PRIVACY NOTICE

How DPO Arabia handles Personal Data.

This Privacy Notice explains how DPO Arabia collects and uses Personal Data when you visit our website, contact us, request pricing, submit an RFQ or engage with our business.

Last updated: 10 October 2026

Purpose-led collection

We collect Personal Data needed to respond to enquiries, prepare proposals, deliver services and operate this website.

Transparent processing

We explain why Personal Data is processed, the applicable legal basis and where it may be disclosed or accessed.

Rights supported

You may contact us about Personal Data and exercise applicable rights under the Saudi Personal Data Protection Law (PDPL).

ON THIS PAGE

01 / CONTROLLER

Who we are

DPO Arabia is operated by HalaPrivacy (شركة هالابرايفاسي), a company registered in the Kingdom of Saudi Arabia. DPO Arabia provides Personal Data Protection Officer (DPO) and KSA Personal Data Protection Law (PDPL) professional services to organisations operating in or subject to the KSA PDPL.

For the DPO Arabia website and our own business activities described in this Privacy Notice, HalaPrivacy Company, operating as DPO Arabia, acts as the Data Controller and determines the purposes and means of processing the relevant Personal Data.

Controller

HalaPrivacy Company (شركة هالابرايفاسي), operating as DPO Arabia

SDAIA National Data Governance Platform (NDGP)

Registration No. 3260005325

Business location

Riyadh, Kingdom of Saudi Arabia

Website

www.dpoarabia.com

Privacy contact

Data Subject Rights Request Form

Who this Privacy Notice covers.

In this Privacy Notice, “you” and “your” refer to the Data Subject whose Personal Data is described in this Notice, including website visitors, individuals making enquiries or submitting RFQs, prospective and existing client contacts, and other individuals who interact with DPO Arabia.

02 / PERSONAL DATA

Personal Data we collect

The Personal Data we collect depends on how you interact with us.

Identity & business contact data

Name, work email address, phone number, organisation and job or role information.

Enquiry & commercial data

Service interests, enquiry details, requested timeline, pricing quiz selections, RFQ information and proposal-related information.

Submitted content

Documents, files and other information you choose to provide through forms, RFQ uploads or communications.

Communication data

Emails, correspondence and records relating to enquiries, scope discussions or service delivery.

Website & technical data

IP address, browser and device information, referral information, website interactions, online identifiers, cookie information and consent preferences generated through website technologies.

Where Analytics cookies are enabled, Google Analytics 4 may process website usage and interaction information.

Where Marketing cookies are enabled, embedded LinkedIn content may involve the collection and processing of technical information, browser and device identifiers, cookies and interaction data by LinkedIn and its associated technical service providers.

Such information may be collected directly by these third parties and is not necessarily received or retained by DPO Arabia.

Sensitive Data

We do not intentionally collect or process Sensitive Data through our website, enquiries, RFQs, or commercial interactions.

When you share information with us.

If you submit an enquiry, RFQ, document or other content, providing only the Personal Data relevant to the interaction helps us avoid unnecessary collection and processing.

03 / PURPOSES & LEGAL BASES

Why we process Personal Data

We process Personal Data only for identified purposes and rely on the legal basis that applies to the relevant activity under the KSA PDPL.

Responding to enquiries and scope requests

Contact and enquiry information is used to understand and respond to your request. Depending on the circumstances, the applicable basis may include Legitimate Interest where its conditions are met, or another basis permitted under the KSA PDPL.

Preparing pricing, proposals and engagement scope

Contact, organisation, RFQ and requirement information is used to prepare and manage commercial discussions. The applicable basis depends on the circumstances and may include Legitimate Interest or processing connected to an existing agreement.

Delivering contracted services

Business contact and engagement information may be processed where necessary to implement an agreement and to operate the agreed services.

Maintaining business and compliance records

Relevant correspondence and engagement records may be retained where required by law, an agreement, or a Legitimate Interest that satisfies the applicable KSA PDPL conditions.

Operating and securing the website

Limited technical information may be processed to operate, maintain and protect the website, including on the basis of Legitimate Interest where applicable.

Website analytics

Where you allow analytics through Cookie Settings, usage and technical information is processed through Analytics to understand website use and improve content and performance. Consent is relied upon for this analytics processing where applicable.

Displaying third-party embedded content

Where you enable Marketing cookies through CookieHub, we display embedded LinkedIn posts to provide access to content relating to KSA PDPL compliance, regulatory developments and privacy governance.

Displaying this optional content involves connecting your browser to LinkedIn and associated technical services, which may process technical information, online identifiers and interaction data.

We rely on your consent to enable this optional embedded content. You may withdraw that consent at any time through CookieHub’s cookie preference controls without affecting your ability to access our core website services or submit an enquiry or RFQ.

We do not rely on a single legal basis for every activity. The relevant basis is assessed against the purpose, Personal Data involved and circumstances of the processing.

How we apply legal bases.

We assess the purpose and circumstances of each processing activity and apply the legal basis that fits that activity under the KSA PDPL.

