Privacy Policy
How PrivSecAI collects, uses, stores, discloses, protects and destroys personal data in connection with privsecai.com.sa, in alignment with the Saudi PDPL and its Implementing Regulations.
PrivSecAI LLC ("PrivSecAI", "we", "us" or "our") respects your privacy. Our website is designed to provide information about our data privacy, cybersecurity, AI governance and professional training services. We do not require users to create an account, and we do not collect payment information or sensitive personal data through the website. We process only limited information that you choose to submit through the Contact Us form, and limited technical or cookie information needed to operate, secure and measure the performance of the website.
On this page
- Purpose and Scope
- Personal Data We Process
- Purposes, Lawful Bases and Retention
- Cookies Collection
- How We Collect Personal Data
- Mandatory and Optional Information
- Sharing and Disclosure
- Storage and International Transfers
- Information Security and Data Breaches
- Your Rights Under the Saudi PDPL
- Complaints and Regulatory Contact
- Direct Marketing
- Children's Privacy
- Third-Party Websites and Embedded Services
- Changes to This Policy
- Contact PrivSecAI
1Purpose and Scope
This Privacy Policy explains how PrivSecAI collects, uses, stores, discloses, protects and destroys personal data when you visit or interact with privsecai.com.sa (the "Website"). It also explains your rights and how to contact us or raise a privacy complaint.
For personal data processed through the Website, PrivSecAI LLC acts as the data controller because it determines the purposes and means of processing. This Policy applies only to the Website and related enquiries. Client engagements, training registrations, recruitment activities, contractual services and processing carried out on behalf of clients may be governed by separate contracts, notices or data-processing terms.
This Policy is intended to align with the Saudi Personal Data Protection Law, its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom, and other applicable laws and regulatory requirements in the Kingdom of Saudi Arabia. Our cybersecurity practices are also informed by relevant National Cybersecurity Authority requirements and the Essential Cybersecurity Controls (ECC 2-2024), where applicable to our activities.
2Personal Data We Process
We follow data-minimisation principles and seek to process only the information reasonably necessary for the purposes described in this Policy.
2.1 Information you provide voluntarily
When you use the Contact Us form, email us, call us or otherwise communicate with us, we may process the information you choose to provide. Depending on your enquiry, this may include:
- Your name and business or organisation name
- Your email address and telephone number
- Your job title or professional role, if you choose to provide it
- The subject and content of your enquiry, message or requested service
- Any documents or additional information that you voluntarily send to us
2.2 Technical, security and usage information
Like most websites, our hosting, content-delivery, security and analytics technologies may automatically process limited technical information when you visit the Website. This may include IP address, date and time of access, browser and device type, operating system, referring page, pages viewed, session duration, language setting, cookie or similar identifiers, and diagnostic or security-event information.
We use this information to deliver the Website, maintain availability, detect misuse, investigate security events, troubleshoot technical problems and understand aggregate Website performance. We do not use Website technical data to create advertising profiles or to make decisions that produce legal or similarly significant effects about you.
2.3 Information we do not intentionally collect through the Website
- Account passwords or user-profile information, because the Website does not require account registration
- Payment-card, banking or online-payment information
- Precise geolocation data
- Personal data obtained from data brokers
- Sensitive personal data, unless you voluntarily include it in an enquiry
- Personal data for behavioural advertising or sale to third parties
3Purposes, Lawful Bases and Retention
We process personal data only for clear and lawful purposes. Depending on the activity, we rely on your consent, the need to take steps at your request or perform an agreement, compliance with a legal obligation, and/or our legitimate interests where permitted by the PDPL and after considering your rights and interests.
