.
A2.3 Roles. The Member is the controller of personal data of its users, buyers and suppliers on the instance, and Penny is its processor under the DPA. Penny is a controller only for any Penny Community features the Member enables in its Order, as Annex B-3 describes.
A2.4 Privacy notices and cookies. The Member provides the privacy notice for its own processing. The cookie banner on the instance covers both the Member’s and Penny’s cookies, unless the Order allocates this differently.
A2.5 Support and moderation. The Member provides first-line support and moderation for its users and listings on the instance. Penny provides platform support and applies clause 8.4 to listings.
A2.6 Requests from individuals. Each party handles requests relating to its own processing. A party that receives a request meant for the other forwards it within five (5) business days.
9.1 Member Subscription Fees. Members pay the subscription fees in the Order for the Procurement Management Solution. Usage above the capacity in the Order is billed at Penny’s then-current rates. Fees are payable in advance and in the currency stated in the Order.
9.2 Supplier fees. Whether a Supplier pays a subscription fee is agreed case by case and stated in its Order. Penny Community service, vendor and payment fees are published at penny.co/service-fees. Penny may change those fees on thirty (30) days’ notice to the Supplier’s registered email address; continued use after the change takes effect is acceptance.
9.3 Invoices and payment. Fees may be paid monthly, annually or as stated in the Order, by bank transfer or by a card registered through Penny’s payment provider. A User providing card details authorises Penny to charge the card for fees when due. Unless the Order states otherwise, invoices are payable within fifteen (15) days. Disputes over an invoice must be raised in writing within seven (7) days of its date; undisputed amounts remain payable.
9.4 Taxes. Fees exclude VAT and other applicable taxes, which the User pays in addition. Withholding tax, if any applies, is the User’s responsibility unless the Order states otherwise.
9.5 Late payment. If any undisputed amount is unpaid thirty (30) days after its due date, Penny may, after giving seven (7) days’ written notice, suspend access to the Services until payment in full. The User will bear reasonable costs of collection to the extent permitted by applicable law. Users may not set off amounts owed against any claim against Penny.
9.6 Term, renewal, cancellation and refunds. Each subscription runs for the initial term stated in the Order (the “Initial Term”) and then renews automatically for successive periods equal to the Initial Term, or twelve (12) months if none is stated (each a “Renewal Term”), unless either party gives written notice of non-renewal at least sixty (60) days before the end of the current term. Penny will send a reminder to the account’s billing contact at least thirty (30) days before each renewal. If the Member continues to use the Services after the end of a term without having given timely notice, the subscription is renewed for a full Renewal Term. The fees for each Initial Term and Renewal Term are a commitment for the whole term, even where they are invoiced monthly or in instalments: a Member that stops using the Services or terminates during a term (other than under clause 15.2 for Penny’s uncured breach, or under clause 2.4, 14.7 or B3.2) remains liable for the fees for the rest of that term, which become due immediately. Renewal fees are at Penny’s then-current rates, notified with the renewal reminder. Subscription fees are non-refundable except as stated in these Terms. If Penny removes material functionality included in a User’s package and does not restore equivalent functionality within thirty (30) days of the User’s written request describing the impact, the User may cancel and receive a refund of prepaid, unused fees. This does not apply where the change is required by law or caused by a third party outside Penny’s control.
10.1 Ownership. As between the parties, each Member owns its Customer Data. Penny uses Customer Data only to provide and support the Services, to comply with law, and as clauses 6, 7 and 10.4 permit.
10.2 Data protection. Personal data in Customer Data is processed under the DPA (Part B), in which Penny acts as processor for the Member. Penny acts as an independent controller for account and billing data, Penny Community (clause 6), Value-Added Services (clause 7), and website and marketing data, as described in the Privacy Policy (Part C) and the processing-role matrix in Annex B-3.
10.3 Hosting. Customer Data is hosted on Google Cloud Platform in the Kingdom of Saudi Arabia, unless the Order states another region at the Member’s request. Penny will not move the hosting region without the Member’s prior written agreement.
10.4 Aggregated data. Penny may create aggregated and anonymised data from use of the Services, from which no individual, Member or Member transaction can be identified, and may use it to operate, secure, benchmark and improve the Services, including training and improving AI features. Such data is not Customer Data or personal data. Any use of Customer Data itself, rather than aggregated and anonymised data, to train AI models requires the Member’s opt-in under clause 4.3.
