PrivacyPolicy
Feexid Privacy Policy
1. Introduction
At Feexid (operated by Digimax, "we," "us," or "our"), we are committed to protecting your privacy and the personal data entrusted to us. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Feexid Software-as-a-Service (SaaS) platform, our website, mobile applications, APIs, and related services (collectively, the "Service").
By accessing or using Feexid, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read together with our Terms and Conditions, Acceptable Use Policy, and Data Processing Addendum (DPA).
If you do not agree with this Policy, please do not use the Service.
2. Scope and Applicability
This Privacy Policy applies to:
• Visitors to our website (www.feexid.com)
• Subscribers and Authorized Users of the Feexid platform (Monthly and Annual subscribers)
• Individuals whose personal data is processed by our Users through the Service (e.g., the User's customers, employees, suppliers)
• Anyone who contacts us, applies for a job, or interacts with our marketing channels
This Policy is governed by and complies with: The Malawi Data Protection Act, The EU General Data Protection Regulation (GDPR), where applicable, The UK Data Protection Act 2018 / UK GDPR, where applicable, The South African POPIA, where applicable, and Other relevant national or regional data protection laws.
3. Definitions
• "Personal Data": any information relating to an identified or identifiable natural person.
• "Processing": any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
• "Data Controller": the party that determines the purpose and means of processing Personal Data.
• "Data Processor": the party that processes Personal Data on behalf of the Controller.
• "Data Subject": the individual to whom the Personal Data relates.
• "Customer Data": data uploaded or processed by Users through the Service.
• "Sub-processor": a third party engaged by Digimax to process Personal Data.
4. Our Role: Controller vs. Processor
4.1 As a Data Controller
We are the Controller for: Account registration data of Subscribers and Authorized Users, Billing and payment information, Website visitor data and marketing communications, Job applicants and HR data, Support, communications, and feedback data.
4.2 As a Data Processor
We are the Processor for: All Customer Data uploaded into Feexid by our Users (e.g., the User's customers, transactions, invoices, inventory data). In this role, the User is the Controller and is responsible for ensuring lawful basis, consent, and data subject rights for their data subjects.
5. Personal Data We Collect
5.1 Information You Provide Directly
• Account Information: name, email address, phone number, business name, job title, country.
• Authentication Data: username, password (hashed), MFA tokens.
• Billing Information: billing address, tax ID, payment card details (processed securely via PCI-DSS-compliant payment processors; we do not store full card numbers).
• Communications: messages, support tickets, feedback, survey responses.
• Content/Customer Data: business records, transactions, invoices, inventory, CRM contacts, and other data you upload.
5.2 Information Collected Automatically
• Device & Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution, time zone.
• Usage Data: pages viewed, features used, click patterns, session duration, login timestamps, error logs.
• Cookies & Similar Technologies: see Section 12.
• Location Data: general geographic location derived from IP address (not precise GPS unless explicitly enabled).
5.3 Information from Third Parties
• Payment Processors: transaction confirmations and fraud signals.
• Authentication Providers: if you sign in via Google, Microsoft, or similar SSO services.
• Marketing Partners: lead data where lawfully shared.
• Public Sources: business registries, when verifying business identity.
5.4 Sensitive Data
We do not knowingly collect sensitive personal data (e.g., health, biometric, racial, religious, sexual orientation data) and ask Users not to upload such data into Feexid unless explicitly supported and contractually permitted.
6. Legal Bases for Processing (GDPR Compliance)
Where GDPR applies, we rely on the following legal bases:
• Contract Performance: Providing the Service, account management, billing.
• Legitimate Interests: Service improvement, fraud prevention, security, analytics.
• Legal Obligation: Tax records, regulatory compliance, court orders.
• Consent: Marketing emails, optional cookies, newsletters.
• Vital Interests: Emergency situations involving safety.
You may withdraw consent at any time without affecting the lawfulness of prior processing.
7. How We Use Personal Data
We use Personal Data to:
1. Provide the Service: create accounts, authenticate users, deliver features, process transactions.
2. Billing and Payments: process subscriptions (Monthly/Annual), invoices, refunds.
3. Customer Support: respond to inquiries, troubleshoot issues, deliver SLA commitments.
4. Improve and Develop the Service: analyze usage, optimize performance, develop new features.
5. Security and Fraud Prevention: detect, investigate, and prevent unauthorized access, abuse, or illegal activity.
6. Communications: send service updates, security alerts, billing notices, and (with consent) marketing.
7. Legal Compliance: comply with applicable laws, regulations, and lawful requests from authorities.
8. Analytics and Reporting: aggregated/anonymized usage analytics that cannot identify individuals.
9. AI and Automated Features: train, improve, and operate AI/ML-powered features using anonymized or aggregated data only (we do not train external AI models on your identifiable Customer Data without explicit consent).
9. International Data Transfers
Feexid may transfer Personal Data across borders for hosting, support, and processing. Where data is transferred outside Malawi or the EEA, we implement appropriate safeguards, including:
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding contractual obligations with sub-processors
• Encryption in transit and at rest
You may request more information on transfer safeguards via info@digimaxmw.com.
