Privacy Policy & PDPL Notice
How we handle what you share with us.
Issued under the Saudi Personal Data Protection Law. It explains what we collect, why, for how long, and your rights.
Effective 13 November 2026 · Version 1.3
1. Controller. Khaled Abdulrazaq Hussain Felimban, freelance practitioner, Freelance Document No. FL-277586721 (Ministry of Human Resources and Social Development), trading as T’ASEES and Khaled Felimban Consultants (the “Practitioner”, “we”), is the controller of personal data processed through www.tasees.sa and in the course of his work. This notice is issued under the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 dated 9/2/1443H, as amended, and its Implementing Regulations. Privacy and data protection contact: Khaled Felimban, info@tasees.sa.
2. What we collect and why.
| Data category | Examples | Purpose | Lawful basis (PDPL) | Retention |
|---|---|---|---|---|
| Booking and inquiry data | Name, organisation and role, mobile or email, session details, your message, the acceptance statement | Answering inquiries, arranging and holding sessions, preparing proposals | Steps before a contract; performance of a contract | 24 months after last contact, or longer if a dispute or legal duty requires it |
| Client engagement data | Contract contacts, invoicing details, project correspondence | Delivering services, invoicing, record-keeping | Performance of a contract; legal obligation | Contract term plus the period required by applicable tax and other laws |
| Recruitment and associate data | CV, qualifications, references | Assessing applicants and associate consultants | Consent; steps before a contract | 12 months unless engaged |
| Marketing preferences | Newsletter or event subscription | Sending insights and invitations | Consent (withdrawable at any time) | Until consent is withdrawn |
| Technical data | IP address and request logs kept by our hosting provider | Security and operation of the Website | Legitimate interest | As set by the hosting provider, and no longer than needed for security |
| Published associates | Name, photograph and professional profile | Presenting the team on the Website, in marketing material and in proposals | Written consent, which can be withdrawn | Until consent is withdrawn or the association ends |
We collect your data from you directly. For recruitment and associate applications we may receive information about you from the referees you named, and we use it only to assess the application. WhatsApp messages about enquiries and Bookings are kept for 24 months after last contact and then deleted from our devices; copies held by WhatsApp are subject to its own privacy policy.
We do not knowingly collect sensitive data (such as health, genetic, credit, religious or ethnic data). Please do not submit it. If an engagement requires it, it will be processed only under a signed agreement with the safeguards the PDPL requires.
3. Principles we apply. We collect only what is necessary for a stated purpose. We keep data accurate and up to date. We do not use it for a new purpose without a lawful basis. We destroy or anonymise it once the purpose ends.
4. Who we share it with. We do not sell personal data. We disclose it only to: (a) service providers acting on our instructions, including website hosting (Hostinger), email, cloud storage and messaging (WhatsApp, operated by Meta); (b) independent consultants bound by written confidentiality and data protection undertakings, where needed for an engagement; (c) professional advisers such as accountants and lawyers; (d) competent authorities, where required by law or a judicial order.
5. Transfers outside the Kingdom. Some providers, including WhatsApp and our email and cloud services, may process data outside the Kingdom. We transfer personal data outside the Kingdom only as permitted by Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, and only the minimum data needed. Our hosting provider, Hostinger, hosts the Website and its technical logs on servers in France, with backups in Lithuania; our email service is also provided by Hostinger outside the Kingdom. If you prefer not to use WhatsApp, you can book by email or telephone.
6. Your rights. Under the PDPL you have the right to:
be informed of how your data is collected and processed and on what basis;
access your personal data and obtain a copy in a clear, readable format;
request correction, completion or updating of your data;
request destruction of your data when it is no longer needed, subject to legal retention duties;
withdraw your consent at any time, without affecting processing carried out before withdrawal;
stop direct marketing at any time through a free, simple unsubscribe option. We send marketing only with your prior consent and never use sensitive data for marketing.
Send requests to info@tasees.sa. We may verify your identity first. We respond within the period set by the Implementing Regulations, currently thirty (30) days, extendable by up to a further thirty (30) days, with prior notice to you, where a request needs unusual effort or several requests are received. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the competent authority, within the period set by the Implementing Regulations (currently ninety (90) days).
7. Security. We apply administrative and technical safeguards suited to the nature of the data, including encryption in transit on the Website, password-protected accounts, and access limited to those who need it. Independent consultants give written confidentiality undertakings. Client data is not entered into public artificial intelligence tools without the client’s written approval.
8. Data breaches. If a personal data breach occurs, we will notify SDAIA within seventy-two (72) hours of becoming aware of it, as required. We will notify affected individuals without undue delay where the breach may cause them harm.
9. Cookies. The Website sets no cookies and stores nothing in your browser. It uses no analytics, advertising or tracking tools, and loads no files from third-party servers. If we introduce any of these, we will ask for your consent first and update this notice.
10. Minors. The Website is not directed at persons under 18. We do not knowingly collect their data.
11. Changes. We will post any update here with a new effective date. Where a change materially affects your rights, we will notify you by reasonable means.
12. Language. This notice is issued in Arabic and English. In case of conflict, the Arabic text prevails.
Issued in Arabic and English. In case of conflict, the Arabic text prevails. النسخة العربية