10.5 Confidentiality. Each party will keep confidential all non-public information the other discloses that is marked confidential or would reasonably be understood to be confidential, including Member Confidential Data and Penny’s product roadmap, pricing and security information. It will use that information only to perform these Terms and disclose it only to its personnel, Penny Group companies, advisers and sub-processors who need it and are bound by equivalent obligations, or as required by law. These obligations do not apply to information that is or becomes public through no fault of the recipient, was already known to it, or is independently developed. They survive for five (5) years after termination, and indefinitely for trade secrets. Where a party is required by law to disclose the other party’s confidential information, it will, where the law permits, give the other party prior notice and disclose only what is required.
11.1 Penny’s IP. Penny and its licensors own all intellectual property rights in the Platform, Services and Penny materials. No rights pass to Users except the licence in clause 5.1.
11.2 User materials. Users retain all rights in their own content and grant Penny only the licences needed to provide the Services and those stated in clauses 6 and 8.3.
11.3 Feedback. Penny may use any suggestions or feedback Users provide without obligation.
11.4 Ratings. Users may rate Suppliers through the methods provided. Penny is not responsible for the content of ratings or reviews and may remove any it reasonably considers false, abusive or unlawful.
11.5 References. Penny may identify a Member by its name and logo as a user of the Services on Penny’s website and in sales and tender materials. Penny will not disclose that a Member buys from a particular vendor, or any Member Confidential Data (clause 6.2). Any other marketing use, such as a case study or press release, needs the Member’s prior written approval. A Member may withdraw this permission at any time by writing to info@penny.co, and Penny will remove the name and logo within thirty (30) days. Users may not use Penny’s name or logo without Penny’s prior written approval.
12.1 Third-party services. Some features rely on third-party services (for example payment providers, ERP connectors, e-invoicing and Partners). Their terms apply to the User’s use of them, and the User is responsible for reviewing those terms. Penny is not responsible for third-party services it does not control.
12.2 Links and advertisements. The Platform may contain links to, or advertisements for, third-party websites. Penny does not endorse them and is not responsible for their content or privacy practices.
12.3 Dealings between Users. Dealings between Users, including Buyers and Suppliers, are solely between them. Penny is not obliged to resolve disputes between Users, but may assist at its discretion.
13.1 Mutual. Each party warrants that it is validly organised and has authority to enter into these Terms.
13.2 Penny. Penny will provide the Services with reasonable skill and care and in accordance with applicable law. Except as these Terms expressly state, and to the extent permitted by law, the Services are provided “as is” and Penny gives no other warranty, including as to fitness for a particular purpose or uninterrupted or error-free operation. Penny does not guarantee the quality, availability or reliability of any Supplier, Partner or vendor.
14.1 Exclusions. To the extent permitted by law, neither party is liable for loss of profit, revenue, goodwill or anticipated savings, or for indirect or consequential loss.
14.2 Liability cap. To the maximum extent permitted by applicable law, Penny’s total aggregate liability arising out of or in connection with the Services, these Terms, any Order and any related claim shall not exceed USD 50, or its equivalent in the applicable local currency. This cap applies collectively to all claims, incidents, Users and causes of action and does not apply separately to each claim, incident, User or legal theory.
14.3 Mandatory exceptions. Nothing in these Terms excludes or limits Penny’s liability to the extent that such liability cannot lawfully be excluded or limited, including liability arising from Penny’s fraud, wilful misconduct or gross negligence where applicable law requires that result.
14.4 User obligations. The limitations in clauses 14.1 and 14.2 do not limit a User’s obligation to pay amounts due, or its liability for unlawful or unauthorised use of the Services, infringement or misuse of intellectual property, breach of confidentiality, breach of data-use restrictions, fraud, wilful misconduct, gross negligence, or its indemnity obligations under these Terms.
14.5 Negotiated cap. A higher or different liability cap applies only where an Order signed by an authorised representative of Penny expressly identifies this clause 14 and states the replacement cap.
14.6 Indemnity. Each User will indemnify Penny against third-party claims arising from that User’s breach of clauses 5, 6.4 or 8, or its violation of law. Penny will notify the User promptly of any such claim and allow it to control the defence, and the User will not settle any claim without Penny’s consent, which will not be unreasonably withheld.
