Effective: 15 October 2026 · Version: 1.2
This policy is published in English.
1. Who we are
BinaFlo is operated by Mivi Tech Labs L.L.C., a limited liability company formed in the State of Wyoming, United States of America, with its registered address at 30 N. Gould Street, Sheridan, Wyoming 82801, USA.
In this policy, "we", "us" and "BinaFlo" mean Mivi Tech Labs L.L.C.
We have no office, branch, establishment or commercial registration in the Sultanate of Oman. We provide BinaFlo to customers in Oman from outside Oman. Nothing in this policy, on our website or in the software should be read as a representation that we are established or registered in Oman.
We are subject to the Personal Data Protection Law promulgated by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024 (together, "the PDPL"), because Article 2 of that Law applies it to the processing of personal data of natural persons in Oman whether the processing takes place inside or outside the Sultanate.
2. The two different roles we play
This is the most important section in this policy, because your rights and who you should contact depend on it.
2.1 Where we are the controller
We decide why and how personal data is processed, and we are directly answerable to you, when we handle:
- data about the person who signs up for a BinaFlo account and the individuals at a customer company who administer it
- data about visitors to binaflo.com
- data about people who contact us for sales, support or any other reason
2.2 Where we are the processor
The customer company — the contractor that subscribes to BinaFlo — is the controller of everything its staff put into the system. We are its processor. We act on that company's documented instructions and we do not decide what to do with that data ourselves.
This covers, among other things:
- employee and worker records, including names, civil ID and passport details, visa and permit data, photographs, nationality, job title, contact details and bank account details
- attendance, working hours and overtime records
- payroll, salary, deductions, social insurance and gratuity calculations
- WPS bank files
- leave, safety incident and document expiry records
- customer, supplier and subcontractor contact details entered by the customer company
If you are a worker, an employee or a site supervisor at a company that uses BinaFlo, your employer is the controller of your data, not us. Ask your employer to exercise your rights. If you contact us directly we will pass your request to your employer and tell you that we have done so — we are not permitted to act on your data without your employer's instruction.
3. What we collect when we are the controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | full name, job title, work email address, mobile number, preferred language | you, at signup |
| Company details | legal and trading name, commercial registration number, VAT registration number, tax card number, chamber of commerce number, municipality number, registered address, bank details for invoicing | you, in Company Profile |
| Authentication | password (stored only as a salted hash, never in readable form), one-time verification codes, session tokens | generated when you sign in |
| Billing | subscription plan, invoices we issue to you, payment status and dates | generated by us |
| Usage and technical | IP address, browser and device type, operating system, pages visited, actions taken in the application, timestamps, error reports | collected automatically |
| Security and audit | sign-in attempts including failures, IP addresses used, changes made to records, the identity of the user who made each change | collected automatically |
| Support | the content of messages you send us, and our replies | you |
We do not knowingly collect any of the categories that Article 5 of the PDPL treats as sensitive personal data — genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or data relating to security measures.
BinaFlo records attendance using QR codes and manual entry. It does not use fingerprints, facial recognition or any other biometric identifier. If we ever introduce such a feature we will update this policy first, and we will not process biometric data without the permit that Article 5 of the PDPL requires, or without an applicable exemption under Article 5bis.
We treat civil ID numbers, passport numbers, salary figures and bank account details as personal data requiring strong protection. Under Article 5 of the PDPL they are not classified as sensitive personal data, and we do not claim otherwise.
