Privacy Policy — English Draft

Last updated: [complete before launch]

1. Introduction

We respect the privacy of website visitors and people who contact us. This notice explains, at a general level, the personal data that may be collected when the website is used or an inquiry is submitted, why it is processed, how it is protected, and the choices available to the data subject.

Data controller: [final legal name]

Privacy contact: [official privacy email]

Address: Riyadh, Saudi Arabia — [complete if required]

2. Data we may collect

Information voluntarily submitted through the contact form may include:

• name
• phone number
• optional email address
• preferred contact method
• selected service
• initial message
• consent time and policy version
• limited technical information needed for security and operation, such as request status and source page, without sending message content to analytics.

The first version of the website does not request document uploads. Please do not submit confidential or sensitive information or documents through the public form.

3. Purposes

Data may be used to:

• receive and respond to an inquiry
• understand the initial need and assess whether and how the service may be provided
• protect the form and website against automated or abusive use
• operate and improve the website using aggregated information that does not disclose message content
• comply with applicable requirements or protect rights where necessary.

Contact-form data will not be used for marketing unless a separate and clear consent mechanism is provided where required.

4. Basis and consent

Contact-form data is processed at the data subject’s request and with explicit consent for contact, together with any other lawful basis appropriate to the context. Where applicable, consent may be withdrawn without affecting processing that occurred before withdrawal or data that must be retained for an applicable obligation.

5. Sharing and service providers

Necessary technical providers may process data for hosting, database, security, and operational email purposes, subject to appropriate arrangements and need-to-know access. We do not sell personal data.

Before launch, the actual provider categories, processing locations, and any cross-border transfer requirements must be documented and reviewed.

6. Retention

Inquiries are retained only for the period needed for assessment, follow-up, and legitimate or legal requirements, after which they are deleted or de-identified under an approved retention schedule. Proposed v1 period: [to be confirmed after legal review].

7. Security

Appropriate organizational and technical measures are used to reduce unauthorized access, loss, or alteration. These may include restricted administration access, authentication, database-level access rules, input validation, and secure handling of technical secrets. No electronic channel can guarantee absolute protection, which is why sensitive information should not be sent through the public form.

8. Data-subject rights

Subject to applicable law, individuals may have rights relating to information, access, correction, destruction, or withdrawal of consent, subject to lawful grounds for retention. Requests may be sent to [privacy email]. Reasonable identity verification may be required before a request is completed.

9. Cookies and analytics

Technically necessary storage may be used for language preference or interface operation. Non-essential analytics or cookies will not be enabled until the provider, appropriate basis, and consent approach are selected. Names, phone numbers, email addresses, message text, inquiry IDs, and the legal-service choice must not be sent to analytics.

10. External links

The site may link to WhatsApp, social networks, or other third-party services. Those services are governed by their own policies and practices after a user leaves this website.

11. Children

The website is not directed at children and does not intentionally request their information through the general contact form. Data discovered to have been sent without an appropriate basis will be handled according to applicable requirements.

12. Changes and contact

This notice may be updated to reflect changes in the website, processing, or applicable requirements. The latest revision date will appear at the top. Questions or requests may be sent to [official privacy email].