Privacy Policy

This policy explains how [COMPANY LEGAL NAME] ("Ehkam", "we", "us") handles personal data when you visit ehkam.net, use the Ehkam platform, or interact with a form or link that one of our customers publishes through it.

We follow the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and its implementing regulations.

1. Who is responsible for your data

Ehkam is a platform that organisations ("customers") subscribe to and use to run their own work. Who is responsible for your data depends on the data:

• Data a customer stores in Ehkam: the customer is responsible (the controller). This includes the records, forms, comments and files you create or appear in at work, and anything you submit through a customer's public form. We process it only on the customer's instructions, to provide the service. If you have a question about that data, or want to exercise your rights over it, contact the organisation; we will help them answer you.
• Data Ehkam holds for its own purposes: we are responsible (the controller). This means your sign-in account, billing for a subscription, our website, and your messages to our support or sales teams.

This policy covers these people:

• Website visitors: anyone who visits ehkam.net or our marketplace pages.
• Prospects: people who write to our sales team or otherwise ask us about Ehkam before subscribing.
• Account holders: people with an Ehkam sign-in, whether they administer an organisation's Workspace or were invited to it.
• Billing contacts: the people who manage a subscription and its payments.
• People in our customers' records: people who are not users but whom a customer records in Ehkam, such as its staff, contractors, suppliers or clients. The customer controls that data.
• Form submitters: people who submit a customer's public form or follow its tracking link. The customer that published the form controls that data.

2. What we collect

When you have an Ehkam account:

• Identity and contact: name (in Arabic and English), email address, phone number, profile picture.
• Sign-in and security:
  • a hash of your password (never the password itself)
  • one-time codes, also stored as hashes
  • two-factor authentication settings
  • sign-in history, including IP address, browser or device type and time
  • failed sign-in attempts
• If you sign in with Google, Apple or your organisation's single sign-on: the profile details that provider shares with us, usually your name and email.
• Devices (if you use our mobile app or allow notifications): device identifier, operating system, model, device name and language, and a notification token. If you turn on biometric unlock, we store a public key; we never receive your fingerprint or face data.
• Activity in your workspace: the records you create or change, your comments and mentions, files you upload, notifications you receive and what you search for. Your organisation's administrators can see this, including a history of who changed what.

When you visit our website: pages viewed, referring site, browser and device type, and approximate country. We use analytics that set no cookies, and we mask IP addresses.

When you submit a customer's public form: whatever that form asks for, plus technical data such as your IP address, used to protect the form from abuse.

When you buy a subscription: billing contact details and the plan you chose. Card details go directly to our payment processor, Stripe; we never see or store your full card number.

When you contact support or sales: your message, your contact details and the details you give us.

When a customer records you: if you appear in a customer's records without being a user, the customer decides what it records about you. We hold that data for the customer, as section 1 explains.

3. Why we use it, and on what basis

We do not sell personal data. We do not use it for advertising, and we do not use the content customers store to train AI models. If we add features that use AI models to generate content or take actions, we will not use customers' content to train general-purpose models, ours or a provider's, without the customer's agreement [PLACEHOLDER: counsel to confirm this commitment].

Marketing messages. We do not send marketing email or marketing text messages today. The messages we send are service messages: sign-in codes, security alerts, invitations, billing notices, and the notifications you or your organisation have turned on. Security and billing messages cannot be switched off while you have an account, but you can choose which other notifications you receive in your notification settings. If we start sending marketing messages, we will do so only with your consent where the law requires it, and every message will include a simple way to opt out.

4. Who we share it with

We share personal data only with service providers that help us run Ehkam, under contracts that limit what they may do with it:

We may also disclose data:

• when the law requires it, or a competent authority lawfully asks for it;
• to protect the rights, safety or property of our users, customers or the public;
• to a buyer or successor if Ehkam is reorganised or sold, under the same protections.

5. Transfers outside Saudi Arabia

Some of the providers above process data outside the Kingdom, as shown in the table. We transfer personal data only where the PDPL and its Regulation on Personal Data Transfer outside the Kingdom allow it, with the safeguards they require.

6. How long we keep it

We keep personal data only as long as we need it for the purposes above or as the law requires:

• Your account data: for as long as you have an account with any organisation on Ehkam, then deleted or anonymised within [PERIOD].
• Sign-in and security logs: 90 days by default.
• Search history: 90 days.
• Audit trail: for the period your organisation's plan provides (90 days, one year or unlimited), or a period your organisation sets.
• Deleted files: recoverable for a short period your organisation chooses (7 days by default), then removed.
• Data exports: download links expire after 7 days.
• When an organisation closes its account: its data is permanently deleted 72 hours after it asks. Audit records are kept for [PERIOD] to meet legal and accountability obligations.
• Billing records: for the period tax and commercial law requires.