4. Why we process it, and on what legal basis
The PDPL permits processing without the data subject's explicit consent only in the four cases set out in Article 10bis. There is no "legitimate interests" basis in Omani law. Where none of those four cases applies, we rely on your consent, and you may withdraw it.
| What we do | Why | Legal basis |
|---|---|---|
| Create and operate your account; deliver the subscription you bought | To perform our contract with you | Art. 10bis(d) — execution of a contract to which the data subject is a party. Our Terms of Service and Data Processing Agreement contain the evidence of PDPL-compliant processing that Art. 10bis(d) requires. |
| Authenticate you, keep the service secure, detect abuse, maintain audit logs | To protect your data and ours | Art. 10bis(d), and Art. 13, which obliges us to apply security measures |
| Issue invoices, take payment, keep accounting records | To be paid, and to meet tax and accounting record-keeping obligations | Art. 10bis(a) — implementation of a legal obligation |
| Provide support when you contact us | To answer you | Art. 10bis(d) |
| Transfer data outside Oman so the service can run at all | See Section 8 | Your express consent, required by Executive Regulation Arts. 37–40 |
| Send you product announcements, offers or marketing | To tell you about BinaFlo | Your consent, which we ask for separately and which you may withdraw at any time. Art. 22 of the PDPL governs marketing. |
| Improve the product using aggregated statistics | To make BinaFlo better | Only after the data has been anonymised so that it is no longer personal data |
We do not sell personal data. We do not share it with advertisers. We do not use it to train machine learning models.
5. Automated decisions
BinaFlo does not make decisions about you by automated means alone.
The software performs automated calculations — overtime, gratuity, social insurance, VAT, Omanisation percentages. These produce figures for a human to review and act on. They do not by themselves decide anything about a person's employment, pay or status; the customer company's own staff do that.
If we ever introduce a genuinely automated decision, Article 14 of the PDPL gives you the right to object to it, and obliges us to introduce a human element when reviewing a decision you have objected to. We will tell you before any such feature goes live.
6. Who we disclose data to
We disclose personal data only to the parties below, only for the purposes stated, and only under a written contract that obliges them to protect it.
6.1 Sub-processors
| Sub-processor | What they do | Data they see | Location |
|---|---|---|---|
| Ezerit Solutions OPC Pvt Ltd (trading as EzerHost) | Hosts the application, the database and file storage | All data in the service | India (Delhi) |
| Resend (Resend Inc.) | Sends transactional email — invitations, verification codes, password resets, notifications | Recipient name and email address, and the content of the message | United States |
| Cloudflare (Cloudflare, Inc.) | Offsite encrypted backup storage (R2) | Encrypted backups only. Backups are encrypted before they leave our servers and Cloudflare does not hold the decryption key. | United States / global |
We will update this table before adding any new sub-processor, and we will notify subscribing customers in advance as set out in the Data Processing Agreement.
6.2 Others
- Professional advisers — lawyers, accountants and auditors, under a duty of confidentiality. This includes the independent compliance auditor that Article 16 of the PDPL requires us to appoint.
- Authorities — where we are compelled by a valid legal obligation, court judgment, order or decision. We will tell you unless we are legally prohibited from doing so.
- A buyer, if the business is sold or merged. You will be told before your data moves, and the buyer will be bound by terms no less protective than these.
We never disclose one customer's data to another customer. Every record in BinaFlo carries a company identifier and is isolated at the database query level.
7. Where data is stored and how it moves
Your data is stored on servers located in India, and is accessed for administration from India and from other locations where our personnel work.
This means personal data of individuals in Oman is transferred outside the Sultanate.
8. Transfers outside Oman — and your consent to them
Article 23 of the PDPL permits transferring personal data outside Oman in accordance with the controls set by the Executive Regulation. It prohibits a transfer where the data has been processed in violation of the Law, or where the transfer would cause harm to the data subject.
We cannot provide BinaFlo without transferring your data outside Oman. We are not established in Oman and we do not operate servers there.
What the law requires, and what we have done
| Requirement | Source | What we do |
|---|---|---|
| The data subject's express consent to the transfer | Executive Regulation Arts. 37–40 | We ask for it separately at signup, in a step of its own, not bundled into acceptance of these terms. You can withdraw it — see below. |
| The recipient must guarantee protection not less than the PDPL standard | Executive Regulation Arts. 37–40 | Every sub-processor is under a written contract imposing PDPL-equivalent obligations, breach notification, confidentiality and audit rights. |
| A documented transfer impact assessment | Executive Regulation Art. 39 | We have carried one out for each destination and each sub-processor. It records the destination country's legal framework, the risk of government access, the technical and contractual safeguards, and our conclusion. We will provide a copy to the Ministry of Transport, Communications and Information Technology (MTCIT) on request, and a summary to a subscribing customer on request. |
Prior approval from MTCIT is not required for a transfer of this kind, and we have not obtained one. There is no list of approved or adequate countries under Omani law; the assessment is ours to make and to document.