Contact and enquiry data
- Purpose
- Respond to enquiries; provide requested information; schedule a discussion; maintain appropriate business correspondence
- Lawful basis
- Consent and/or steps taken at your request; legitimate interests where permitted
- Typical maximum retention
- Up to 12 months after the last substantive contact, unless a longer period is required for an active engagement, dispute or legal obligation
Technical and security logs
- Purpose
- Operate and secure the Website; prevent abuse; investigate incidents; maintain availability and auditability
- Lawful basis
- Legitimate interests in secure operations and compliance with applicable legal or cybersecurity requirements
- Typical maximum retention
- Normally up to 12 months; relevant records may be kept longer if needed to investigate or evidence a security incident
Performance and analytics data
- Purpose
- Measure traffic, usability, page performance and aggregate trends; improve Website content and functionality
- Lawful basis
- Your consent for non-essential cookies or similar technologies
- Typical maximum retention
- As shown in Cookie Settings; configured not to exceed 14 months, unless data is aggregated or anonymised
Cookie-consent records
- Purpose
- Remember and evidence your cookie choices and avoid repeatedly requesting the same preference
- Lawful basis
- Compliance, accountability and legitimate interests in recording your choice
- Typical maximum retention
- Up to 12 months, after which the Website may ask you to confirm your preferences again
4Cookies Collection
Cookies are small text files or similar technologies placed on or read from your device when you visit a website. Some cookies are necessary for the Website to operate securely. Other cookies, such as performance or analytics cookies, are optional and are activated only after you provide consent through the cookie banner or Cookie Settings.
Strictly necessary cookies
- What it does
- Support core Website functions, security, network management and storage of your consent choice
- Our approach
- Required for the Website to function and cannot generally be disabled through the Website. You can still configure your browser to block them, but parts of the Website may not work correctly
Performance and analytics cookies
- What it does
- Help us understand aggregate visitor numbers, pages viewed, navigation patterns, loading performance and technical errors
- Our approach
- Used only after consent. You may reject or withdraw consent without losing access to the core Website
Preference or functional cookies
- What it does
- Remember choices such as language or display preferences, where enabled
- Our approach
- Used after consent unless a particular preference is strictly necessary to deliver a feature you requested
Advertising cookies
- What it does
- Track visitors for targeted advertising or cross-site profiling
- Our approach
- We do not currently use advertising or behavioural-tracking cookies. If this changes, we will update this Policy and obtain appropriate consent before activation
You can accept, reject or manage optional cookies through the cookie banner or Cookie Settings link on the Website. You can also delete or block cookies through your browser settings. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal. The specific cookie names, providers, purposes and expiry periods should be displayed in the live Cookie Settings panel, which forms part of this Policy.
5How We Collect Personal Data
- Directly from you when you submit a form, send an email, call us or communicate with us
- Automatically from your browser or device through Website infrastructure, security logs, cookies and similar technologies
- From service providers that support the Website, but only to the extent needed to operate, secure or measure the Website
We do not purchase personal data about Website visitors from third-party data brokers.
6Mandatory and Optional Information
Fields marked as required in the Contact Us form are necessary for us to receive and respond to your enquiry. If you do not provide required contact information, we may be unable to reply. Any additional details are optional and should be limited to what is relevant to your request.
Strictly necessary cookies are required for core Website operation and security. Performance, analytics and preference cookies are optional. Rejecting optional cookies will not prevent you from viewing the main Website or contacting us.
7Sharing and Disclosure
We do not sell or rent personal data. We may disclose limited personal data only when necessary to the following recipients:
- Authorised PrivSecAI personnel who need the information to respond to your enquiry or maintain the Website
- Website hosting, email, cloud, analytics, security, backup and technical-support providers acting on our instructions
- Professional advisers, auditors or insurers where reasonably necessary and subject to confidentiality obligations
- Competent authorities, regulators, courts or law-enforcement bodies when disclosure is required or permitted by Saudi law
- A successor entity in connection with a lawful merger, restructuring or transfer of business, subject to appropriate confidentiality and data-protection safeguards
When we appoint a service provider to process personal data on our behalf, we seek to use providers that offer appropriate security and privacy safeguards. Contracts or equivalent arrangements are used where required to define confidentiality, permitted processing, incident notification, secure return or deletion of data, and compliance with applicable Saudi requirements.
8Storage and International Transfers
Website and communication data may be stored in systems located in the Kingdom of Saudi Arabia or, depending on the service provider used, in another jurisdiction. We do not transfer personal data outside the Kingdom merely for convenience. Where an international transfer is necessary, we will apply the requirements of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, including transfer assessments, appropriate safeguards, contractual protections and any approvals or exemptions required by the competent authority.
We take reasonable steps to ensure that a transfer does not reduce the level of protection afforded to your personal data under Saudi law.