14.7 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, including natural disasters, war, civil unrest, epidemics, government action, internet or utility failures, or attacks on infrastructure, provided it uses reasonable efforts to mitigate. This clause does not excuse payment obligations, except as stated below. The affected party will notify the other promptly. If the event prevents the Services from being provided for more than thirty (30) consecutive days, either party may terminate the affected Services on written notice. In that case the Member is not liable for fees for the period after termination, and Penny will refund any such fees already paid.
15.1 Term. These Terms apply for as long as a User uses the Services. Subscription terms, and their automatic renewal, are as set out in the Order and clause 9.6.
15.2 Termination for breach. Either party may terminate on written notice if the other materially breaches these Terms and fails to cure within thirty (30) days of notice, or becomes insolvent. Penny may suspend immediately where needed to protect the Platform, other Users or to comply with law.
15.3 Effect. On termination, access ends and unpaid fees become due. Penny will make Customer Data available for export for thirty (30) days and then delete it under the DPA, except where retention is required by law. During the term, the Member may export its Customer Data at any time using the export features of the Platform.
15.4 Survival. Clauses 6.1 to 6.2, 6.9, 9 (for amounts owed), 10, 11, 14, 16 and 17 survive termination.
16.1 Law. These Terms are governed by the laws of the Kingdom of Saudi Arabia.
16.2 Disputes. The parties will first try to resolve any dispute amicably within thirty (30) days of written notice. Failing that, the dispute will be finally resolved by arbitration administered by the Saudi Center for Commercial Arbitration under its rules, seated in Riyadh, before one arbitrator, in Arabic or English as the parties agree or, failing agreement, as the tribunal decides. Either party may seek urgent interim relief from a competent court.
17.1 Notices. Notices to Users are sent to the registered account email. Notices to Penny go to info@penny.co. Communications are electronic and satisfy any written-form requirement.
17.2 Assignment. Neither party may assign these Terms without the other’s written consent, except that either party may assign them, on notice, to a company in its group or in connection with a merger, acquisition or sale of all or substantially all of its assets.
17.3 Sub-contracting. Penny may use Penny Group companies and sub-contractors to provide the Services and remains responsible for them.
17.4 Entire agreement. The Legal Documents and any Order form the entire agreement on their subject matter. No purchase order terms, vendor onboarding terms or other terms supplied by a User apply to the Services, even if Penny receives them or acts on the related document, unless an authorised representative of Penny agrees to them in a signed document. Nothing in the Legal Documents excludes or limits any right or obligation that cannot be excluded under mandatory law, or the powers of any regulator.
17.5 Severability and waiver. An invalid provision is severed without affecting the rest. A failure to enforce a right is not a waiver.
17.6 Independent parties. Nothing creates a partnership, agency or employment relationship.
17.7 Contact. Penny Software Arabia for Information Technology Company, Office 20, 2nd Floor, King Abdul-Aziz Street, An Nafal District, Riyadh, Kingdom of Saudi Arabia. Email: info@penny.co.
This DPA forms part of the Terms and is accepted with them. It applies when Penny processes personal data in Customer Data on behalf of a Member. Capitalised terms not defined here have the meanings in the Terms. “Applicable Data Protection Law” means the Saudi Personal Data Protection Law and its Implementing Regulations and Transfer Regulations (“PDPL”), Bahrain Law No. 30 of 2018 on Personal Data Protection, the ADGM Data Protection Regulations 2021, and any other data protection law that applies to the processing.
B1.1 The Member is the controller and Penny is the processor of personal data in Customer Data. Annex B-1 describes the processing.
B1.2 Penny is an independent controller, not a processor, for the processing described in clause 10.2 of the Terms. This DPA does not apply to that processing.
B2.1 Instructions. Penny will process Customer Data only on the Member’s documented instructions, which are the Terms, the Order and the Member’s configuration of the Platform, unless law requires otherwise; in that case Penny will inform the Member first unless the law prohibits it. Penny will tell the Member if it believes an instruction breaches Applicable Data Protection Law.
B2.2 Confidentiality. Penny will ensure that everyone it authorises to process Customer Data is bound by confidentiality.
B2.3 Security. Penny will implement and maintain the technical and organisational measures in Annex B-2, appropriate to the risk. Penny maintains ISO/IEC 27001 certification and a SOC 2 report, and complies with the applicable controls of the National Cybersecurity Authority and the applicable requirements of the Saudi Data & AI Authority (SDAIA).
