Privacy PolicyPrivacy Policy

This website is operated by AMA GROUP, Commercial Registration No. 4650274479 (“AMA GROUP”, “we”, “us”, or “our”), which is the controller of the personal data collected through it within the meaning of the PDPL.

AMA GROUP determines the purposes and means of processing that data and is responsible for complying with the PDPL in all processing it carries out itself or through service providers acting on its behalf.

For any question or request concerning your personal data or this Policy, please contact us via the Contact page on this website and indicate in your message that it relates to privacy.

This Policy applies to personal data we collect through the website, including the contact form, the proposal request form, the careers inquiry form, and any correspondence that follows from them.

It does not apply to third-party websites or services, even where the website links to them. Personal data we process while delivering contracted projects for our clients, such as data relating to users of the applications and systems we build, is governed by the contracts concluded with those clients. In those cases the client, as the owner and operator of the product, is ordinarily the controller, and we access such data only to the extent required to perform or maintain the contracted work.

Contact form: your name, email address, the subject and content of your message, and, if you choose to provide them, your phone number and the name of the organization you represent.

Proposal request form: your name, organization name, email address, country, phone number, the service you are interested in, a description of your project, an indicative budget range, your expected timeline, and any attachment you choose to upload.

Careers inquiry form: your name, email address, the role or area you are interested in, your message, your CV, and, if you choose to provide them, your phone number and a link to your professional profile.

Usage and technical data: when you browse the website, data about your device and your browsing is processed as described in the Analytics and Measurement section. We do not store your IP address; we use only a salted hash of it, temporarily, to protect the website and its forms against automated submissions and misuse.

We do not request or seek to collect sensitive personal data, such as health, genetic, or biometric data, or data revealing ethnic origin or religious, philosophical, or political beliefs. Please do not include such data in any message or attachment.

CVs and attachments are accepted only in specified formats and sizes. On receipt, we verify that the content of each file matches its declared format and reject any file that fails this check.

A CV is used solely to assess your careers inquiry, and a proposal attachment solely to understand your project and prepare our response. Access to each is limited to personnel whose duties require it.

Please do not include personal data about other individuals, or information you are not authorized to disclose. If an attachment contains another person’s personal data, you confirm that you have a lawful basis for sharing it with us.

We use analytics and measurement tools to understand how the website is used, to improve it, and to measure the performance of our campaigns. Only the tools you consent to are active, as described in the Cookies and Consent section.

Without your consent: we record only anonymous page-view counts, consisting of the page, the landing campaign, the referring host, the country, and the device type, with no identifiers and nothing stored on your device. We treat the Global Privacy Control (GPC) and Do Not Track browser signals as a choice of essential technologies only.

First-party analytics, once you consent to the analytics category: an analytics system of our own, whose data we collect ourselves and store on our own server. It covers the following:

Browsing: the pages you visit and their titles, the referring page (origin and path), entry and exit pages, engaged time and total time, scroll depth, and the time you spend on each section.

Interaction: clicks (element, link text, and position); use of calls to action, outbound links, menus, FAQs, and filters; rage clicks and dead clicks; JavaScript errors; and performance metrics.

Form behavior: whether you start or abandon a form, the last field you reached, the time spent on each field, the fields that failed validation, and the submission outcome. We never record what you type; field values reach us only when you submit the form.

Campaigns: campaign parameters (UTM) and ad click identifiers (gclid, fbclid, ttclid, sccid, and msclkid), which we link to form submissions so that we know which campaign brought each request.

Device and location: device type, operating system, browser, screen and viewport size, language, time zone, and the country, region, and city derived from your IP address. We do not store the IP address itself; we use only a salted hash of it, temporarily, to prevent abuse and to limit request rates.

Analytics tools, once you consent to the analytics category: Microsoft Clarity for session recordings and heatmaps, with form fields masked; Google Analytics 4 to measure traffic and its sources; and Google Tag Manager to manage how these tools load.

Marketing tools, once you consent to the marketing category: conversion measurement from Meta, TikTok, Snap, and Google Ads, to measure the performance of our advertising campaigns and the conversions they generate, such as a form submitted after arriving at the website from an ad.

We use cookies and similar browser storage technologies in three categories: technologies necessary to operate and secure the website, such as verification tokens attached to forms and the record of your consent choice, which do not require your consent; analytics technologies; and marketing and campaign-measurement technologies.

When you visit the website, a consent banner lets you accept all, keep essential only, or choose the analytics and marketing categories separately. You can change your choice at any time through the “Privacy settings” link at the bottom of the website. Withdrawing consent does not affect the lawfulness of processing carried out before it.

Our cookies and storage: ama_consent is an essential cookie that records your consent choice for 12 months; ama_vid is a random analytics visitor identifier kept for 13 months; and browser storage holds your session, which ends after 30 minutes of inactivity, together with the first and last campaigns that brought you to the website, until you withdraw your consent.

Analytics tool cookies, with approximate periods set by their providers: Microsoft Clarity: _clck, about 1 year, and _clsk, 1 day; Google Analytics 4: _ga and _ga_<id>, 2 years.

Marketing tool cookies, with approximate periods set by their providers: Google Ads: _gcl_*, 90 days; Meta: _fbp and _fbc, 90 days; TikTok: _ttp and similar cookies, up to 13 months; Snap: _scid and similar cookies, up to 13 months.

