Privacy Policy
Effective Date: October 2026. This Privacy Policy sets forth the mandatory principles, protocols, and technical safeguards governing the collection, processing, retention, and protection of personal data by ComplySaudi ("ComplySaudi.com", "we", "us", or "our"), in rigorous compliance with the Kingdom of Saudi Arabia Personal Data Protection Law (promulgated under Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H) and its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).
1. Statutory Regulatory Framework & Scope
ComplySaudi functions as an authoritative regulatory intelligence portal and strategic advisory service for corporate enterprises, HR executives, and foreign investors operating within the Kingdom of Saudi Arabia. We are fully committed to upholding the highest standards of data integrity, confidentiality, and statutory accountability.
All personal data handled through this platform is processed strictly in accordance with:
- The Saudi Personal Data Protection Law (PDPL) and its executive implementing resolutions.
- The SDAIA Regulatory Framework for National Data Management and Personal Data Protection.
- The Regulations on Personal Data Transfer Outside the Kingdom of Saudi Arabia.
- The Saudi Anti-Cyber Crime Law (Royal Decree No. M/17).
This Policy applies to all visitors, registered corporate clients, consultation applicants, and individuals accessing our knowledge base, guides, and computational utilities.
2. Statutory Definitions under Saudi Law
Personal Data
Any data, regardless of source or form, that may lead to the identification of an individual specifically, or that makes it possible to identify them directly or indirectly, including names, national identity numbers, addresses, contact numbers, and corporate credentials.
Data Processing
Any operation performed on personal data by any means, whether automated or manual, including collection, recording, classification, structuring, storage, modification, retrieval, consultation, disclosure, transmission, or destruction.
Data Controller
ComplySaudi, which specifies the purpose and manner of processing personal data in connection with its publication, computational services, and strategic advisory dossiers.
Data Subject
The individual natural person to whom the personal data relates, including corporate representatives, enterprise counsel, business owners, and portal visitors.
3. Categories of Data Collected & Processing Methods
We adhere strictly to the PDPL statutory principle of Data Minimization (collecting only the minimum information necessary to execute requested operations). We categorize collected data into three distinct tiers:
A. Voluntarily Provided Corporate & Consultation Data
When you book a strategic advisory consultation, request a procedural compliance audit, or submit an editorial inquiry, we collect your authorized representative name, corporate email address, contact phone number, company name, commercial registration (CR) number (if voluntarily submitted), and primary statutory concerns (such as MISA incorporation, ZATCA Phase 2, or Qiwa disputes).
B. Interactive Statutory Calculator Data (Client-Side Privacy Architecture)
Our computational engines (including the GOSI Contribution Estimator, ZATCA VAT Delay Fine Calculator, and MISA Setup Cost Engine) operate on a strictly client-side execution model. Numerical inputs such as employee basic wages, housing allowances, delayed VAT amounts, and capitalization figures are computed in memory within your browser session. We do not log, transmit, record, or aggregate individual employee compensation records or proprietary corporate balance sheets on remote servers.
C. Technical Telemetry & Infrastructure Logs
To maintain high availability, prevent distributed denial of service (DDoS) events, and ensure cybersecurity compliance under Saudi regulations, our hosting architecture automatically logs standardized network telemetry. This includes truncated internet protocol (IP) addresses, user-agent signatures, referrer URLs, and access timestamps. These technical records are decoupled from corporate identities and analyzed solely for security monitoring.
4. Statutory Legal Grounds for Processing
Under Article 5 and Article 6 of the Saudi PDPL, ComplySaudi only processes personal data where an authorized statutory legal basis exists:
- Consent: Where you have furnished clear, unambiguous consent by submitting an inquiry form, requesting a legal consultation, or subscribing to regulatory intelligence updates.
- Contractual Performance: Where processing is requisite to prepare preliminary advisory proposals, execute engagement agreements, or deliver requested legal workflows.
- Statutory & Regulatory Obligations: Where processing is mandated by Royal Decrees, ministerial orders, tax transparency directives, or judicial court subpoenas issued by competent Saudi authorities.
- Legitimate Interests: To protect digital platform security, safeguard intellectual property against unauthorized automated scraping, and preserve operational stability, provided such interests do not override your fundamental statutory rights.
5. Cookies, Analytics & Tracking Technologies
ComplySaudi employs strictly controlled technical cookies and privacy-first measurement tools:
- Essential Technical Cookies: Required to enable core navigation, session security, and state persistence across statutory guides.
- Performance & Analytics: We utilize Google Analytics 4 configured strictly with IP masking and anonymization protocols. Telemetry helps us evaluate which statutory chapters (e.g., ZATCA e-invoicing waves or Qiwa labor rules) require updated editorial annotations.