B2.4 Breach notification. Penny will notify the Member without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include the information then available on the nature of the breach, the data and individuals affected, likely consequences and measures taken, so that the Member can meet its own notification obligations, including any notice to SDAIA required within seventy-two (72) hours.
B2.5 Assistance. Taking into account the nature of the processing, Penny will assist the Member to respond to data subject requests within the periods Applicable Data Protection Law sets (thirty (30) days under the PDPL), to conduct impact assessments, and to respond to regulators. Penny will forward any request it receives directly to the Member and will not answer it unless the Member instructs.
B2.6 Records. Penny will keep records of its processing activities as Applicable Data Protection Law requires.
B2.7 Audit. Penny will make available information reasonably needed to demonstrate compliance with this DPA, including a summary of its latest security assessment or certification, once per year on request. The Member may also audit Penny’s compliance with this DPA, itself or through an independent auditor bound by confidentiality, once a year, and at any time where a regulator requires it, after a personal data breach, or where there are reasonable indications of non-compliance, on thirty (30) days’ notice (or shorter notice where urgent), during business hours and at its own cost.
B2.8 Return and deletion. On termination, Penny will make Customer Data available for export for thirty (30) days and then delete it within sixty (60) days, except where retention is required by law, in which case it will remain protected under this DPA.
B3.1 General authorisation. The Member authorises Penny to engage the Penny Group companies and sub-processors listed in the Sub-processor List (Part E). Penny will impose data protection obligations on each sub-processor no less protective than this DPA and remains responsible for them. On request, Penny will provide a summary of the data protection terms in its sub-processor agreements.
B3.2 Changes. Penny will give at least thirty (30) days’ notice before adding or replacing a sub-processor, by updating the Sub-processor List and emailing account administrators who subscribe to updates. The Member may object on reasonable data protection grounds within that period; the parties will discuss in good faith, and if no solution is found the Member may terminate the affected Services and receive a refund of prepaid unused fees.
B3.3 Hosting region. Customer Data is hosted as set out in clause 10.3 of the Terms and is not moved without the Member’s prior written agreement.
B3.4 Cross-border access and transfers. Customer Data may be accessed or transferred outside the country where it is hosted only by the entities in the Sub-processor List, for the purposes stated there, and only under a safeguard that Applicable Data Protection Law recognises, such as SDAIA’s Standard Contractual Clauses, an adequacy decision, or authorisation from the relevant authority. Penny will complete and keep the transfer risk assessments the PDPL requires and provide a summary on request.
B4.1 The Member warrants that it has a lawful basis for the processing it instructs, has given the individuals concerned the notices Applicable Data Protection Law requires, and will not instruct Penny to process sensitive data unless the Order expressly permits it.
B5.1 Liability under this DPA is subject to clause 14 of the Terms.
B5.2 On matters of personal data protection, this DPA prevails over the Terms and any Order. Penny will give the notice in clause 2.4 of the Terms before changing this DPA.
Data subjects: Member employees and Authorised Users; approvers; vendor and supplier contact persons; sole proprietors registered as vendors
Personal data: Name, job title, business email, phone, user ID and login records; approval actions; vendor contact details; bank details of sole-proprietor vendors; content of messages and documents uploaded
Sensitive data: None intended
Purposes: Providing the Procurement Management Solution and Penny Community: sourcing, purchase orders, receiving, invoicing, payments, budgeting, supplier management, analytics, local content reporting and support
Duration: Term of the subscription plus the return and deletion period in B2.8
Locations: Hosting as set out in clause 10.3 of the Terms; access by entities in the Sub-processor List
Encryption in transit and at rest; role-based access and least privilege; multi-factor authentication for Penny staff; logging and monitoring; vulnerability management and periodic penetration testing; secure development lifecycle; backup and disaster recovery; staff confidentiality undertakings and training; incident response plan with the 24-hour Member notification in B2.4.
