Personal data.

CyberListen, based in Riyadh, is the controller for personal data from this site and from support@cyberlisten.com. A signed engagement may name you as controller and us as processor. In that case the contract allocates the duties, and this page still describes the public site.

There is no account and no form on these pages. The message is sent by your mail program. We do not receive it through the website.

We set two cookies. One remembers the language. One remembers the choice you make on the cookie notice. Both are described on the cookies page. We do not set an advertising cookie, and we do not run a measurement tool on this site.

Once you email us, we have what you chose to send: your name, role, organisation, the message, and ordinary mail headers. A message about a service, a role, a partnership or a product investment is the same kind of enquiry. The host of the website may keep a short server log — IP address, time, and page — to keep the site up and to look into abuse. That log is not a cookie. We do not build a marketing profile from it, and we do not sell it.

We use an enquiry, including a partnership enquiry or a product-investment enquiry, to answer you, to decide whether a discussion fits, to take a next step you ask for, to keep a record of what was requested and what we declined, and to meet a legal duty, including export screening. Those are the purposes of that processing.

The language cookie is how the site opens in the language you use, or in English when that language is not published here. Article 6 of the Personal Data Protection Law lists circumstances in which the consent required by Article 5 is not required. Processing under another law, and processing to implement a prior agreement to which the person is a party, are among those circumstances. A prior agreement is not the only circumstance in Article 6. Enquiry data is not used to advertise.

Please do not put sensitive personal data in a first email. That includes health, belief, origin, and criminal data, as the law uses those ideas. If a case later requires it, the engagement states the basis and who may see it.

Access inside CyberListen is limited to people who need it to answer, to deliver, or to meet a legal duty. A processor, such as email or hosting, is bound by written terms and may not use the data for its own purposes.

We disclose personal data to a court, SDAIA, the National Cybersecurity Authority, or another competent authority when the law of the Kingdom requires it, and no more than that demand covers.

The company is based in Riyadh. If a person outside the Kingdom must read an enquiry in order to answer it, that is a transfer under the law and the Transfer Regulation, and it is identified before it happens.

We do not transfer data if it would prejudice national security or the vital interests of the Kingdom. We minimize what leaves. SDAIA may publish a list of places that provide adequate protection. Until a destination is on that list, we do not treat it as adequate. Where a transfer is necessary, the safeguard has to be one the Transfer Regulation recognises. A transfer that cannot meet those conditions is handled inside the Kingdom or declined.

Controlled software is a separate question from personal data. Staff outside the Kingdom do not receive it merely because they can see a mailbox.

An enquiry that does not become an engagement is kept only as long as we need it to answer, to show why we declined, and to meet a legal hold. A signed engagement is kept for the life of the contract and for the period Saudi law requires afterwards, including tax.

The language cookie and the consent cookie each last twelve months, unless you clear them sooner. We use access control and encryption in transit. A personal-data breach that the law requires us to notify is notified to SDAIA and, where the law requires it, to you.

Subject to the law and its exceptions, you may ask for access, for correction of what is wrong, and for deletion of what we no longer have a basis to keep. Where processing was based on consent, you may withdraw that consent.

Write to support@cyberlisten.com. We may need to confirm you are the person. We answer within the period the Implementing Regulations set. We may refuse where the law allows it, and we will say so.

You may complain to SDAIA. That right does not depend on asking us first.