Privacy policy · Diwink

Who we are

This site and Diwink Cloud are published by Fikra Systems (“we”), whose registered office is in Saida (Algeria); its full details are given in the legal notice. For the processing described in this policy, Fikra Systems is the controller.

For any question about your personal data, or to exercise your rights: contact@fikrasystems.com.

This policy applies law no. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended and supplemented by law no. 25-11 of 24 July 2025.

For people in the European Economic Area, this policy also applies Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

What this policy covers

It covers the visitors of this site, the people who have a Diwink Cloud account and the contacts of customer organisations (owners, billing addresses).

It does not cover the data an organisation entrusts to Diwink Cloud about its users (their Windows accounts, their print history): for those, the organisation is the controller, and Fikra Systems processes them on its behalf as described in the data processing agreement. If you print in an organisation that uses Diwink, contact it first; we pass on to it the requests we receive about these data.

This site

This site sets no cookies and uses no audience measurement, no tracker and no resource from another site (font, script, video): your browser contacts only this site. It has no form.

If you arrive through a link from a Fikra Systems partner (an address containing ?ref=), its code is kept by your browser for your visit (in the tab’s session storage, cleared when the tab is closed) and added to the sign-up links, and to the link to Diwink’s other site: it is sent to Diwink Cloud with the sign-up page’s address when you open it, and is recorded with an organisation only if you sign up.

Like any web server, the site’s server may record the technical data of each request: IP address, page requested, date, browser. These logs serve only its security and its proper working, and are kept for a limited time.

Your account and your organisation

When you use Diwink Cloud, we process:

your name and your work e-mail address;
your password, kept only as a hash from which it cannot be recovered;
if you turn it on, two-step verification: the key of your authenticator app, encrypted, and the hashes of your recovery codes;
your language, the organisations you belong to, the dates your account was created and you last signed in, failed sign-ins and lockouts;
for your organisation: its name, its e-mail domain, its market, its language, its time zone, its owner and, where applicable, the code of the partner it came through;
its plan, its seats, its periods, its billing documents and its payments (amount, date, payment method, the provider’s reference);
its usage figures (numbers of users, PCs, printers, print jobs and pages, with no names) and the date of its last activity.

When a reseller partner creates the organisation, its owner’s name and e-mail address are given to us by that reseller, and the account is created before the owner sets it up.

For billing, we also process the organisation’s details: its legal name, its billing e-mail address, its address and its VAT number. Paddle collects your payment details itself, on its own pages (see “Who receives them”).

E-mails, correspondence and logs

We send you the service’s e-mails: confirmation of your address, invitations, new password, your organisation being ready, the notifications your organisation chose to send by e-mail, billing documents, notices of the end of a period or of inactivity. We send you no marketing without your consent.

When you write to us, we keep your messages for as long as needed to answer you and follow up your request.

The service keeps technical logs, for 30 days, to run and to detect incidents. Your IP address is used to limit sign-up and sign-in attempts; your organisation’s audit log records it with each sign-in to the panel and each change.

Why we process them

We process these data to:

provide Diwink Cloud: create and protect your account, prepare your organisation, sign you in, send the invitations and the service’s e-mails;
bill: issue the billing documents, collect payments and keep our accounts;
apply your plan and size the service, from the usage figures;
protect the service and its customers: check that addresses are work addresses, limit sign-in attempts, detect abuse and incidents;
warn Free-plan organisations that have stayed inactive before they are deleted.

We do not sell your data and do not use them for advertising.

Its legal bases (GDPR, article 6) are the performance of the contract to which you are a party (providing the service, billing), compliance with our legal obligations (billing, accounting) and our legitimate interest in providing an organisation’s members and billing contacts with the service it subscribed to, protecting that service, sizing it and warning inactive organisations. We take no decision based solely on automated processing that produces legal effects concerning you (GDPR, article 22).

Who receives them

Your data are accessible to:

the members of Fikra Systems’ team who need them, according to their role (support, billing);
the host of Diwink Cloud and of Diwink Hub, Fikra Systems’ back office where billing and the owners’ details are kept, and the service that sends our e-mails, which process them on our behalf;
if your organisation came through a Fikra Systems partner, or a reseller partner manages its subscription, that partner, limited to the information described in “What partners receive”;
the authorities, when the law requires us to.

Purchases are made from Paddle, Fikra Systems’ reseller and merchant of record: Paddle collects your payment details (card, billing address, country, VAT number) on its own pages and processes them as a controller, under its privacy notice. We send it only your organisation’s identifier; we never receive your full card number: Paddle sends us the state of the subscription, the amounts paid and their references and, for a card payment, the card’s type, its last four digits, its expiry date and the cardholder’s name.

What partners receive

Fikra Systems’ partners are referral partners, who recommend Diwink, and resellers, who sell it to their customers. In their portal, they receive only the following information.

