Privacy Policy – KSA ZATCA Integration Phase 1 and 2

1. Introduction

This Privacy Policy explains how Index of Solutions handles data when you use our ZATCA E-Invoicing Integration extension for Microsoft Dynamics 365 Business Central, covering both Phase 1 (Generation) and Phase 2 (Integration) of the Saudi e-invoicing mandate. We are committed to protecting your privacy and to being transparent about how data is processed and where it goes.

2. Scope

This policy applies only to the ZATCA E-Invoicing Integration extension and the support services Index of Solutions provides around it. It does not cover the third-party e-invoicing service provider you connect it to, Microsoft Dynamics 365 Business Central itself, or any other system you may use alongside the extension — each is governed by its own privacy terms.

3. How the Extension Works

The extension is a connector. It does not itself clear, report, stamp or sign invoices with the Saudi Zakat, Tax and Customs Authority (ZATCA). Submission to the ZATCA FATOORA platform is performed by a third-party e-invoicing service provider — LinkPro or Flick — with which you hold your own account and agreement.

The extension therefore transmits sales document data from your Business Central environment to the provider endpoint you configure, using the credentials you supply. Index of Solutions is not a party to your agreement with that provider, and device registration, cryptographic stamping and certificate management remain between you and the provider.

4. Data Transmitted by the Extension

To produce a compliant e-invoice, the extension sends the following sales document data to your configured provider endpoint:

• Customer name, in both English and Arabic
• VAT registration number and Commercial Registration Number (CRN)
• Customer address
• Document numbers and dates
• Line descriptions, quantities, prices and discounts
• VAT amounts

This data originates in your own Business Central environment and is transmitted only to the endpoint you configure. Index of Solutions does not receive a copy of your invoice data, does not store it outside your environment, and never sells, rents or shares it.

5. Diagnostic Telemetry

The extension emits operational telemetry through Microsoft Azure Application Insights, used solely for diagnostics and product improvement. This is technical information about how the extension itself is running — such as extension version, feature usage, error messages, response codes and performance timings.

Telemetry is not used for marketing or profiling, is not sold or shared with third parties, and is retained under the terms of the Microsoft Azure service that hosts it. Invoice content is not the purpose of this telemetry.

6. Data Ownership and Roles

All data processed through the extension remains the property of your organization, and data stored in your Business Central environment stays yours — including if you later uninstall the extension.

You are the data controller for the data you submit. By configuring the extension, you confirm that you have a lawful basis to transmit that data to your chosen e-invoicing provider. Index of Solutions acts only as a software provider and, where we deliver support, as a processor acting on your instructions.

7. Data Security

The extension relies on the secure environments of Microsoft and your chosen provider, and follows industry best practices:

• Encryption: HTTPS / TLS for every call to the provider endpoint.
• Access: Role-based control in Business Central; provider credentials held by you.
• Storage: No invoice data stored by Index of Solutions outside your environment.

Keeping your provider credentials confidential is your responsibility. If you believe they have been exposed, rotate them with your provider immediately.

8. Disclosure to Third Parties

We do not share, sell or distribute your information to third parties. The only outbound data flow is to the LinkPro or Flick endpoint you configure, which forwards to ZATCA strictly to meet statutory e-invoicing requirements, and the diagnostic telemetry described above. Provider availability, pricing and terms are outside our control.

9. Record Retention

Retaining your invoices, signed XML documents and audit records for the period required by Saudi law is your responsibility, not ours. The extension does not act as an archive, and Index of Solutions does not keep a copy of these records on your behalf.

10. User Responsibilities

As a user of the extension, you are responsible for:

• The accuracy and completeness of the master data and transactions you submit — VAT registration numbers, CRN, Arabic names and addresses
• Holding an active agreement and account with your chosen e-invoicing provider, and keeping its credentials confidential
• Verifying the result of each submission and retaining the resulting records as Saudi law requires
• Your own compliance with ZATCA regulations and the Saudi VAT Implementing Regulations
• Microsoft Dynamics 365 security and privacy policies, and your organization’s internal data protection policies

The extension is software, not tax or legal advice. It does not by itself guarantee compliance with any ZATCA requirement, phase or technical specification, and those requirements change over time.

12. Updates to This Policy

We may update this Privacy Policy periodically to reflect legal, technical, or operational changes. The updated version will always be available on our website.