Privacy Policy

Last updated: August 2026

Introduction

RAFD Business Analysis respects your privacy and is committed to protecting your personal data in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulation, supervised by the Saudi Data & AI Authority (SDAIA).

This policy explains what we collect, why, how we protect it, and what rights you hold over it.

Data we collect

Data you provide directly

Full name and company name.
Mobile number and email address.
The request or project details you write in the contact form.
Any documents or data you later share with us to deliver the service.

Data collected automatically

IP address, browser type, device and operating system.
Pages visited, time on page and referral source.
Cookie data as described in the Cookie Policy.

We do not request sensitive data through the website

The contact form asks for no card numbers or confidential financial information. When you pay online, card details are entered directly on the payment gateway's secure page, so we never see or store them; we receive only the transaction status, amount and reference. Any financial data relating to your project is received only after an NDA is signed and through agreed channels.

Purposes and legal basis for processing

We process your data for the following purposes only:

Responding to your request and issuing a quotation or scheduling a session — on the basis of pre-contractual steps taken at your request.
Delivering the contracted service and issuing invoices — on the basis of performance of the contract.
Legal compliance, such as retaining accounting and tax records — on the basis of statutory obligation.
Improving the website and service through aggregated analytics — on the basis of legitimate interest, without prejudice to your rights.
Sending marketing updates — only after your explicit consent, which you may withdraw at any time.

We do not use your data for any other purpose without notifying you and obtaining consent where required.

We never sell, rent or trade your personal data. We may share it narrowly with:

Technical service providers acting for us (hosting, email, analytics) under contracts binding them to confidentiality and protection.
Our payment gateway provider (N-Genius — Network International) and your card issuer, to the extent needed to complete and verify a payment and prevent fraud.
Specialist advisors engaged on your project, after they sign a non-disclosure agreement.
Government or judicial authorities where legally required.

Where any transfer outside the Kingdom occurs, we comply with the controls on cross-border transfer set out in the Personal Data Protection Law and its Regulation.

Your rights

The law grants you the following rights over your personal data:

Right to be informed: to know the legal basis and purpose for collecting your data.
Right of access: to view the data we hold about you.
Right to obtain a copy: to receive a copy in a clear, readable format.
Right to rectification: to have your data corrected, updated or completed.
Right to destruction: to request deletion once the data is no longer needed, subject to statutory retention periods.
Right to withdraw consent: to withdraw consent for consent-based processing at any time.

To exercise any of these rights, write to [email protected]. We respond within the statutory period, and may ask you to verify your identity first in order to protect your data.

Retention periods

Enquiries that do not become engagements: retained for up to 24 months, then destroyed.
Contracted client data and files: retained for the duration of the relationship and for the subsequent statutory period required for accounting and tax records.
Mailing list data: retained until consent is withdrawn or you unsubscribe.

After the retention period the data is destroyed or anonymised so that you can no longer be identified.

Security measures

We apply technical and organisational measures proportionate to the nature of the data, including:

Encrypting the connection to the website over HTTPS.
Restricting data access to those who need it to do their work.
Binding non-disclosure agreements for everyone handling client data.
Regular backups and strong password policies.

No transmission method over the internet can be guaranteed absolutely secure. We commit to notifying the competent authorities and affected data subjects of any breach requiring notification under the law.

Minors' privacy

Our services are directed at businesses and adults, and we do not knowingly collect data from anyone under eighteen. If you become aware that a minor has provided us with their data, please tell us so we can delete it immediately.

Updates to this policy

We may update this policy to reflect changes in our practices or in applicable law. The updated version is published on this page with a revised "last updated" date, and for material changes we seek to notify you through available channels.

Data protection contact

For any query or complaint relating to your data privacy:

Email: [email protected]
Phone: +966 55 646 9879
Address: Riyadh, Kingdom of Saudi Arabia

You also have the right to lodge a complaint with the authority responsible for supervising the Personal Data Protection Law in the Kingdom.