7. Your rights

Under the PDPL you have the right to:

• be informed about how your data is processed (this policy);
• access your data and get a copy of it;
• correct data that is inaccurate or incomplete;
• have your data destroyed when it is no longer needed, subject to the law;
• withdraw consent, where processing is based on consent.

To exercise these rights:

• For data your organisation stores in Ehkam, contact the organisation first; we will support them.
• For your Ehkam account or anything else, email [privacy@ehkam.net].
• We will answer within the period the law requires, and may need to verify your identity first.

Many of these you can do yourself:

• edit your profile;
• change your password and two-factor settings;
• sign out of other devices;
• if you administer an organisation, export or delete its data.

Complaints. If you are unhappy with how we handle your personal data, please tell us first at [privacy@ehkam.net] so we can try to put it right. You also have the right to lodge a complaint with the competent authority in the Kingdom, the Saudi Data and AI Authority (SDAIA), whether or not you have contacted us.

8. Cookies and similar technologies

We use only the cookies and browser storage the service needs to work and to remember your choices, such as keeping you signed in, protecting forms, and remembering your language. We use no advertising or cross-site tracking cookies, and our website analytics set no cookies at all. Our Cookie Policy lists each one, with its purpose and how long it is kept.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including:

• encryption in transit (HTTPS);
• hashed passwords and one-time codes;
• optional and enforceable two-factor authentication;
• account lock-out after repeated failed sign-ins, and request rate limits;
• per-organisation separation of data in the application;
• role-based access controls;
• audit logging;
• error monitoring.

No system is perfectly secure. If a breach affects your personal data, we will notify the competent authority and, where required, you or your organisation, as the law requires.

10. Children

Ehkam is a service for organisations and is not directed at anyone under [18]. We do not knowingly collect children's personal data for our own purposes, and people under [18] may not hold an Ehkam account. If you believe we have collected a child's data, contact us and we will delete it.

If a customer records information about a child in its Workspace, the customer is responsible for having a lawful basis and any consent the law requires, such as a guardian's.

11. Changes to this policy

If we change this policy, we will update the date above. If the change is significant, we will tell account holders by email or in the app before it takes effect.

12. Links to other websites

Our websites and the service may link to websites and services we do not run. This policy does not cover them; their own privacy notices apply.

13. Related documents and language

• This policy should be read with our Terms of Service and our Cookie Policy. For personal data we process for customers, our Data Processing Addendum with each customer also applies.
• This policy is offered in Arabic and English. If they differ, the [Arabic] version prevails [PLACEHOLDER: counsel to confirm, as in the Terms].

14. If you are in the European Union or the United Kingdom

[PLACEHOLDER: counsel option. Include this section only if we offer Ehkam in the EU or UK, or monitor people there. Until then, delete it.]

Where the EU or UK General Data Protection Regulation applies to our processing:

• Controller and representative: for the data in section 1 that we control, the controller is [COMPANY LEGAL NAME]. Our representative in the EU is [PLACEHOLDER: EU representative] and in the UK is [PLACEHOLDER: UK representative].
• Legal bases: we rely on the bases in section 3: performance of a contract, legitimate interests (which you may ask us to explain), legal obligation, and consent where we ask for it.
• Your rights: in addition to the rights in section 7, you may ask us to erase your data, restrict or object to its processing (including any processing based on legitimate interests), and receive data you gave us in a portable format. You may withdraw consent at any time without affecting earlier processing.
• Transfers: where we transfer your data out of the EU or UK to a country without an adequacy decision, we use the safeguards the GDPR allows, such as standard contractual clauses [PLACEHOLDER: confirm the mechanism].
• Complaints: you may complain to the data protection authority where you live or work, or where an alleged breach happened.

15. If you are a California resident

[PLACEHOLDER: counsel option. Include this section only if we serve customers in California and meet the thresholds of the California Consumer Privacy Act. Until then, delete it.]

Where the California Consumer Privacy Act, as amended, applies to us:

• What we collect: in the last 12 months we collected the categories described in section 2: identifiers (such as name, email, phone and IP address), commercial information (subscription and billing details), internet activity (sign-in history and website usage), and professional information (the organisation you work for). The purposes are in section 3, and the categories of recipients are in section 4.
• No sale or sharing: we do not sell personal information, and we do not share it for cross-context behavioural advertising.
• Your rights: you may ask to know what personal information we collected about you and how we used it, to receive a copy, to correct it, and to delete it, subject to the exceptions in the law. You may use an authorised agent. We will not treat you differently for exercising these rights.
• How to ask: email [privacy@ehkam.net] [PLACEHOLDER: add any second request method the law requires]. We will verify your request before acting on it.

16. Contact

[COMPANY LEGAL NAME], Commercial Registration [NUMBER], [ADDRESS], Kingdom of Saudi Arabia. Privacy questions: [privacy@ehkam.net]. Data protection officer: [NAME / CONTACT, if appointed]. General support: support@ehkam.net.