The partner your organisation is attributed to, because it signed up through its link or Fikra Systems attributed it to that partner (a referral partner or a reseller alike), receives:

the organisation’s name, its sign-up date, its state, its plan (or the Free plan), whether it pays for a subscription and whether a reseller partner manages it;
the dates between which its payments earn the partner a commission: from its first payment, for the period agreed with the partner;
for each commission: the document paid (Fikra Systems’ invoice number, or the Paddle transaction’s reference), the amount excluding taxes it is computed on, its rate, amount, currency, date, state and payout.

The reseller partner managing your organisation’s subscription also receives:

the organisation’s market, language, time zone and state, the dates it was created and activated;
its owner’s e-mail address and name as the reseller entered them when it created the organisation (none when Fikra Systems attached the organisation to it), and whether the owner has set up their account;
its subscription: plan, seats bought and those of the next period, state, how it is paid, period and end; the number of seats in use;
its numbers of PCs (and of PCs online), printers and active users, the date of its last activity and that of an inactivity notice;
its figures for each of the last 90 days: print jobs, refused jobs, pages, PCs, printers and users, without any name;
the billing documents Fikra Systems addresses to the reseller for it, and the reseller’s payments.

For Diwink Server, installed on the customer’s premises, the reseller holding a key receives the activations of that key on its customer’s server: the server’s name and serial number, the company name entered in its settings, its numbers of PCs, printers and users at its last check, and the dates of activation, end and last check.

Apart from the owner’s address and name that the reseller itself typed, no partner receives the names or addresses of the organisation’s users, nor anything they print.

Hosting and transfers

Diwink Cloud, and Diwink Hub where billing is kept, are hosted by Fikra Systems with a professional hosting provider. Law no. 18-07 makes any transfer of personal data abroad subject to the prior authorisation of the ANPDP, save for the exceptions the law provides: Fikra Systems makes none without it.

Fikra Systems is established outside the European Union: the data of people in the European Economic Area are therefore processed outside it. For any question about this, write to us.

How long we keep them

Your account: as long as you belong to an organisation; you may ask for its deletion at any time. An account that no longer belongs to any organisation is kept until you ask for its deletion.
Your organisation and its details: as long as it exists. A Free-plan organisation with no activity is deleted after 90 days, following two warnings by e-mail (at 60 and 80 days).
A sign-up whose address is never confirmed (the account, its organisation being prepared and what Diwink Hub receives of it): deleted 14 days after the sign-up. An invitation that is not accepted: deleted 30 days after it expires.
After an organisation is deleted: a record of its existence (name, owner, dates), 10 years, like our accounting documents.
The account of the owner of an organisation a reseller partner created, when the owner never sets it up: as long as the organisation exists. The partners’ commissions: 10 years, like our accounting documents.
Billing documents and payments: 10 years (a legal obligation).
The payment providers’ notifications: 10 years, with the accounting documents they support.
The service’s technical logs: 30 days.

How long the data your organisation entrusts to Diwink Cloud are kept, including the print history according to its plan, is set out in the data processing agreement.

Security

Each organisation has its own database; exchanges with the panel and with the PCs are encrypted (HTTPS); passwords are kept only as hashes and secrets are encrypted; an account is locked for 15 minutes after 5 failed sign-ins; two-step verification is available; rights in the panel follow roles, and every change is recorded in the audit log. The details are on the Security page and in the annex of the data processing agreement.

Your rights

Law no. 18-07 gives you a right to information, a right of access to your data, a right of rectification (updating, rectifying, erasing or locking data that are inaccurate, incomplete or processed in breach of the law) and a right to object, on legitimate grounds, to their processing. No direct marketing is sent to you without your prior consent.

You may lodge a complaint with the National Authority for the Protection of Personal Data (ANPDP).

If you are in the European Economic Area, the GDPR also gives you the rights of access to your data, rectification, erasure, restriction of processing, portability and objection (articles 15 to 21), and the right to withdraw at any time a consent you gave.

You may then also lodge a complaint with the data protection authority of the Member State where you live or work, or where you believe an infringement took place.

Exercising your rights

Write to us at contact@fikrasystems.com, preferably from your account’s address: we may ask you to prove your identity. You can also change your name and your language yourself in your Diwink Cloud account.

For the data about you in an organisation (your user, your print history), contact its administrators: in the panel, they can view your user and your history, export the history (Excel files), and correct or delete your user. The history cannot be corrected or deleted: it is kept according to the organisation’s plan and still names you once your user is deleted, as the data processing agreement sets out. We pass on to the organisation the requests we receive about these data.

We answer within one month, which may be extended by two months for a complex request; we then let you know.

Personal data breaches

In the event of a personal data breach, Fikra Systems notifies it to the ANPDP and informs the people concerned where the law requires, within the time limits it sets. For the data it processes on behalf of an organisation, it warns that organisation as provided in the data processing agreement.

When the breach concerns people in the European Economic Area, Fikra Systems also notifies it to the competent supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of people, and informs the people concerned without undue delay when the risk is high (GDPR, articles 33 and 34).

Changes to this policy

We may change this policy; the version in force is published on this page with its date. We inform the owners of organisations by e-mail of any significant change.