How we apply Legitimate Interest.

Where a processing relies on Legitimate Interest, we will assess whether the interest is lawful, the processing is necessary and the rights and interests of Data Subjects are appropriately balanced before relying on that basis.

How we apply consent.

Where a processing requires consent, we will request it in an appropriate manner. Consent can be withdrawn at any time, subject to any other legal basis that may require or permit continued processing.

04 / COLLECTION METHODS

How we collect Personal Data

We collect Personal Data directly from you and, where relevant, indirectly through the sources.

Directly from you

Through website forms, the pricing quiz, RFQ uploads, email, meetings, calls and other communications with DPO Arabia.

From your organisation or authorised representative

Where they provide your business contact information or relevant engagement information for an enquiry, proposal or service.

Automatically through the website

Limited technical and website interaction information may be generated automatically through essential website technologies and, where you enable Analytics cookies, Google Analytics 4.

Where you enable Marketing cookies, embedded LinkedIn content is loaded on our Thank You page. This may result in technical information, online identifiers, cookie information and interaction data being collected directly by LinkedIn and its associated technical service providers.

We use CookieHub to record and apply your preferences for optional website technologies. Analytics and Marketing technologies are controlled independently according to your consent choices.

How Personal Data reaches us.

Most Personal Data is provided directly by you. Where we receive it indirectly, we use it only where the source and purpose are relevant to the business interaction or website function.

05 / PROCESSING

How we use and process Personal Data

Depending on the relevant purpose, processing may include collecting, recording, organising, reviewing, communicating, using, storing, retrieving, restricting, disclosing where permitted, and securely destroying Personal Data.

We limit the Personal Data we process to the minimum necessary and directly relevant to the stated purpose. We take sufficient steps to verify that Personal Data is accurate, complete, up to date and relevant to the purpose for which it was collected.

How we keep processing proportionate.

We limit Personal Data to what is necessary and directly relevant to the stated purpose and take sufficient steps to keep it accurate, complete, up to date and relevant.

07 / INTERNATIONAL PROCESSING

International processing and transfers

DPO Arabia primarily operates in the Kingdom of Saudi Arabia. Personal Data may, where necessary, be transferred to, stored in, processed in or remotely accessed from outside the Kingdom by service providers or affiliates for operational or technical purposes.

Any such transfer or disclosure is carried out in accordance with the KSA PDPL and the Regulation on Personal Data Transfer Outside the Kingdom. Where required, we conduct and document a transfer impact and risk assessment and apply appropriate safeguards, such as Standard Contractual Clauses (SCCs) or another permitted transfer mechanism by SDAIA.

International processing associated with embedded content

Where you enable Marketing cookies, your browser may establish direct connections with LinkedIn and its associated technical service providers to retrieve and display embedded content.

These connections may involve the disclosure, transmission, or processing of technical information, online identifiers, cookie information, and interaction data outside the Kingdom of Saudi Arabia, depending on the locations and infrastructure used by the relevant providers.

Where such activities constitute international transfers or disclosures subject to the KSA PDPL and the Regulation on Personal Data Transfer Outside the Kingdom, the applicable conditions and safeguards must be satisfied.

Consent to load optional LinkedIn content through CookieHub does not, by itself, replace any separate legal requirements applicable to international transfers or disclosures of Personal Data.

Further information about LinkedIn’s processing activities is available through its applicable privacy and cookie documentation.

08 / RETENTION & DESTRUCTION

How long we retain Personal Data

We retain Personal Data only for as long as necessary to fulfil the purpose for which it was collected. Retention is determined based on the nature and purpose of the processing, the status of the relevant enquiry or engagement, and any applicable legal, contractual, accounting, professional, dispute or compliance requirements.

Enquiries that do not proceed

Retained for a limited period after the last meaningful interaction where needed to manage the enquiry and related business records.

RFQs and proposals

Retained according to the commercial and recordkeeping need associated with the relevant proposal or procurement process.

Client engagement records

Retained for the duration of the engagement and afterwards where an applicable contractual, legal, accounting, dispute or professional recordkeeping requirement applies.

Website and security records

Retained only for the period needed for website operation, troubleshooting, security and related evidence.

Consent or preference evidence

Where consent is used, relevant evidence may be retained for as long as needed to demonstrate the choice and manage any withdrawal or associated compliance requirement.

At the end of the applicable retention period, Personal Data is securely destroyed unless continued retention is required or permitted under an applicable legal basis. Backup or archive copies remain Personal Data until they are securely overwritten or destroyed according to the applicable process.

How we determine retention.

Retention periods are tied to the purpose of processing, the status of the relationship and applicable legal, contractual, accounting, professional, dispute or compliance requirements.

09 / SECURITY

How we protect Personal Data

We apply technical, organisational and administrative measures intended to protect Personal Data against unauthorised access, disclosure, alteration, loss or destruction, taking account of the nature of the information and processing involved.

These measures include technical safeguards for systems, access and communications; administrative controls covering policies, awareness, third-party oversight and incident handling; and organisational safeguards addressing roles, confidentiality, governance and accountability.

