I. Introduction and Scope

Welcome to Flextock. This Privacy Policy describes how Flextock ("Flextock," "we," "us," or "our"), a technology-enabled logistics and fulfillment company, collects, uses, and shares personal information when you use our services.

A. Defining Roles: Data Processor vs. Data Controller

Flextock operates in two distinct data roles:

• Flextock as Data Processor: For the personal data of the end customers of our merchants (e.g., names, shipping addresses, phone numbers, and order contents), the Merchant remains the Data Controller. Flextock acts solely as a Data Processor, processing such data only on the documented instructions of the Merchant to fulfill orders, manage inventory, and handle returns, as detailed in our Data Processing Addendum (DPA).
• Flextock as Data Controller: For the personal data of our Merchants (including account owners, billing contacts, and dashboard users) and data collected from our website visitors, Flextock acts as the Data Controller. We determine the purposes and means of processing this data for our own legitimate business operations.

II. Information We Collect

We collect information directly from Merchants, automatically through the use of our dashboard and systems, and indirectly from Merchants about their customers.

A. Information Collected Directly from Merchants (Data Controller)

• Account and Contact Data: Full name, business email address, billing address, business phone number, company name, legal entity documents, and password/login credentials.
• Financial Data: Payment information (e.g., bank account details) used for billing and invoicing our fulfillment services.
• Onboarding Data: Details about the type of products you sell, your anticipated order volume, and your e-commerce platform integrations (e.g., Shopify store URL).
• Usage and Support Data: Communications with our support team, and records of actions taken within the Flextock Merchant Dashboard.

B. Information Processed on Behalf of Merchants (End Customer Data - Data Processor)

We receive this data from your integrated sales channels (like Shopify) solely for the purpose of fulfilling your contractual orders.

C. Information Collected Automatically (System and Log Data)

When you or your authorized users access the Flextock Merchant Dashboard, WMS, or our websites, we automatically collect:

• Log Data: IP address, browser type, operating system, pages viewed, time spent, and referral source.
• Performance Metrics: Data generated by our proprietary systems (Warehouse Management System (WMS) and in-house Fleet Management System (FMS)) such as pick/pack times, delivery success rates, and delivery routes, used for operational analytics.
• Cookies and Tracking: We use cookies and similar technologies to enhance dashboard functionality, remember your preferences, and analyze system performance.

III. How We Use the Information (Purpose of Processing)

We use the collected information for the following key purposes:

A. Providing Fulfillment Services (Core Contractual Obligation)

• Order Execution: Utilizing customer Order Details and Shipping Information via our WMS to execute picking, packing, and dispatching orders.
• Logistics Coordination: Sharing necessary customer data with third-party carriers (e.g., Aramex, Bosta) or our in-house FMS for delivery and status updates.
• Inventory Management: Using Merchant and Order Data to manage, track, and report on the status of your inventory.

B. Account Management and Billing

• Service Provision: Using Merchant Account Data to grant access to the Flextock Merchant Dashboard and maintain your services.
• Financial Processing: Using Financial Data to issue invoices, process payments, and manage billing disputes.
• Communication: Sending essential service announcements, operational updates, and contractual notifications.

C. Improvement and Optimization (Legitimate Business Interest)

• System Enhancement: Analyzing Log Data and Performance Metrics to improve workflow efficiency, optimize warehouse operations (WMS), and enhance route planning (FMS).
• Security: Monitoring systems for unauthorized access, fraudulent activity, and abuse, ensuring the stability and security of our platform.

IV. Sharing and Disclosure of Information (The Recipients)

Flextock only shares information as necessary to perform our fulfillment services, comply with law, or with your explicit consent.

A. Sharing Customer Data with Third-Party Logistics Partners (Processors)

We share the end customer's personal data (Name, Shipping Address, Phone Number, and Order Details) with the following parties:

• Shipping Carriers: Third-party logistics providers (e.g., Aramex, Bosta, etc.) for the sole purpose of delivery, tracking, and proof-of-delivery collection.
• Customs and Border Authorities: For necessary customs clearance and regulatory compliance in cross-border shipping.

B. Service Providers and Sub-Processors

We engage trusted third-party service providers ("Sub-Processors") to help us operate our business, subject to strict contractual confidentiality and data protection obligations:

• Hosting and Infrastructure: Providers who host our WMS, Dashboard, and data storage (e.g., cloud service providers).
• Payment Processors: Used to securely handle billing transactions related to the Merchant's fulfillment fees.

V. International Data Transfers

Flextock operates globally and utilizes cloud infrastructure and sub-processors that may be located outside of the Merchant's or Customer's local operating region (e.g., in Europe, the US, or other regions).When transferring personal data internationally, Flextock ensures that the transfer is lawful by relying on Standard Contractual Clauses (SCCs) or similar legally recognized frameworks to ensure the recipient is bound to protect the data to the same standard required by the local applicable law.

VI. Data Security and Retention

A. Data Security

Flextock implements robust technical and organizational security measures designed to protect the personal data we process:

• System Controls: Data within the Merchant Dashboard, WMS, and FMS is protected by encryption, multi-factor authentication, and role-based access control to limit visibility to authorized personnel.
• We regularly review and update our security protocols in line with industry best practices.

B. Data Retention

We retain personal data for as long as necessary to provide our services, maintain essential business records, and fulfill legal or regulatory obligations.

• Merchant Data: Retained for the duration of the contractual relationship and for a legally mandated period afterward (typically 5-7 years for financial records).
• Customer Data (Fulfillment Records): Retained according to the terms of our Data Processing Addendum (DPA) with the Merchant and as required for legal claims, audits, or tax compliance.

VII. Data Subject Rights

Flextock adheres to the rights mandated by applicable data protection laws.

A. Rights of Flextock Merchants (Data Controller)

Merchants have the right to request access, correction, or deletion of the personal data we hold about their account, subject to our legal obligations.

B. Rights of End Customers (Data Processor)

End customers must direct any requests to exercise their data subject rights (such as access, correction, or deletion) directly to the Merchant (the Data Controller). Flextock will strictly follow the lawful instructions received from the Merchant regarding the handling of this data.

VIII. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.