Privacy Policy

1. Who we are and our role

Ufuq Al-Tatweer, based in Riyadh, Kingdom of Saudi Arabia, is the data controller for personal data collected through this website and its contact channels. In relation to consulting project data, the Company may act as a data processor on behalf of the client, as defined in the service agreement and the non-disclosure agreement.

2. Data we collect

a. Data you provide directly

• Full name, mobile number, email address, organisation name and job title.
• The content of your message, the service requested and your estimated budget.
• Data you share with us during project delivery (financial statements, operational data, documents).

b. Data collected automatically

• IP address, browser type, operating system and device language.
• Pages visited, time spent and referral source.
• Cookie identifiers as described in our Cookie Policy.

We do not intentionally collect any sensitive personal data (such as health, belief, genetic or biometric data) through the website, and we ask that you do not send such data through contact forms.

3. Legal basis for processing

• Consent: when you submit the contact form or accept optional cookies.
• Contract performance: to deliver the engaged service, issue invoices and communicate operationally.
• Legitimate interest: to secure the website, prevent misuse and improve service quality, without prejudicing your rights.
• Legal obligation: to comply with accounting, tax and regulatory requirements in the Kingdom.

4. Purposes of use

1. Responding to your enquiries and requests and arranging diagnostic sessions.
2. Preparing quotes and scope documents and delivering advisory projects.
3. Issuing compliant invoices, processing payments and maintaining accounting records.
4. Improving website content and user experience through aggregated, non-identifying analytics.
5. Protecting the website and its data from unlawful use.
6. Sending updates or professional content, only if you explicitly opt in, with the ability to unsubscribe at any time.

5. Data sharing

We disclose your personal data only in the following cases:

• Trusted service providers acting on our behalf (hosting, email, analytics tools), only to the extent needed to perform their function, and under contractual confidentiality and data protection obligations.
• Competent authorities where there is a legal obligation or a judicial or regulatory order.
• With your explicit written consent, such as naming your organisation as a reference or case study.

We never sell, rent or exchange your data for marketing purposes under any circumstances.

6. Transfers outside the Kingdom

Some technical data may be processed through international service providers (such as font, map and hosting services). In such cases we apply appropriate safeguards consistent with the Personal Data Protection Law and its Implementing Regulation on cross-border data transfers.

7. Retention periods

• Contact requests not followed by an engagement: up to 24 months, then destroyed.
• Contracted client data and financial records: for the period required by accounting and tax regulations in the Kingdom.
• Client project data (operational documents): working copies are destroyed after the support period ends; a secured archival copy of the final deliverables is retained unless you request otherwise in writing.
• Technical website logs: up to 12 months.

8. Your rights

Under the Personal Data Protection Law you have the right to:

• Be informed of the legal basis and purpose of collecting your data.
• Access the personal data we hold about you.
• Obtain a copy of it in a clear, readable format.
• Correct, update or complete your data.
• Request destruction of your data once it is no longer needed for the purpose it was collected for.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@massar.it.com and we will respond within the statutory period. We may ask for proof of identity before acting, to protect your data.

9. Data security

We apply appropriate organisational and technical measures to protect your data, including:

• Encrypting website traffic over HTTPS.
• Restricting data access on a need-to-know basis within the assigned project team.
• Storing client documents in secure environments protected by strong passwords and two-factor authentication.
• Signing non-disclosure agreements with all team members and collaborators.
• Periodic access reviews and secure destruction of unnecessary copies.

Nevertheless, no method of transmission over the internet can be guaranteed absolutely secure. We commit to notifying you and the competent authority of any breach affecting your data as required by law.

10. Children's privacy

Our services are directed at organisations and adults, and we do not knowingly collect data from anyone under the age of eighteen. If we learn that such data has been collected, we destroy it immediately.

11. Policy updates

We may update this policy to reflect changes in our practices or in applicable law. The updated version is published on this page with an amended "last updated" date, and we recommend reviewing it periodically.

12. Contact and complaints

For any enquiry or complaint regarding the privacy of your data:

• Email: contact@massar.it.com
• Phone and WhatsApp: +966 53 610 5087

If you are not satisfied with our response, you have the right to lodge a complaint with the authority supervising the application of the Personal Data Protection Law in the Kingdom of Saudi Arabia.