How we select safeguards.

We apply technical, organisational and administrative measures based on the nature of the Personal Data, the processing context and the risks that need to be controlled.

10 / YOUR RIGHTS

Your Personal Data rights

Subject to the KSA PDPL, its Implementing Regulations and any applicable conditions or restrictions, you may exercise the following rights.

Right to be informed

To be informed about the legal basis and purpose for collecting and processing your Personal Data.

Right of access

To access Personal Data held about you, subject to applicable conditions.

Right to obtain a copy

To request your Personal Data in a clear and readable format where applicable.

Right to correction, completion or update

To request that inaccurate or incomplete Personal Data is corrected, completed or updated.

Right to request destruction

To request destruction where the applicable KSA PDPL conditions are satisfied and continued retention is not required.

Right to withdraw consent

Where consent is the basis relied upon, you may withdraw it through an available method. Withdrawal does not affect processing supported by another legal basis.

Right to restrict processing

To request restriction of processing where you contest the accuracy of your Personal Data, while we verify its accuracy.

To exercise a right, submit a request through our Data Subject Rights (DSR) Request Form. We may take appropriate steps to verify your identity or authority before acting on the request.

We will act on a Data Subject rights request without delay and within a period not exceeding 30 days. Where implementation requires disproportionate effort, or we receive multiple requests from the same Data Subject, this period may be extended by up to an additional 30 days. If an extension is required, we will notify you in advance and explain the reason for the delay.

How we handle a rights request.

We assess each request, verify identity or authority where needed, apply the relevant KSA PDPL conditions and document the response and closure evidence.

11 / COMPLAINTS

Questions, complaints or objections

If you have a concern about how DPO Arabia handles your Personal Data or applies the KSA PDPL, you may contact us using the Data Subject Rights (DSR) Request Form so we can review and respond.

You also have the right to submit a complaint relating to the application of the KSA PDPL to the Competent Authority. You may also have the right to claim compensation for material or moral damage where the conditions established by the Law and its Implementing Regulations are met.

How we handle privacy concerns.

Privacy concerns submitted through our Data Subject Rights Request Form are reviewed through our privacy handling process, without affecting any right to complain to the Competent Authority.

12 / WEBSITE TECHNOLOGIES

Cookies and website technologies

We use essential website technologies to operate, secure, and maintain the DPO Arabia website. We also use optional analytics technologies and third-party embedded content, subject to your cookie preferences.

Essential technologies

These support core website functionality, security, consent management, and technical operation. They are necessary for the website to function and do not require consent through our optional cookie categories.

Website Analytics

Where you enable Analytics cookies, we use Google Analytics 4 to understand website visits, navigation, enquiry interactions and website performance. This may involve processing device information, browser information, online identifiers and website usage data.

LinkedIn embedded content and Marketing cookies

Our Thank You page includes embedded LinkedIn posts featuring privacy, regulatory and KSA PDPL-related content.

These posts remain blocked unless you enable Marketing cookies through CookieHub. When enabled, your browser connects to LinkedIn and associated third-party services, which may process technical information, online identifiers, cookie information, and interaction data. Our testing also identified ProtectHS-related requests associated with LinkedIn content.

The embedded content and associated third-party processing are subject to the relevant providers’ privacy and cookie practices. Such processing may involve systems located outside the Kingdom of Saudi Arabia.

Cookie Settings and Withdrawal of Consent

You can accept, reject, or withdraw consent for optional Analytics and Marketing cookies independently at any time through Manage cookie preferences.

Disabling Marketing consent prevents the LinkedIn posts from loading and hides previously displayed embeds. Previously stored third-party cookies may remain in your browser and can be managed through your browser settings.

Your decision regarding optional cookies does not prevent you from submitting an enquiry or Request for Quotation (RFQ) to DPO Arabia.

Where analytics-related processing involves transfer, storage, processing or remote access outside the Kingdom of Saudi Arabia, the safeguards described in Section 07 of this Privacy Notice apply.

How analytics choice works.

Analytics is used only when enabled through Cookie Settings, and the preference can be changed at any time through the website controls.

13 / UPDATES

Changes to this Privacy Notice

We may update this Privacy Notice when our processing activities, website, service providers or applicable requirements change. The latest version will be published on this page and identified by the last-updated date shown above.

Version	Effective date	Update
v1.1	10 October 2026	Updated disclosures relating to website technical data, consent-based LinkedIn embedded content, third-party recipients, optional Analytics and Marketing technologies, consent withdrawal and potential international processing associated with embedded content.
v1.0	01 October 2026	Initial published version of the DPO Arabia Privacy Notice.

How updates are communicated.

The current version is published on this page with its last-updated date so changes to our processing information can be identified.

14 / CONTACT

Questions about your Personal Data?

Use our dedicated Data Subject Rights Request Form if you want to exercise an applicable Personal Data right, ask a privacy question or ask us to review a concern relating to Personal Data processed by DPO Arabia.