| Activity | Processing role |
|---|---|
| Procurement workflows on Customer Data (requests, sourcing, POs, invoices, budgets, document OCR, chatbot use in the Member’s workspace) | Penny Software Arabia is processor for the Member. |
| Technical and customer support by Penny Software W.L.L | sub-processor of Penny Software Arabia. |
| Account, billing, security, website and marketing data | Penny is independent controller. |
| Penny Community vendor profiles and recommendations | Penny is independent controller. |
| Benchmarking and service improvement | Penny is controller for creating aggregated and anonymised data; the result is not personal data. Use of Customer Data itself to train AI requires the Member’s opt-in (clause 4.3), and Penny’s role for that use will be set out in the opt-in. |
| AI model providers | sub-processors of Penny for Customer Data, and processors of Penny for data Penny controls. |
| Value-Added Services | Penny is independent controller when transmitting data the User authorises; the Partner is independent controller for its own service. |
| Payment gateway | the licensed payment service provider is independent controller for payment processing; Penny is independent controller when sharing order data with it. |
This Privacy Policy explains how Penny collects, uses, shares and protects personal data when Penny decides why and how that data is processed (as a “controller”). It complies with the Saudi Personal Data Protection Law and its Implementing Regulations (“PDPL”). Annexes C-1 and C-2 add the rules for Bahrain and ADGM.
The controller is Penny Software Arabia for Information Technology Company, Office 20, 2nd Floor, King Abdul-Aziz Street, An Nafal District, Riyadh, Saudi Arabia, unified national number 7006326446, unless an Order names Penny Software W.L.L as the contracting party. Our Data Protection Officer can be reached at info@penny.co.
Data in your organisation’s workspace. When your employer or a customer uses Penny’s Procurement Management Solution, that organisation is the controller of the data in its workspace and Penny processes it on its behalf under our Data Processing Addendum. For that data, please contact the organisation directly; we will pass on any request we receive.
Account and contact: name, job title, business email, phone, company, login details. Source: you, or your organisation when it creates your account.
Vendor contact data: name, title, business email and phone of vendor contact persons. Source: Penny customers who add vendors; vendors themselves.
Transaction data: orders, invoices and payment status, for Penny Community and Value-Added Services. Source: Platform use.
Billing: billing contacts and payment records (card details are held by our payment provider, not by Penny). Source: you; payment providers.
Communications: support requests, chat, conversations with the AI chatbot, call notes. Source: you.
Technical: IP address, device and browser type, log data, cookie identifiers. Source: automatically, per the Cookie Policy.
Marketing preferences: opt-ins, opt-outs, event registrations. Source: you.
We do not intentionally collect sensitive personal data, such as health, biometric or genetic data, religious beliefs or criminal records.
Create and manage accounts, provide the Services, process orders and payments, give support. Basis: performance of our contract with you or your organisation.
Penny Community: create vendor profiles and recommend vendors to Penny customers. Basis: legitimate interest in operating a B2B vendor network, assessed and documented; you can object at any time.
Share data with a Value-Added Services Partner you choose (for example a payments, logistics or financing provider). Basis: your request and consent, recorded at activation.
Security, fraud prevention, troubleshooting and service improvement. Basis: legitimate interest.
Invoicing, tax (including ZATCA e-invoicing), accounting and legal compliance. Basis: legal obligation.
Marketing emails, SMS and calls about Penny or Partner services. Basis: your consent, which you can withdraw at any time.
Non-essential cookies. Basis: your consent via the cookie banner.
We will not use personal data for a new purpose incompatible with these without telling you first and, where required, obtaining consent.
We share personal data only as needed for the purposes above, with:
Penny Group companies that provide support, engineering and operations (listed in Part E);
service providers acting on our instructions, such as hosting, email, payment and e-invoicing providers (listed in Part E);
analytics providers that measure how the Platform and the website are used (listed in Part E and the Cookie Policy);
advertising partners, for website visitors who accept advertising cookies (listed in the Cookie Policy);
other Penny customers, for Penny Community vendor profiles (business contact details only);
Partners you choose to use, for Value-Added Services;
professional advisers, auditors and insurers;
authorities, courts and regulators, where the law requires; and
a buyer or investor, in a merger, acquisition or financing of Penny’s business, under confidentiality.
We do not sell personal data and do not share it with third parties for their own marketing without your consent.
Personal data may be accessed by Penny Software W.L.L in Bahrain, which provides technical and customer support, and by service providers in the locations in Part E. We transfer or disclose data outside the Kingdom only as the PDPL and SDAIA’s Transfer Regulations permit, using safeguards such as SDAIA’s Standard Contractual Clauses, and after the risk assessment those regulations require.
| Data | How long we keep it |
|---|---|
| Commercial and accounting records, tax invoices and contracts | 10 years after the end of the relevant financial year, as Saudi commercial record-keeping and tax rules require. |
| User profiles and login data | life of the account plus 12 months. |
| Payment records held by Penny (fee statements only) | 5 years. |
| Penny Community profile | while the profile is active; deleted within 30 days of opt-out. |
| Value-Added Services authorisations | life of the service plus 5 years. |
| Support communications | 3 years. |
| Marketing data | until consent is withdrawn; deleted without undue delay afterwards. |
| Security and technical logs | 12 months. |
At the end of the period we delete or anonymise data in line with SDAIA’s retention and destruction requirements.