- Zero Commercial Ad Retargeting: We do not deploy third-party advertising tracking pixels, data-broker tracking scripts, or cross-site behavioral targeting cookies.
6. Technical Safeguards & Cross-Border Data Transfer
We enforce military-grade encryption standards across all digital communication layers:
- Encryption in Transit: All communications between your terminal and our infrastructure are encrypted utilizing modern Transport Layer Security (TLS 1.3).
- Encryption at Rest: Internal operational databases and backup repositories are secured using Advanced Encryption Standard (AES-256) algorithms.
- Access Control: Administrative access is restricted under zero-trust, multi-factor authentication (MFA) protocols to vetted personnel bound by strict professional confidentiality agreements.
SDAIA Cross-Border Transfer Compliance
In compliance with the SDAIA Regulations on Personal Data Transfer Outside the Kingdom, any technical telemetry processed via global cloud content delivery networks (CDNs) adheres to strict data protection standards that match or exceed Saudi statutory requirements, ensuring no compromise to data subject confidentiality.
7. Retention Periods & Secure Destruction
Personal data collected through advisory consultation inquiries is retained only for the duration required to satisfy the statutory, commercial, or operational purpose for which it was originally collected, or to comply with statutory record-keeping periods mandated under Saudi commercial law.
Upon the expiration of the lawful retention schedule, or upon receiving a valid request for erasure from a verified data subject, data records are permanently destroyed through cryptographically certified digital wiping or physical media shredding in alignment with SDAIA technical guidelines.
8. Your Statutory Rights under the Saudi PDPL
As a data subject under the legal framework of the Kingdom of Saudi Arabia, you possess non-waivable statutory rights regarding your personal records:
Right to Knowledge & Information
The right to be informed of the statutory basis, purpose, and processing methods governing your personal data.
Right of Access
The right to request access to and inspect your personal data held within our records, and to obtain an electronic copy in a readable format.
Right to Correction & Rectification
The right to request the prompt correction, updating, or completion of any inaccurate, incomplete, or outdated personal information.
Right to Destruction & Erasure
The right to request the permanent deletion of your personal data when the processing purpose is exhausted or when consent is legitimately withdrawn.
Right to Withdraw Consent
The right to withdraw previously granted processing consent at any juncture, without prejudice to lawful processing conducted prior to withdrawal.
To submit a statutory request to exercise any of the rights enumerated above, please transmit a formal request to our Data Governance Officer at contact@complysaudi.com. We will review and respond to all verified statutory petitions within thirty (30) days as stipulated by SDAIA guidelines.
9. Third-Party Disclosures & Commercial Non-Sale Guarantee
ComplySaudi does not sell, rent, monetize, trade, or commercially distribute client or visitor data to marketing agencies, data brokers, or advertising networks under any circumstances.
Personal data is disclosed strictly under the following narrow statutory circumstances:
- With Prior Explicit Consent: When you specifically request referral or introduction to our associated licensed Saudi law firms or chartered tax accountants.
- Mandatory Judicial Process: In compliance with an enforceable court judgment, formal decree, or statutory subpoena issued by a competent Saudi judicial or administrative authority.
- Public Interest & Security: To prevent cybercrimes, fraud, or acute security threats in accordance with the Saudi Anti-Cyber Crime Law.
10. Incident Management & Breach Notification Protocol
In the highly improbable event of a security incident compromising personal records under our care, ComplySaudi maintains an incident response protocol aligned with SDAIA executive regulations. If an incident presents potential harm or infringement upon the rights of data subjects:
- The competent regulatory authority (SDAIA) will be notified within seventy-two (72) hours of confirmed incident detection.
- Affected data subjects will be promptly alerted with clear technical descriptions of the incident, prospective impacts, and concrete remedial measures undertaken.
11. Amendments & Regulatory Harmonization
As ministerial regulations, royal decrees, and SDAIA implementing circulars evolve, ComplySaudi reserves the right to amend this Privacy Policy. Any material revision will be published on this page with an updated "Effective Date". Continued interaction with this platform subsequent to published amendments constitutes your acknowledgment and adherence to the updated policy terms.
12. Data Protection Officer & Inquiries
For questions regarding this Privacy Policy, statutory compliance inquiries, or to submit formal PDPL requests, please communicate with our Data Governance Desk:
Entity: ComplySaudi Regulatory Intelligence Portal
Attn: Data Governance Officer & Legal Desk
Email: contact@complysaudi.com
Jurisdiction: Jeddah, Kingdom of Saudi Arabia