If you withdraw consent to the transfer
You may withdraw it at any time by writing to the address in Section 13.
We want to be straightforward about the consequence: because the service cannot operate without the transfer, withdrawing consent means we can no longer provide BinaFlo to you. We will treat it as a request to close the account, stop processing, and delete or return the data under Section 10. In that situation we will refund any prepaid fees for the period after the account is closed.
9. How we protect it
- In transit — TLS on every connection, with certificates from a recognised authority. Plain HTTP is redirected, never served.
- At rest — full database backups taken daily, encrypted with
agebefore leaving the server, and held in offsite object storage by a provider that does not hold the decryption keys. - Passwords — stored only as salted hashes. We cannot read your password and will never ask you for it.
- Access control — role-based permissions with per-user overrides. Every operational record carries a company identifier and queries are scoped to it.
- Audit — sign-ins, failures, and changes to records are logged with the acting user, the time and the source IP.
- Segregation — production and staging are separate environments with separate databases and separate credentials.
- Administrative access — restricted to named personnel, over key-based SSH only, with no password authentication.
Article 13 of the PDPL requires a controller to apply measures appropriate to the risk. We review these annually and after any incident.
No system is perfectly secure, and we will not tell you otherwise. What we commit to is the standard above, and to telling you promptly when something goes wrong — see Section 11.
10. How long we keep it
| Data | Retention | Why |
|---|---|---|
| Account and profile data | For the life of the subscription, then 90 days | To allow reactivation and export after cancellation |
| Customer content — employee, attendance, payroll, invoice and project records | For the life of the subscription, then 90 days, then deleted | The customer company is the controller and sets its own retention; we hold it only while instructed |
| Invoices we issue to you, and our accounting records | 10 years | 10 years from the end of the tax year in which the return is filed — Omani tax law |
| Security and audit logs | 12 months | Security investigation and dispute resolution |
| Backups | 7 days locally, 30 days offsite, then overwritten | Disaster recovery |
| Support correspondence | 24 months | Service history |
| Marketing consent records | Until withdrawn, plus 24 months | To prove consent was given, as Art. 22 requires |
A customer company's own obligations may be longer than ours — for example Article 52 of the Labour Law RD 53/2023 requires an employee's personnel file to be kept for at least one year after employment ends, and tax records must be kept for ten years. Those obligations sit with the employer. Export your data before you cancel. We provide export in the application, and the 90-day window after cancellation is a courtesy, not a guarantee.
When a retention period ends we delete the data or irreversibly anonymise it. Data already written to a backup is removed when that backup rotates out, within the periods above.
11. If there is a breach
Article 19 of the PDPL and Articles 30 and 32 of the Executive Regulation set two separate obligations, both within 72 hours.
- If a breach threatens your rights, we notify the Ministry of Transport, Communications and Information Technology within 72 hours of becoming aware of it, using the Ministry's Personal Data Breach Report Form.
- If a breach is likely to cause you serious harm or a high risk, we notify you within 72 hours as well.
We will tell you what happened, what data was affected, what we have done, and what you should do. Article 11(f) gives you the right to be notified, and we will not use uncertainty about scope as a reason to delay telling you that something happened.
Where we are the processor, we notify the customer company without undue delay and support its own notifications. We do not notify that company's workers directly unless the company instructs us to.
