Privacy policy
This policy explains what personal data this site collects, why, where it is stored, when it is destroyed, and what your rights are and how to exercise them, under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulation.
Who collects your data
The controller is Zainab Mustafa Alwosaibi, legal specialist, acting in her personal capacity, based in the Eastern Province, Saudi Arabia. For anything about your data: info@zainabmlegal.com.
What data is collected
No personal data is collected from you except through the contact form, or if you email me directly:
- Form data: name, email address, organisation or establishment (optional), topic, message, and your choices in the two consent boxes together with the date and time of sending, so that consent is documented.
- Technical data sent with the message: the hosting provider's form system automatically records the IP address, browser type and the page the form was sent from. The provider also processes technical logs to run and protect the site. I do not use this data to identify you or for any marketing purpose.
- Direct emails: your email address and the content of your message.
What is not collected: the site does not ask for ID numbers, health, criminal, security or any other sensitive data, case details or documents. If any of this is sent, I will not deal with its substance and I will destroy it.
Calculators: the site's calculators run in your browser. The figures you enter are not sent to me or to any server.
Cookies and tracking: the site does not set analytics or advertising cookies and loads no third-party tracking tools. Fonts, images and files are served from the site itself. If an analytics tool is added later, this policy will be updated before it runs, and your consent will be asked for where required.
Why it is collected (purposes)
- To read and answer your message and follow up on what you asked.
- To send awareness emails when new articles or guides are published, only if you agreed to this in the second box.
- To run the site and protect it from spam and misuse.
Your data is never sold, rented or used to build marketing profiles, and it is not processed later for a purpose that conflicts with the one it was collected for.
Legal basis
- Purposes 1 and 2: your explicit consent (PDPL Article 5), given separately for each purpose as the Implementing Regulation requires (Article 11). The awareness-email box is optional and not pre-ticked, and my reply to your message does not depend on it. These emails follow the Implementing Regulation rules for awareness messages (Article 28): the sender is named, and stopping them is free and as easy as signing up.
- Purpose 3: the legitimate interest in keeping the site secure and protecting networks and information, for non-sensitive technical data (PDPL Article 6, paragraph 4, as amended, and Implementing Regulation Article 16).
Retention and destruction
- Form messages and emails: kept for no more than 12 months after our last exchange, then destroyed from the form system and the mailbox, unless a law requires them to be kept longer (Article 18).
- Your address on the awareness-email list: kept while your consent stands. When you withdraw it, sending stops immediately and your address is removed from the list within 30 days.
- Technical logs held by the hosting provider: kept under the provider's own policy; I do not copy them anywhere else.
Who receives your data
- Netlify, Inc. (based in the United States): hosts the site and receives, stores and filters form messages for spam, as a processor acting on my behalf, together with the providers it relies on to run its service, including Akismet, the spam-filtering service that every form message passes through.
- The email service provider I use to answer messages and to send awareness emails to those who agreed, which may process the data outside the Kingdom.
- Competent authorities, where a law requires disclosure to them.
I do not disclose your data to anyone else.
Processing outside the Kingdom
Because the hosting provider and the form system are outside the Kingdom, I treat this as a transfer of data outside the Kingdom under PDPL Article 29 as amended, made to carry out what you asked for, and limited to the minimum data needed. That is why the form has as few fields as possible and asks you not to send sensitive data.
Protecting your data
The site runs over an encrypted connection (HTTPS), and only I read the messages. If a leak or unlawful access occurs that could harm your data or you, I will notify the competent authority within 72 hours of becoming aware of it, as the Implementing Regulation requires (Article 24), and inform you where required.
Your rights
Article 4 of the PDPL, as amended by Royal Decree No. (M/148), gives you these rights:
- The right to be informed of the legal basis and purpose of collecting your data, which this policy explains.
- The right of access to the data I hold about you.
- The right to obtain a copy of your data in a readable and clear format.
- The right to ask for correction, completion or updating of your data.
- The right to ask for destruction of data that is no longer needed, subject to Article 18.
You may also withdraw your consent at any time (PDPL Article 5 and Implementing Regulation Article 12), without affecting processing carried out before the withdrawal, and you may file a complaint with the competent authority for the Law, the Saudi Data and AI Authority (SDAIA) (Article 34), within no more than 90 days of the incident or of when you became aware of it (Implementing Regulation Article 37).
How to exercise your rights
- Email info@zainabmlegal.com with the subject "Request about my data" and say which right you want to exercise.
- Send the request from the same address you used to contact me, so that I can verify your identity before acting on it, as the Implementing Regulation requires.
- I act on the request free of charge within no more than 30 days, which may be extended by another 30 days if acting on it requires disproportionate effort or you send several requests, after telling you in advance about the extension and the reason (Implementing Regulation Article 3).
- To stop the awareness emails only, the unsubscribe link in any email or a short reply is enough.
Legal capacity
The contact form is intended for people with full legal capacity. If that is not your case, please do not send your data through the form.
External links
This site links to official websites and social platforms. Each has its own privacy policy, and this policy does not cover them.
Changes to this policy
I may update this policy when the way the site works or the law changes. The date of the last update appears at the top of the page, and any material change, such as adding an analytics tool, is published here before it applies.