1. Introduction
Alaa Mesbah Advisory ("we," "us," or "our") operates the website alaamesbah.com. We are committed to protecting the personal data of all individuals who visit our website, engage with our content, or contact us for advisory services.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data in full compliance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H, and its Implementing Regulations issued by the Saudi Data & AI Authority (SDAIA). It also reflects applicable directives from the Communications, Space & Technology Commission (CITC) concerning digital services and electronic communications.
By using alaamesbah.com, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
The data controller responsible for your personal data is:
Alaa Mesbah Advisory Email: Advisor@alaamesbah.com Phone: +966 56 923 0640 Locations: Riyadh / Jeddah, Kingdom of Saudi Arabia
3. Data We Collect
We collect personal data only to the extent necessary for the purposes described in this Policy. The categories of data we may collect include:
a) Data you provide directly:

• Full name

• Email address

• Phone number

• Topic of interest (advisory session, workshop, or general inquiry)

• Any additional information you voluntarily share through our contact or inquiry forms

b) Data collected automatically:

• IP address and approximate geographic location

• Browser type and version

• Device type and operating system

• Pages visited and time spent on the site

• Referral source (how you arrived at alaamesbah.com)

c) Newsletter and subscription data:

• Email address provided when subscribing to our newsletter or updates

We do not collect sensitive personal data as defined under Article 2 of the PDPL (such as health data, financial account details, or religious beliefs) through this website.
4. Legal Basis for Processing
In accordance with the PDPL and its Implementing Regulations, we process your personal data on the following legal bases:

• Consent — Where you have freely and explicitly provided your consent, such as when subscribing to our newsletter or submitting an inquiry form

• Contractual necessity — Where processing is necessary to respond to your request for advisory services or to fulfill a service engagement

• Legitimate interests — Where processing is necessary for our legitimate business interests, such as website analytics and security, provided these interests do not override your rights and freedoms

• Legal obligation — Where we are required to process or retain data to comply with applicable Saudi law

5. How We Use Your Data
We use the personal data we collect for the following purposes:

• To respond to your inquiries, messages, and service requests

• To provide information about advisory services, workshops, and events

• To send newsletters and updates to subscribers who have opted in

• To analyze website usage and improve the user experience

• To maintain the security and integrity of our website

• To comply with applicable legal obligations under Saudi law

• To contact you regarding upcoming events or engagements where you have expressed interest

We will not use your personal data for purposes incompatible with those stated above without obtaining your prior consent.
6. Sharing of Personal Data
We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:
a) Service providers: We may share data with trusted third-party service providers who assist in operating our website and communications (such as Wix as our website platform, and email marketing tools). These providers are bound by data processing agreements and are not permitted to use your data for their own purposes.
b) Legal compliance: We may disclose personal data where required to do so by Saudi law, court order, or a directive from a competent authority such as SDAIA, CITC, or the Public Prosecution.
c) Business transfers: In the event of a restructuring or transfer of our advisory practice, personal data may be transferred as part of that process, subject to equivalent privacy protections.
All third-party data sharing is conducted in accordance with Article 13 of the PDPL and the conditions set out in its Implementing Regulations.
7. Cross-Border Data Transfers
Our website is hosted and operated through Wix.com, which may store or process data on servers located outside the Kingdom of Saudi Arabia. Any such cross-border transfer of personal data is conducted in accordance with Article 17 of the PDPL, which permits international transfers only where:

• The receiving country provides an adequate level of data protection, as determined by SDAIA; or

• Appropriate contractual safeguards are in place; or

• The transfer is necessary to fulfill a contractual obligation with you

We take reasonable steps to ensure that any international data transfers comply with Saudi regulatory requirements.
8. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or as required by applicable Saudi law and regulatory obligations. Specifically:

• Inquiry and contact form data: retained for up to 3 years from the date of last contact

• Newsletter subscription data: retained until you unsubscribe

• Website analytics data: retained for up to 12 months in aggregated or anonymized form

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.
9. Your Rights Under the PDPL
In accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, you have the following rights regarding your personal data:

• Right of access — You may request a copy of the personal data we hold about you

• Right to correction — You may request correction of any inaccurate or incomplete data

• Right to erasure — You may request deletion of your personal data, subject to our legal retention obligations

• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

• Right to object — You may object to processing carried out on the basis of legitimate interests

• Right to data portability — You may request that your data be provided to you in a structured, commonly used format

To exercise any of these rights, please contact us at Advisor@alaamesbah.com. We will respond within the timeframe specified under the PDPL and its Implementing Regulations, which is generally no later than 30 days from the date of your request.
If you believe your rights have been violated, you have the right to file a complaint with SDAIA as the competent supervisory authority for personal data protection in the Kingdom of Saudi Arabia.
10. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze site usage. Cookies are small data files stored on your device.
We use the following types of cookies:

• Essential cookies — Required for the website to function properly (e.g., session management)

• Analytics cookies — Used to understand how visitors interact with the site (e.g., pages visited, time on site)

• Preference cookies — Used to remember your settings and preferences

You may manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the website. Where required by applicable regulation, we will request your consent before placing non-essential cookies on your device.
11. Children's Privacy
Our website is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data through our site, please contact us immediately at Advisor@alaamesbah.com and we will take prompt steps to delete such data in accordance with the PDPL.
12. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures are consistent with the security requirements set out in the PDPL Implementing Regulations issued by SDAIA.
However, no method of transmission over the internet or electronic storage is entirely secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
13. Links to Third-Party Websites
Our website may contain links to external websites, including our social media profiles on LinkedIn and Instagram. This Privacy Policy applies only to alaamesbah.com. We are not responsible for the privacy practices of third-party websites and encourage you to review their respective privacy policies.
14. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Continued use of alaamesbah.com following any update constitutes your acknowledgment of the revised Policy.
15. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact:
Alaa Mesbah Advisory Email: Advisor@alaamesbah.com Phone: +966 56 923 0640 Locations: Riyadh / Jeddah, Kingdom of Saudi Arabia
To file a complaint with the Saudi data protection authority: Saudi Data & AI Authority (SDAIA) Website: sdaia.gov.sa