12. Your rights
Article 11 of the PDPL gives you the following rights over personal data we hold about you as controller:
| Right | Article | What it means |
|---|---|---|
| Withdraw consent | Art. 11(a) | Where we rely on your consent, you can take it back. This does not undo processing already carried out lawfully. |
| Rectification | Art. 11(b) | Have inaccurate data amended or updated, or have processing blocked |
| Access | Art. 11(c) | Obtain a copy of your personal data that we process |
| Portability | Art. 11(d) | Have your personal data transferred to another controller |
| Erasure | Art. 11(e) | Have your data deleted, subject to the archival exception in that article and to the retention obligations in Section 10 |
| Breach notification | Art. 11(f) | Be told when your data is compromised |
| Object to automated decisions | Art. 14 | Object to a decision produced by automated processing, and require a human element in the review |
How to exercise them
Write to the Data Protection Officer at the address in Section 13, saying which right you want to exercise. We may ask for proof of identity, and only for that purpose.
We respond within 45 days, free of charge. We may refuse a request that is manifestly repetitive, and if we refuse we will tell you why and tell you that you may complain to the Ministry.
(The 45-day deadline is set by the Executive Regulation. We do not cite an article number for it here because published sources disagree on which one it is.)
If your employer uses BinaFlo, we are the processor of your employment data and not the controller. Send your request to your employer. If you send it to us, we will forward it and confirm to you that we have.
13. Data Protection Officer, and how to contact us
Article 20 of the PDPL requires every controller to appoint a Data Protection Officer, with no exemption for small organisations. Articles 34 and 35 of the Executive Regulation require the contact details to be published.
Data Protection Officer: Sanjay Kashyap Madhu Email: privacy@binaflo.com Postal: Mivi Tech Labs L.L.C., 30 N. Gould Street, Sheridan, Wyoming 82801, USA
For anything else: support@binaflo.com
We aim to acknowledge within 5 working days and to answer substantively within the 45-day limit.
We are not required by Omani law to appoint a representative in Oman, and we have not appointed one. Neither the Law nor the Executive Regulation imposes that obligation on a foreign controller. If that changes, we will appoint one and update this policy.
14. Complaining to the regulator
Article 12 of the PDPL gives you the right to complain to the Ministry. You do not have to come to us first, although we would prefer the chance to put things right.
Ministry of Transport, Communications and Information Technology (MTCIT) Personal Data Protection Department Email: PDPC@mtcit.gov.om Portal: https://mtcit.gov.om/sectors/governance/personal Complaints form: "Reporting/Complaint for Violations of the Personal Data Protection Law"
The Ministry decides complaints within 60 days. Silence after that period is treated as rejection.
15. Children
BinaFlo is a business application for construction companies and is not intended for anyone under 18. We do not knowingly collect data from children. Article 6 of the PDPL contains specific protections for children's data; if you believe a child's data has reached us, write to privacy@binaflo.com and we will delete it.
Where a customer company enters data about a worker who is a minor, that company is the controller and is responsible for the lawfulness of doing so, including under the Labour Law.
16. Cookies and similar technologies
We use the minimum necessary:
| Purpose | What it is | Can you refuse? |
|---|---|---|
| Keeping you signed in | A session cookie or token in local storage | No — the application cannot work without it |
| Remembering your language choice | A preference cookie | Yes, at the cost of re-selecting each visit |
| Security, rate limiting and abuse prevention | Short-lived technical cookies | No |
We do not use advertising cookies, third-party trackers, cross-site tracking pixels or analytics that profile you as an individual. If we ever add analytics, it will be a form that does not identify individuals, we will say so here first, and we will ask for consent where required.
17. Changes to this policy
When we change this policy we update the version number and the effective date at the top, and we keep previous versions available.
For a change that materially affects your rights or how we use your data, we notify account holders at least 30 days before it takes effect, by email and in the application. Where the change requires your consent under the PDPL, we ask for it — we do not treat silence or continued use as consent to a new purpose.
18. Governing law
This policy is governed by the laws of the Sultanate of Oman, and in particular the Personal Data Protection Law promulgated by Royal Decree 6/2022 as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024.
Nothing in this policy limits any right you have under Omani law.
BinaFlo is a product of Mivi Tech Labs L.L.C., Wyoming, USA. Version 1.2, effective 15 October 2026.