We use technical and organisational measures appropriate to the risk, including encryption, access controls, monitoring and staff confidentiality. If a personal data breach occurs, we notify SDAIA within seventy-two (72) hours where required and inform affected individuals without undue delay where the breach may harm them.
Under the PDPL you have the right to:
(1) be informed about how we process your personal data;
(2) access your personal data and obtain a copy in a readable format;
(3) correct, complete or update it;
(4) request its destruction when it is no longer needed;
(5) withdraw consent at any time, without affecting earlier processing; and
(6) object to processing for direct marketing or based on legitimate interest, including Penny Community listing.
Send requests to info@penny.co. We may ask you to verify your identity. We respond within thirty (30) days, or tell you within that period if we need an extension permitted by law. If you are not satisfied, you may complain to the Saudi Data & AI Authority (SDAIA). Annexes C-1 and C-2 set out the authorities for Bahrain and ADGM.
We will notify you of material changes to this Policy at least thirty (30) days in advance by email or in the Platform, and obtain fresh consent where the law requires.
Role of the Bahrain entity. Penny Software W.L.L, registration no. 151350-1, Flat 121, Building 2196, Road 3640, Block 436, Al Seef, Kingdom of Bahrain, provides technical and customer support to Penny Software Arabia and processes personal data for that purpose as its sub-processor under a written intra-group agreement. It does not currently contract with customers. If an Order names it as the contracting party, it is the controller or processor (as Annex B-3 describes) for that Order.
Applicable law. Bahrain Law No. 30 of 2018 on Personal Data Protection and its implementing resolutions apply to processing carried out in Bahrain, in addition to this Policy, including their requirements on security measures, processor obligations and the escalation of breaches.
Transfers. Personal data is made available to Bahrain from Saudi Arabia under SDAIA’s Standard Contractual Clauses. Any transfer from Bahrain to another country is made only to a country on the list approved by Bahrain’s authority, with that authority’s authorisation, or on another basis the Law permits; the basis for each recipient is stated in Part E.
Rights and complaints. Individuals whose data is processed in Bahrain have the rights in section C8 and the rights the Bahrain Law gives them, which they may exercise at info@penny.co. They may also complain to Bahrain’s Personal Data Protection Authority.
Penny Software Holding Limited, registered no. 000003577, Cloud Suite 218, 15th Floor, Al Sarab Tower, Al Maryah Island, Abu Dhabi, United Arab Emirates, is the group holding company established in ADGM. It does not contract with customers and does not access Customer Data. It processes personal data only for its own corporate purposes, such as shareholder, director and staff records, under the ADGM Data Protection Regulations 2021, and maintains its registration with the ADGM Commissioner of Data Protection. If this changes, Penny will update Part E and give notice under DPA clause B3.2. Individuals whose data it processes may contact info@penny.co or complain to the ADGM Commissioner of Data Protection.
Cookies and similar technologies (pixels, local storage, SDKs) store or read small pieces of data on your device. Some cookie identifiers are personal data, and we treat them under the Privacy Policy.
Strictly necessary: sign-in, security, load balancing, remembering your cookie choice. Consent: not needed; the Platform cannot work without them.
Functional: remembering language, filters and display preferences. Consent: needed.
Analytics: measuring how pages and features are used, to improve them. Consent: needed.
Advertising and retargeting: showing Penny ads on other sites and measuring campaigns, including third-party cookies from advertising partners. Consent: needed.
The “Consent: needed” entries above apply to the website (penny.co), where the cookie banner records your choice. For the Platform (app.penny.co), see D2.
On the website (penny.co), a banner on your first visit lets you accept all, reject all non-essential cookies, or choose by category. Non-essential cookies stay off until you opt in, you can change your choice at any time through “Cookie settings” in the site footer, and rejecting them does not limit access to the website. The Platform (app.penny.co) uses the analytics cookies listed in D3 to measure and improve the product, and they are set when you use the Platform. Using the Platform requires accepting the Terms and Conditions, which include this Cookie Policy. You can delete cookies in your browser at any time.
