Privacy Policy

Last Updated: May 17, 2026

At SirajTech ("we," "our," or "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our cybersecurity consulting services. It applies to all visitors, clients, and users across the Kingdom of Saudi Arabia and internationally.

We are committed to protecting your personal data in accordance with the Saudi Personal Data Protection Law (PDPL), the National Cybersecurity Authority (NCA) guidelines, and international best practices.

1. Information We Collect

We collect information you provide directly to us, as well as information automatically collected when you interact with our website and services.

2. How We Use Your Information

We use your personal information for the following purposes:

• Service delivery: To provide cybersecurity consulting, Aramco CCC certification support, and managed security services you have requested.
• Communication: To respond to your inquiries, send service updates, and provide technical support.
• Improvement: To analyze website usage and improve our content, services, and user experience.
• Compliance: To meet legal and regulatory obligations under Saudi law, including NCA requirements and anti-money laundering regulations.
• Marketing (with consent): To send you relevant cybersecurity resources, industry updates, and service offerings. You may opt out at any time.

3. Legal Basis for Processing (PDPL Compliance)

Under the Saudi Personal Data Protection Law (PDPL), we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for specific processing purposes (e.g., marketing communications).
• Contractual necessity: Processing is necessary for the performance of a service agreement with you.
• Legal obligation: Processing is required to comply with Saudi laws and regulatory requirements.
• Legitimate interests: Processing is necessary for our legitimate business interests, such as improving our services and preventing fraud.

4. Data Sharing & Disclosure

We do not sell your personal information. We may share your data only in the following circumstances:

• Service providers: With trusted third-party vendors who assist us in operating our website and delivering services (e.g., hosting providers, email services, CRM platforms) — all bound by confidentiality agreements.
• Legal requirements: When required by Saudi law, court order, or government regulation (including NCA and other regulatory bodies).
• Business transfers: In connection with a merger, acquisition, or sale of assets — with notice to you.

5. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy, or as required by Saudi law:

• Contact form inquiries: 2 years after last communication.
• Client service records: 7 years after the end of the service agreement (to comply with Saudi commercial law and tax regulations).
• Website analytics: 26 months (aggregated and anonymized).

6. Your Rights (Under Saudi PDPL)

As a data subject under the Saudi PDPL, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to restriction: Request restriction of processing in certain circumstances.
• Right to data portability: Receive your data in a structured, commonly used format.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within 30 days as required by PDPL.

7. Data Security

We implement robust technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Access controls and multi-factor authentication for all systems.
• Regular security audits and vulnerability assessments.
• Employee training on data protection and confidentiality.
• NCA-aligned security controls and incident response procedures.

8. Cookies

Our website uses cookies to enhance your experience. By continuing to browse, you consent to our use of essential cookies. Analytics cookies require your explicit consent via our cookie banner.

You can manage cookie preferences through your browser settings at any time. Blocking certain cookies may affect website functionality.

9. Third-Party Links

Our website may contain links to third-party websites (e.g., LinkedIn, YouTube). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. International Data Transfers

Your data is primarily stored and processed within the Kingdom of Saudi Arabia. In the limited cases where data may be transferred internationally (e.g., using global cloud services), we ensure appropriate safeguards are in place, including Standard Contractual Clauses and compliance with PDPL transfer requirements.

11. WhatsApp & Chatbot Communications

When you contact us via WhatsApp or our AI chatbot widget, your communications are encrypted in transit. Chat transcripts may be stored for quality assurance and service improvement purposes. You can request deletion of your chat history at any time by emailing us.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations. Material changes will be notified via our website or direct communication. The "Last Updated" date at the top of this page indicates when the policy was last revised.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

• Email: [email protected]
• Phone: +966 54 048 1582
• Address: King Fahd Suburb, Dammam, Eastern Province, Saudi Arabia

---

Data Protection Officer: SirajTech Compliance Team · [email protected]

Regulatory Authority: Saudi Authority for Data and Artificial Intelligence (SDAIA) — sdaia.gov.sa