Privacy policy

Who is responsible for your data

Operator details are published here before this site launches. The controller's name, address and data protection contact will be added to this section at the same time, and no quote request form will be switched on before they are.

What this covers

This site is a reference aimed at people setting up or running a company in Saudi Arabia. The policy follows the Personal Data Protection Law and its Implementing Regulation, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). If you are elsewhere, the law of your own country may give you further rights.

What we collect

• When you read the site: nothing that we store. Our host, Cloudflare, processes the technical details every web request carries, such as your IP address, browser type and the page requested, to deliver the page and protect the site from attacks.
• Quote requests (not open yet): your city, entity type, foreign ownership share, number of foreign employees, name, email address and, if you give one, a mobile number, plus the two consents you tick.
• Website plan enquiries (not open yet): the name of the person asking, the firm's name, email address, optional mobile number, the cities the firm serves, and the consent ticked.
• Messages you send us: whatever you include, usually a name, an email address and a correction.

We do not ask for sensitive data, and we ask you not to include any in a request or message.

Why we use it, and on what basis

• Passing a quote request to setup consultancies and letting them contact you: your consent, given with two separate tick boxes. You can withdraw either consent at any time; withdrawal stops further use but does not undo what was already done with your consent.
• Answering a website plan enquiry and arranging a call: your consent, given on the form, and the steps a business asks us to take before a possible agreement.
• Keeping the site running and secure: our legitimate interest in protecting the site and its readers, which the Implementing Regulation recognises for network and information security.
• Answering a correction or data request: your request itself, and our legitimate interest in keeping the figures on the site accurate.

Who receives it

• Setup consultancies: the firms your quote request is sent to, and only those. These are businesses offering company formation services in Saudi Arabia. They may pay us a fee for the introduction. They receive your request to quote on it and must use it for that purpose.
• Our hosting provider: Cloudflare, Inc., a US company, which serves every page and processes request data on its global network.
• Our form processor: the service that receives form submissions and delivers them to us. It is named here before the form opens.
• Authorities: only where Saudi law requires it.

Apart from the paid introductions described above, your details go to nobody else, and nobody receives them for their own marketing.

Transfers outside Saudi Arabia

Cloudflare and form processing services run infrastructure outside the Kingdom, so data about your visit and any request you send may be processed abroad, including in the United States. The PDPL allows a transfer outside the Kingdom for purposes that include providing a service to you, and the Regulation on Personal Data Transfer outside the Kingdom requires appropriate safeguards where a controller relies on its exemptions: contractual clauses, common rules or accreditation. We transfer only what the service needs, and standard contractual clauses will be in place with those providers before the form opens.

How long we keep it

• Quote requests: 12 months from receipt, then deleted, unless a dispute about that request is still open.
• Website plan enquiries: 12 months from receipt, then deleted. If the firm takes the plan, its contact details are kept for as long as the agreement runs.
• Correction and data requests: 12 months after we close them.
• Hosting request logs: kept by Cloudflare under its own retention schedule, not by us.

Your rights

Article 4 of the Personal Data Protection Law gives data subjects the rights to be informed, to access their data, to obtain it in a readable format, to have it corrected, and to have it destroyed. You can also withdraw your consent at any time. We answer a request within 30 days, which the Implementing Regulation allows to be extended once where a request needs disproportionate effort; if that happens we tell you why beforehand.

To use a right, follow the contact page and say that your message is a data request. We may ask you to confirm your identity first.

Complaints

If you are unhappy with how we handled your data or your request, tell us first so we can put it right. You can also complain to the competent authority, SDAIA, within 90 days of the event or of becoming aware of it.

Cookies, analytics and advertising

Today the site sets no cookies of its own, runs no analytics and shows no advertising. The calculator works in your browser and sends nothing. If advertising or analytics are added later, this section will be updated first, and any cookie that needs your consent will not be set until you give it.

Security

Pages are served over HTTPS and form submissions travel over an encrypted connection. The site itself is static and has no database of visitors.

Changes to this policy

When the policy changes, the date at the top changes with it. A change to who receives request data will always be made here before it takes effect.