Swipe sideways to see all columns →
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| Website (penny.co), strictly necessary | |||
| cookieyes-consent | CookieYes | records your cookie choice | 1 year |
| wp_consent_functional, wp_consent_preferences, wp_consent_statistics, wp_consent_statistics-anonymous, wp_consent_marketing | WordPress | apply your cookie choice | 30 days |
| Website (penny.co), analytics | |||
| _ga, _ga_3Q3XWVCH5C | Google Analytics | measure visits | 400 days |
| Website (penny.co), advertising and retargeting | |||
| _gcl_au | Google Ads | advertising and retargeting | 90 days |
| IDE | Google DoubleClick | advertising and retargeting | 13 months |
| test_cookie | Google DoubleClick | advertising and retargeting | 15 minutes |
| _fbp | Meta | advertising and retargeting | 90 days |
| _ttp, _tt_enable_cookie, ttcsid, ttcsid_D81IPCBC77UD0UBIJQD0 | TikTok | advertising and retargeting | 90 days |
| _scid, _scid_r, sc_at | Snapchat | advertising and retargeting | 13 months |
| X-AB | Snapchat | advertising and retargeting | 1 day |
| _twpid, _twsid, muc_ads, personalization_id | X | advertising and retargeting | 13 months |
| bcookie | advertising and retargeting | 1 year | |
| li_gc | advertising and retargeting | 6 months | |
| lidc | advertising and retargeting | 1 day | |
| __cf_bm | LinkedIn and X bot check | advertising and retargeting | 30 minutes |
| mlf_attribution, mlf_attribution_latest | Penny | campaign attribution | 90 days |
| Web app (app.penny.co), strictly necessary | |||
| __Secure-penny_refresh | Penny | keeps you signed in | for the session period your organisation sets |
| __Secure-penny_mfa | Penny | two-step sign-in | 5 minutes |
| __Secure-penny_google_state | Penny | sign-in with Google | 5 minutes |
| _GRECAPTCHA | Google reCAPTCHA | protects forms from abuse | 6 months |
| Web app, analytics after sign-in | |||
| _pendo_visitorId, _pendo_accountId, _pendo_meta, _pendo_sessionId | Pendo | product analytics and in-app guides | up to 100 days |
| _hjSessionUser | Hotjar | usage analytics | 1 year |
| _hjSession | Hotjar | usage analytics | 30 minutes |
Wittify (wittify.ai) — Functional. Provides the website chat assistant; loads only if you allow Functional cookies and may store a chat/session identifier in your browser and process the messages you type (servers: wittify.ai, Amazon Web Services).
Questions: info@penny.co.
Last updated: 11 November 2026. Penny gives thirty (30) days’ notice before adding or replacing an entry (DPA clause B3.2). To receive updates by email, write to info@penny.co.
Swipe sideways to see all columns →
| Entity | Location | Role | Data | Safeguard |
|---|---|---|---|---|
| Penny Software Arabia for Information Technology Company | Saudi Arabia (unified national number 7006326446) | contracting entity; operations and support | all Customer Data | not applicable (in-Kingdom). |
| Penny Software W.L.L | Bahrain (registration no. 151350-1) | technical and customer support, as sub-processor to Penny Software Arabia | Customer Data, as needed for support and maintenance | SDAIA Standard Contractual Clauses (intra-group). |
| Penny Software Holding Limited (registered no. 000003577) | UAE (ADGM) | group management | none; no access to Customer Data | not applicable. |
| Cloud hosting providers | Kingdom of Saudi Arabia by default, or the region stated in the Order (clause 10.3 of the Terms) | cloud hosting | all Customer Data | none needed where hosted in the Kingdom; otherwise SDAIA Standard Contractual Clauses. |
| Email and notification providers | Location as notified in this list | transactional email | names, email addresses | SDAIA Standard Contractual Clauses where outside the Kingdom. |
| Licensed payment service providers | Saudi Arabia or as notified | payment processing and settlement as independent licensed providers | billing and transaction data | in-Kingdom, or SDAIA Standard Contractual Clauses where outside. |
| E-invoicing solution providers | Saudi Arabia | ZATCA e-invoicing | invoice data | not applicable. |
| AI model providers | Location as notified in this list | AI features (OCR, chatbot, recommendations) | content submitted to AI features, processed only to return results; no training of the provider’s models; deleted within 30 days | SDAIA Standard Contractual Clauses where outside the Kingdom. |
Named providers:
