1. Introduction
Awtar PR & Marketing Company is committed to protecting the privacy of users and clients. This policy is an integral part of our Terms of Use and defines how personal data is collected, processed, and protected per the Personal Data Protection Law (Royal Decree M/19 dated 9/2/1443H) and its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).
By using Awtar's website or services, you acknowledge having read and expressly consented to this policy.
2. Data We Collect
a. Data You Provide Directly
- Full name, phone number, email address.
- Business information (brand name, activity, commercial registration if applicable).
- Project details, needs, and marketing goals.
- Payment data (via certified payment gateways — we do not store card details).
- Any content you share with us (text, images, videos, account access).
b. Data Collected Automatically
- IP address, browser type and operating system, device type.
- Pages visited and browsing duration.
- Approximate geographic location (based on IP only).
- Cookies and session identifiers (see Cookie Policy).
3. Processing Purposes
- Responding to your inquiry and providing an appropriate quote.
- Executing contracted services and following up project progress.
- Issuing invoices and recording financial transactions.
- Communicating with you by phone or email to send updates and reports.
- Improving site experience and performance analytics.
- Sending marketing newsletters and promotional offers with your prior consent, with opt-out option in every message.
- Complying with regulatory, tax, and accounting obligations.
- Detecting and preventing fraud and unlawful use.
4. Legal Basis for Processing
- Explicit consent from the data subject.
- Contract performance to which you are a party.
- Compliance with regulatory obligation (taxes, accounting records).
- Legitimate interests of Awtar to improve services, without overriding your rights.
5. Data Sharing with Third Parties
We do not sell your personal data to any third party. We may share it only in these cases:
- Operational service providers: CRM, payment gateways, hosting and email services, site analytics tools — all bound by confidentiality.
- Social media platforms: When running ad campaigns, we share some data with Meta, Google, and TikTok under their data processing agreements.
- Government entities: Upon official request by judicial order or to comply with Saudi regulations.
- Awtar's legal and accounting advisors under confidentiality.
6. Retention Period
- Invoices and financial transactions: 10 years (per ZATCA regulations).
- Active client data: Duration of contractual relationship + 3 years after termination.
- Visitor and incomplete inquiry data: Maximum 12 months.
- Analytics records: 14 months.
After this period, data is securely deleted or anonymized.
7. Data Security
- Encrypted communication between your browser and our servers (HTTPS / TLS 1.3).
- Sensitive data encryption at rest (AES-256).
- Access control on least-privilege principle.
- Two-factor authentication for all employees.
- Periodic security reviews and annual penetration testing.
- Binding NDAs for every employee and service provider.
In case of a data breach likely to affect you, we will notify you and the competent authority (SDAIA) within (72) hours of incident discovery per regulatory requirements.
8. Your Rights Under PDPL
- Right to be informed about the legal basis and processing purposes.
- Right of access to a copy of your processed data.
- Right to correction of inaccurate or incomplete data.
- Right to deletion when no longer needed.
- Right to withdraw consent at any time without affecting prior lawful processing.
- Right to data portability in a structured, machine-readable format.
- Right to object to processing for direct marketing.
We will process your request within (30) business days. In exceptional cases we may extend by (30) additional days with notice.
9. Cookies
Our site uses cookies to enhance your experience and analyze performance. For full details please review the Cookie Policy.
10. Children's Data
Awtar services target adults (18+) and businesses. We do not knowingly collect data of minors. If we learn of any such collection, we delete it immediately.
11. International Data Transfer
Some data may be processed on servers outside Saudi Arabia (Google Analytics, Meta Ads, project management tools). We commit in each case to:
- Ensuring the receiving country provides adequate protection.
- Entering binding data processing agreements (DPAs) with third parties.
- Complying with SDAIA's international transfer controls.
12. Policy Updates
We may update this policy occasionally. Material changes will be notified by email or prominent site notice at least (15) days before taking effect.
To inquire about the Privacy Policy or exercise any of your rights, please contact the Data Protection Officer (DPO):
- Email: info@awtar.it.com
- Phone: +966545868090
- Address: Riyadh, Kingdom of Saudi Arabia
If unsatisfied with the response, you may file a complaint directly with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official website.
