This is a working draft that has not yet been reviewed by legal counsel and still contains unfilled fields. It must not be relied upon before that review.
This policy explains how Company legal name (“Masarkum”, “we”) handles personal data collected through masarkum.com and through the Masarkum platform.
It is written to meet the Personal Data Protection Law issued under Royal Decree M/19 and its Implementing Regulations. The supervisory authority is the Saudi Data & AI Authority (SDAIA).
1. The capacity in which we handle your data
We handle personal data in two distinct capacities, each carrying different obligations:
- As a controller — for website visitors, people who submit the contact form, and the representatives of organisations we contract with. We determine the purposes and means of processing.
- As a processor — for data that subscribing organisations enter into the Masarkum platform (their employees, projects, risks and so on). The subscribing organisation is the controller; we process that data only on its instructions and under our subscription agreement with it.
2. The data we collect
We collect the minimum needed for a stated purpose. We do not collect data on the chance that it may prove useful later.
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, organisation, email, phone number, the content of your message | The contact form or direct correspondence |
| Account data | Username, job role, organisational unit, sign-in records | The subscribing organisation when accounts are provisioned |
| Platform content | Plans, KPIs, projects, risks, policies and attachments entered by users | Entered by the subscribing organisation’s users |
| Technical data | IP address, browser and device type, request time, error logs | Recorded automatically when the site or platform is used |
| Display preferences | Light or dark mode, language choice | Stored locally in your browser |
3. Purposes and legal bases
We do not process personal data without a clear legal basis. What we process, and why:
| Purpose | Legal basis |
|---|---|
| Responding to demo requests and enquiries | Steps taken at your request prior to entering a contract |
| Providing and operating the platform for subscribers | Performance of the subscription agreement |
| Protecting our systems, detecting intrusion, diagnosing faults | Legitimate interest in service security, balanced against your rights |
| Improving the service and providing support | Legitimate interest, or performance of the subscription agreement |
| Statutory, accounting and tax obligations | Compliance with a legal obligation |
| Marketing communications | Your explicit consent, which you may withdraw at any time |
4. Cookies and local storage
As it currently stands, masarkum.com uses no tracking cookies and no third-party analytics, and we build no advertising profiles of visitors.
We use your browser’s local storage for one purpose only: remembering whether you chose light or dark mode. That value never leaves your device and never reaches us. You can clear it from your browser settings.
If analytics or cookies are added later, this section must be updated and a consent mechanism added before they are enabled.
5. Sharing your data
We do not sell, rent or trade personal data in any form. We share it only in narrow, defined circumstances:
- Technical service providers who enable us to run the site and platform (hosting, email, operational monitoring), under contracts binding them to protection no weaker than our own.
- Competent governmental or judicial authorities, where a valid legal request exists and only to the extent that request requires.
- Our professional advisers (legal or accounting) where needed, and only within the scope of their engagement.
- The actual list of service providers must be enumerated and named here before publication.
6. Transfers outside the Kingdom
Our default is to process and store data inside the Kingdom of Saudi Arabia, and we offer in-Kingdom hosting for organisations that require it.
Where a transfer outside the Kingdom is necessary, it takes place only under the PDPL and the Regulation on Personal Data Transfer outside the Kingdom — including verifying the level of protection in the receiving jurisdiction and putting appropriate safeguards such as standard contractual clauses in place — and never where the transfer would prejudice national security or the Kingdom’s vital interests.
7. Retention
We keep personal data only for as long as the purpose it was collected for requires, then destroy it or irreversibly anonymise it.
Prospect data that does not become a customer: 24 months from last contact. Subscriber data: for the subscription term and the period agreed in the subscription agreement thereafter. Accounting records: for the period the applicable regulations require.
We maintain our record of processing activities throughout the processing and for five years after it ends, as the Implementing Regulations require.
8. Security
We apply organisational and technical controls proportionate to the sensitivity of the data, including:
- Encryption in transit and at rest
- Role-based permissions down to record level, on a least-privilege basis
- An immutable audit log of every access and material change
- Logical separation of each subscribing organisation’s data
- Periodic access reviews, tested backups, and an incident response plan
9. Data breach notification
If personal data is leaked, damaged or accessed without authorisation, we notify the competent authority within 72 hours of becoming aware of the incident, and we notify affected individuals without undue delay where the incident is likely to cause serious harm to their data or conflict with their rights.
The notification describes the incident, its likely effect, the steps we have taken to contain it, and how to reach our data protection officer.
10. Your rights
The PDPL grants you the following rights, and we charge nothing for exercising them:
- The right to be informed of the legal basis for collecting your data and the purpose it serves.
- The right of access — to obtain a copy of your data in a clear, readable format.
- The right to have inaccurate, incomplete or outdated data corrected.
- The right to request destruction of your data once the purpose for collecting it has ended or it is no longer needed.
- The right to restrict or object to processing in the cases the law permits.
- The right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- The right to port your data to another controller in a commonly used electronic format.
11. How to exercise your rights
Send your request to privacy@masarkum.com stating which right you wish to exercise. We may ask you to verify your identity first, to protect your data from unauthorised access.
We respond within 30 days of receiving a request. If we need longer, we will tell you and explain why before that period expires.
If your request concerns data entered into the Masarkum platform by a subscribing organisation, that organisation is the controller. We will refer you to them and support them in responding.
If you are not satisfied with our response, you have the right to complain to the Saudi Data & AI Authority (SDAIA) as the competent authority.
12. Data protection officer
We have appointed a data protection officer to oversee compliance and to handle your questions and requests.
Contact: privacy@masarkum.com — Officer name and title — National address.
13. Artificial intelligence in the platform
The Masarkum platform includes features that use AI models to produce drafts — project charters, policy summaries, risk narratives and similar.
Every generated output appears as a draft carrying an AI-generated marker and is adopted only after human review. Subscriber data is not used to train general-purpose models. Each call records the model version and prompt version in the audit log.
14. Children’s data
The site and platform are intended for organisational and professional use and are not designed to collect data from anyone under eighteen. If we learn that such data has been collected without a lawful basis, we will destroy it.
15. Changes to this policy
We may update this policy from time to time. The last-updated date appears at the top of this page, and where a change is material we will notify subscribing organisations a reasonable period before it takes effect.
16. Contact us
Company legal name — Commercial Registration No. 0000000000 — National address, Kingdom of Saudi Arabia.
General enquiries: info@masarkum.com — Privacy matters: privacy@masarkum.com.