9Information Security and Personal Data Breaches
PrivSecAI applies risk-based administrative, organisational and technical measures intended to protect the confidentiality, integrity and availability of personal data. These measures are informed by applicable Saudi legal and regulatory requirements and relevant NCA ECC principles, including data protection, secure web applications, access control, cryptography, vulnerability management, logging and monitoring, incident management, business continuity, and third-party security.
Measures may include, as appropriate to the risk and technology used:
- Secure communications protocols such as HTTPS/TLS
- Role-based access restrictions and authentication controls
- Security logging, monitoring and incident-escalation procedures
- Malware, vulnerability and patch-management controls
- Backup, recovery and business-continuity arrangements
- Confidentiality obligations and staff awareness
- Security and privacy requirements for relevant third-party providers
No internet service is completely secure. If a personal data breach occurs, we will investigate, contain and remediate it. Where the PDPL requires notification, we will notify the competent authority within the applicable statutory timeframe, including within 72 hours of becoming aware where that timeframe applies, and will notify affected individuals without undue delay when the breach may cause harm to their data or conflict with their rights or interests.
10Your Rights Under the Saudi PDPL
Subject to the PDPL, its Implementing Regulations and any applicable exceptions, you may have the following rights:
Right to be informed
Receive clear information about the legal basis, purposes and manner in which your personal data is processed.
Right of access
Ask whether we process your personal data and access the personal data we hold about you.
Right to obtain a copy
Request your personal data in a readable and clear format, where applicable.
Right to correction
Request correction, completion or updating of inaccurate, incomplete or outdated personal data.
Right to destruction
Request deletion or destruction of personal data when the legal conditions are met.
Right to withdraw consent
Withdraw consent for consent-based processing, including optional cookies, without affecting earlier lawful processing.
Right to complain
Raise a concern with us and, if unresolved, lodge a complaint with the competent Saudi data-protection authority.
To exercise a right, email contact@privsecai.com.sa with the subject line "Privacy Request" and describe your request. We may ask for information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure. We will respond within the period required by the PDPL and may extend that period where permitted and reasonably necessary. We will explain any lawful limitation or refusal.
11Complaints and Regulatory Contact
We encourage you to contact us first so that we can review and address your concern. You may send a complaint to contact@privsecai.com.sa or use the contact details in Section 16.
You may also submit a complaint to the Saudi Data & AI Authority (SDAIA), as the competent authority, through its official channels or the National Data Governance Platform. Official information is available at sdaia.gov.sa and dgp.sdaia.gov.sa.
12Direct Marketing
Submitting a contact enquiry does not automatically subscribe you to marketing. We will not use your contact details to send promotional communications unless you have requested them or provided any consent required by applicable law. Every electronic marketing message, if used, will provide a reasonable method to opt out. We do not share contact-form details with third parties for their independent marketing.
13Children's Privacy
The Website and PrivSecAI's professional services are directed to organisations and business users and are not designed for children. We do not knowingly seek to collect children's personal data through the Website. If you believe a child has submitted personal data to us without appropriate authorisation, please contact us so that we can review and securely delete the information where required.
14Third-Party Websites and Embedded Services
The Website may contain links to third-party websites, social-media pages or external services. Those third parties operate under their own terms and privacy notices. PrivSecAI is not responsible for their privacy practices. We recommend reviewing the applicable privacy notice before providing personal data to any third party.
15Changes to This Policy
We may update this Policy to reflect changes in the Website, our processing activities, service providers, security practices or Saudi legal and regulatory requirements. The latest version will be published on the Website with a revised effective date. Where a change materially affects how we process personal data, we will provide an appropriate notice and obtain consent when required.
16Contact PrivSecAI
For privacy questions, requests or complaints, reach out through any of the channels below.
＋Regulatory Alignment Note
This Website Privacy Policy has been structured to address the transparency, purpose limitation, data minimisation, storage limitation, security, accountability and data-subject-rights expectations of the Saudi PDPL and its Implementing Regulations. The security commitments are also drafted with reference to relevant NCA ECC 2-2024 themes. Compliance depends on PrivSecAI's actual Website configuration and operating practices remaining consistent with this Policy, including the contact-form fields, cookie banner, analytics retention settings, hosting arrangements, vendor contracts, access controls and incident-response procedures.
