Privacy Policy

Introduction and controller identity

ETEJAH for Business Analysis and Development is committed to protecting the privacy of its website visitors and clients, and processes personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulation.

ETEJAH is the data controller for personal data collected through this website and through engagements, and is based in Riyadh. Our contact details are shown at the end of this page.

Data we collect

Data you provide

• Full name and company name.
• Mobile number and email address.
• The service requested, estimated budget and description of your request.
• Any documents, operational or financial data you provide for the purpose of delivering the service.

Data collected automatically

• IP address, browser type, operating system and device type.
• Pages visited, session duration and referral source.
• Language preference and your cookie choice.

Legal basis for processing

• Consent: when you submit the contact form or accept optional cookies.
• Performance of a contract: to process the data necessary to deliver the contracted service.
• Legitimate interest: to secure the website, prevent misuse and improve service quality, without prejudicing your rights.
• Legal obligation: where a statutory requirement exists, such as retaining invoices for tax purposes or responding to a request from a competent authority.

Purposes of processing

• Responding to your request and scheduling the discovery session.
• Preparing technical and financial proposals and delivering the agreed scope of work.
• Issuing invoices and meeting tax and accounting requirements.
• Improving the website experience and measuring page performance.
• Protecting the website from unlawful use and automated messages.

We do not use your data for automated decision-making or for profiling that has a legal effect on you.

Data sharing and disclosure

We do not sell, rent or trade your personal data. We may share it, to the minimum extent necessary, with:

• Technical service providers operating our infrastructure (hosting and email), under contractual confidentiality obligations.
• Our professional advisors (accountants or legal advisors) where needed.
• Competent governmental or judicial authorities where a lawful request exists.

In all cases disclosure is limited to the minimum data required to achieve the purpose.

Transfers outside the Kingdom

Some technical data may be processed by service providers whose servers are located outside the Kingdom (such as embedded font or map services). Where this occurs, we comply with the cross-border transfer controls set out in the Personal Data Protection Law and its Regulation, and verify that an appropriate level of protection exists.

Retention period

• Contact enquiry data: up to 24 months from last contact, then deleted or anonymised.
• Contracted client data and deliverables: for the duration of the engagement and for no less than the statutory retention period for accounting and tax records.
• Technical website logs: a short period for security and troubleshooting purposes.

We delete or anonymise data once the purpose of collection no longer exists, unless a statutory obligation requires retention.

Your rights under the Personal Data Protection Law

The Law grants you the following rights, which you may exercise by contacting us:

• Right to be informed: to know the legal basis and purpose for collecting your data.
• Right of access: to request access to your data held by us and obtain a copy of it.
• Right to correction: to request correction or updating of inaccurate or incomplete data.
• Right to destruction: to request deletion of your data once it is no longer needed, unless a statutory obligation requires retention.
• Right to withdraw consent: to withdraw your consent at any time without retroactive effect on prior processing.

We respond to requests within the statutory period. If you are not satisfied with our response, you have the right to lodge a complaint with the authority competent to supervise the application of the Personal Data Protection Law in the Kingdom.

Data security

• Encrypted connection to the website over HTTPS.
• Access to client data restricted to those who need it to perform their work.
• Signed non-disclosure agreements with everyone who handles client data.
• Regular backups and secure document storage controls.

Nevertheless, no method of electronic transmission or storage is absolutely secure, and we exercise the care of a prudent person in this regard.

Children's privacy

Our services are directed at organisations and adults, and we do not knowingly collect data from anyone under eighteen. If we become aware otherwise, we will delete the data immediately.

Cookies

The website uses essential and optional cookies, detailed in our cookie policy.

Updates to this policy

We may update this policy to keep pace with regulatory or operational changes. Updates are published on this page with a revised update date, and we recommend reviewing it periodically.

Privacy contact

To exercise your rights or for any enquiry about this policy, write to contact@etejah.it.com or call +966 53 637 6303.