10. Data Retention
We retain Personal Data only as long as necessary for the purposes outlined in this Policy:
• Account Information: Active subscription + 90 days
• Customer Data (Monthly Plan): 30 days post-termination, then permanent deletion
• Customer Data (Annual Plan): 90 days post-termination, then permanent deletion
• Billing & Tax Records: 7 years (or as required by Malawian tax law)
• Support Tickets: 3 years from resolution
• Marketing Data: Until consent is withdrawn
• Backups: Rolling 30–90 days, automatically purged
• Audit and Security Logs: Up to 2 years
After retention periods expire, data is permanently deleted or irreversibly anonymized.
11. Security Measures
Digimax employs industry-standard, layered security controls, including:
• Encryption: TLS 1.2+ in transit; AES-256 at rest.
• Access Controls: Role-based access, least-privilege principles, MFA for staff.
• Network Security: Firewalls, intrusion detection/prevention systems, DDoS protection.
• Monitoring: 24/7 security monitoring, audit logs, anomaly detection.
• Backups: Automated, encrypted, and regularly tested for restorability.
• Vulnerability Management: Regular vulnerability scans and periodic penetration tests.
• Employee Training: Mandatory privacy and security training; signed confidentiality agreements.
• Vendor Risk Management: Due diligence on all sub-processors.
While we apply strong safeguards, no system is 100% secure. Users are responsible for maintaining the security of their credentials and devices.
13. Your Privacy Rights
Subject to applicable law, you have the following rights:
• Right to Access: Request a copy of Personal Data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion (subject to legal retention obligations)
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time
• Right Not to Be Subject to Automated Decisions: Decisions producing legal/significant effects
• Right to Lodge a Complaint: With your local data protection authority
13.1 How to Exercise Your Rights: Contact us at info@digimaxmw.com. We will respond within 30 days.
13.2 Identity Verification: We may request reasonable proof of identity.
13.3 Requests Involving Customer Data: If you are a data subject of one of our Users, please contact the User directly.
14. Children's Privacy
Feexid is intended for business use only and is not directed to children under 18. We do not knowingly collect Personal Data from children. If we become aware of data collected from a minor, we will delete it promptly. Parents or guardians may contact info@digimaxmw.com.
15. Marketing Communications
With consent, we may send marketing emails about new features, promotions, or related services. You may unsubscribe at any time via:
• The "unsubscribe" link in any marketing email
• Account preferences in Feexid
• Emailing info@digimaxmw.com
Transactional and service-related emails (e.g., billing, security alerts) are essential and cannot be opted out of without account closure.
16. Automated Decision-Making and AI
Feexid may use automated processing and AI/ML features. These features:
• Do not make decisions producing legal or similarly significant effects without human review.
• Use anonymized or aggregated data wherever possible.
• Are not used to train external/third-party AI models on identifiable Customer Data without explicit consent.
You may request human review of any decision you believe was made solely on automated processing.
17. Data Breach Notification
In the event of a confirmed Personal Data breach likely to result in risk to data subjects, we will:
• Notify affected Users within 72 hours of discovery.
• Notify relevant supervisory authorities as required by law.
• Provide information about the nature of the breach, likely consequences, and mitigation measures.
• Cooperate with affected Users to fulfill their own breach notification duties.
18. Third-Party Links and Integrations
Feexid may link to or integrate with third-party services (e.g., payment gateways, accounting software, email providers). These third parties have their own privacy policies, and we are not responsible for their practices. Review their policies before sharing data.
19. Subscriber-Specific Privacy Notes
19.1 Monthly Plan Subscribers
Account data retained for 30 days post-termination. Standard support response times. Standard sub-processor list applies.
19.2 Annual Plan Subscribers
Account data retained for 90 days post-termination. Priority privacy request handling (response within 14 days). Eligible for a dedicated DPA. May request additional security attestations.
20. Whistleblower and Privacy Concerns
If you believe we have violated this Policy or your privacy rights, please contact our Data Protection Officer (DPO) at info@digimaxmw.com. We investigate all concerns confidentially and in good faith. You may also lodge a complaint with the relevant supervisory authority in your jurisdiction.
21. Jurisdiction-Specific Disclosures
21.1 European Economic Area (EEA), UK, Switzerland
Data subjects in these regions have rights under GDPR/UK GDPR. Our representative can be contacted at info@digimaxmw.com.
21.2 California Residents (CCPA/CPRA)
California residents have the right to know what data is collected, request deletion, and opt out of sale (we do not sell data).
21.3 South Africa (POPIA)
South African data subjects have rights under POPIA. Our Information Officer can be contacted at info@digimaxmw.com.
21.4 Malawi
This Policy complies with the Malawi Data Protection Act. MACRA or applicable supervisory authority is the relevant body for complaints.
22. Changes to This Privacy Policy
We may update this Policy from time to time. Material changes will be communicated by email and/or in-app notice at least 30 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance. If you do not agree, you may terminate your subscription.
If you have any questions about this Privacy Policy, please contact us at info@digimaxmw.com