PROMISE, Privacy Policy
1. About this policy
This Privacy Policy explains how PROMISE (“PROMISE”, “we”, “us”) collects and processes your personal data through our website promise-sa.com, and the rights you have under the Personal Data Protection Law of the Kingdom of Saudi Arabia (the “PDPL”) and its Implementing Regulations. We make this policy available to you before we collect your personal data.
2. Who we are (data controller)
PROMISE is the data controller for the personal data described here.
- Legal entity: PROMISE. Full legal entity details are available on request.
- Address: King Fahad Road, Al Rahmaniyah District, Riyadh, Kingdom of Saudi Arabia
- General contact: info@promise-sa.com · +966 53 353 3267
- Privacy requests: info@promise-sa.com
3. The personal data we collect
- When you contact us through the website enquiry form, or by email, phone, or WhatsApp: your full name; work email; phone or WhatsApp number (optional); company name (optional); country (optional); the topic you select; and the content of your message.
- Automatically when you visit the website: technical and usage data such as your IP address, approximate location, device and browser type, pages viewed, date/time, and the referring website, collected through standard server logs (see Section 7).
- We do not operate an online account, e-commerce checkout, newsletter sign-up, or online job-application form on this website, and we do not knowingly collect sensitive personal data through it. Please do not include sensitive data (for example, data revealing health, religious, or political information) in your message.
4. How and from where we collect it
Directly from you (the enquiry form, email, phone, WhatsApp) and automatically (server logs). We do not buy personal data or obtain it from third-party marketing lists.
5. Why we process your personal data
To respond to your enquiry and arrange a consultation; to provide and communicate about the services you request; to operate and secure the website; and to comply with applicable law.
6. Legal basis for processing (PDPL Articles 5 and 6)
We use one basis per purpose:
- Responding to your enquiry and arranging a consultation: your consent (Art 5). We recommend consent because you voluntarily submit the form to be contacted; you may withdraw it at any time.
- Keeping the website secure and operational: our legitimate interest (Art 6(4)), which does not apply to sensitive data and is balanced against your rights (we keep an internal record of this assessment).
- Meeting legal obligations: as permitted by Article 6, where the law requires it.
Note: we do not rely on any “pre-contractual steps” basis; that concept is not part of the PDPL.
7. Cookies and analytics
The website uses strictly necessary and functional technologies only (for example, caching and security). We do not currently run website analytics. If we introduce analytics in future, we will ask for your consent first through our cookie notice, and non-essential cookies will not load until you agree.
8. Service providers we share data with
We do not sell your personal data. We share it only with providers who process it on our behalf under our instructions, and with authorities where required by law. Current providers: website hosting, Cloudways (hosted on DigitalOcean, Frankfurt, Germany); content delivery / edge cache, Cloudways’ own edge cache; website analytics, we do not currently use a website-analytics provider; and email, Microsoft 365 (Microsoft). We do not use a CRM or marketing-automation platform.
9. Transfer or storage of personal data outside the Kingdom
Some of our providers process personal data outside the Kingdom: our hosting infrastructure is located in Germany, and our email is provided through Microsoft 365. Where we transfer personal data outside the Kingdom, we do so in accordance with the PDPL (Article 29) and the Regulation on Personal Data Transfer Outside the Kingdom.
10. How long we keep your data (retention)
Where Saudi law requires a minimum retention period, we keep the data for that period. Otherwise, our retention periods are:
- Enquiries that do not become clients: 12 months, then deleted.
- Enquiries that become clients: for the duration of our engagement and any longer period required by applicable Saudi law.
- Contact-form submissions are not stored in the website database; they are sent to us by email only.
- Email correspondence: up to 24 months for non-clients.
- Server and security logs: 6 to 12 months.
- Consent records: the processing period plus approximately 3 years.
When a period ends, we delete or anonymise the data.
11. Storage, security, and destruction
We store personal data with reputable service providers and apply appropriate technical and organisational measures, including an encrypted website connection (HTTPS/TLS), access controls, and limiting who can see the data. When personal data is no longer needed and no legal retention applies, we securely delete or anonymise it. No method of transmission or storage is completely secure, so while we protect your data, we cannot guarantee absolute security.
12. Your rights under the PDPL
Subject to the PDPL’s conditions and exceptions, you have the right to: be informed of the legal basis and purpose of collection (Art 4(1)); access your personal data (Art 4(2)); obtain your personal data in a readable, clear format (Art 4(3)); request the correction, completion, or updating of your data (Art 4(4)); and request the destruction of your data when it is no longer needed (Art 4(5)). You may also withdraw your consent at any time (Art 5(2)).
13. How to exercise your rights, and withdrawing consent
Contact info@promise-sa.com. We verify your identity before acting on a request and respond within the timeframe set by the PDPL and its Implementing Regulations. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, or processing on another lawful basis.
14. Complaints
Please contact us first so we can help. You may also complain to the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA).
15. Children
The website is intended for businesses and professionals and is not directed at children; we do not knowingly collect children’s personal data through it.
16. External links
Our website may link to third-party sites, including government platforms. We are not responsible for their privacy practices; please read their policies.
17. Changes to this policy
We may update this policy and will post the new version here with a revised “last updated” date; we will take reasonable steps to notify you of material changes.
18. Contact
PROMISE, King Fahad Road, Al Rahmaniyah District, Riyadh, Kingdom of Saudi Arabia. info@promise-sa.com · +966 53 353 3267.
An Arabic version will be added when the Arabic site launches.