You can also delete or block cookies through your browser settings. Please note that disabling essential technologies may affect how parts of the website work.

We process personal data only to: respond to and follow up on your messages and inquiries; review proposal requests and prepare proposals and estimates; assess careers inquiries and correspond about them; improve the website and our services and understand which content is most useful to our visitors; measure the performance of our campaigns and understand where visits and requests come from; operate and secure the website and prevent its misuse; comply with legal obligations; and establish, exercise, or defend legal rights.

We do not process data for purposes incompatible with those for which it was collected, we limit it to the minimum necessary, and we do not send you marketing messages without your prior consent.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Our processing of data submitted through the forms is based on your consent, which you give expressly by ticking the consent box before submitting, and on taking the steps you request before entering into a contract with you or the organization you represent.

Our processing of analytics and marketing data is based on the consent you give through the consent banner, separately for each category.

We may also process certain data where required to comply with a legal obligation, or on the basis of our legitimate interests, such as securing the website and preventing fraud and misuse, provided this does not prejudice your rights and interests and does not involve sensitive data.

You may withdraw your consent at any time: through “Privacy settings” for analytics and marketing, and via the Contact page on this website for form data. Withdrawal does not affect the lawfulness of processing carried out before it.

We treat everything you share with us through the website, including ideas, documents, requirements, and information about your organization or project, as confidential. We do not disclose it, and we use it only to review and respond to your request or to perform what is later agreed.

Access to this information is limited to our personnel whose duties require it and to service providers bound by confidentiality obligations no less protective than our own. Our duty of confidentiality continues after our correspondence ends, whether or not a contract is concluded.

Where needed, we are glad to sign a non-disclosure agreement before reviewing any highly sensitive information, in which case its terms apply alongside this Policy.

We apply protection by design: data protection controls are built into the website and our systems from the outset rather than added afterwards, in line with recognized professional practice.

As appropriate, these controls include encryption of data in transit, data minimization, storing data on a server dedicated to us, not storing IP addresses and using only a temporary salted hash of them, masking form inputs in session recordings, verification of uploaded files, protection of forms against automated submissions together with rate limiting, separation of duties with access restricted to those who need it, and periodic review of our security procedures.

No method of electronic transmission or storage is entirely free of risk. If a personal data breach affects your data, we will notify the competent authority and inform you as required by the PDPL, and we will take the steps needed to contain the incident and limit its effects.

We disclose personal data only to the extent necessary. Form submissions, their attachments, and analytics data are stored on our own backend server, a dedicated virtual private server operated for us on OVHcloud infrastructure and reached through Cloudflare’s network. Cloudflare provides website hosting and content delivery, security, and approximate geolocation based on IP address. We also use email delivery and form security-verification services. These providers act under contractual obligations to protect the data and not to use it for any other purpose.

If you consent to the analytics or marketing categories, the data relating to each category is sent to the providers of its tools: Microsoft (Clarity), Google (Google Analytics 4, Google Tag Manager, and Google Ads), Meta, TikTok, and Snap. Some of these providers may process the data as independent controllers under their own terms and privacy policies.

Where needed, we may also disclose personal data to professional advisers bound by confidentiality; to competent government or judicial authorities where required by law or by a lawful request; and in connection with a merger, acquisition, or restructuring, subject to appropriate safeguards.

We do not sell or rent personal data.

Our server and the service providers referred to in this Policy, including OVHcloud, Cloudflare, and the providers of the analytics and marketing tools, may process data outside the Kingdom of Saudi Arabia. This takes place only in accordance with the PDPL and the Regulation on Personal Data Transfer outside the Kingdom.

For any such transfer, we take care that it does not prejudice national security or the vital interests of the Kingdom, that it is limited to the minimum data necessary, and that the recipient provides an adequate level of protection or appropriate safeguards are applied where the law requires.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or for any longer period required by law.

Messages and proposal requests are kept for the duration of our correspondence and for as long afterwards as needed to follow up; if they lead to a contract, they become part of the contract records and are kept as the law requires. Careers inquiries and CVs are kept while they are being assessed, and we keep them for future opportunities only with your consent. Raw analytics events and session data are kept for 13 months; aggregated, anonymized statistics that do not identify you may be kept longer; and cookies and browser storage follow the periods set out in the Cookies and Consent section. Security-related technical data is kept for a limited period for protection and troubleshooting purposes.

When a retention period ends, we securely destroy the data or anonymize it so that it can no longer be linked to you.

Subject to the conditions and exceptions set out in the PDPL, you have the right to: be informed of the legal basis and purpose for collecting your data; access your data and obtain a copy of it in a clear format; request that it be corrected, completed, or updated; request its destruction when it is no longer needed; and withdraw your consent to its processing.

You can withdraw your consent to analytics or marketing at any time through the “Privacy settings” link at the bottom of the website; doing so deletes the identifiers stored in your browser and clears third-party tool cookies. To request deletion of data already collected, or to exercise any of your other rights, please contact us via the Contact page on this website. We may ask for reasonable information to verify your identity before acting on a request, and we will respond within the period prescribed by law.

If you believe that the processing of your data breaches the PDPL, you may lodge a complaint with the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA). We would, however, welcome the opportunity to address your concern first.

The website is intended for businesses and professionals. It is not directed at individuals under 18 years of age, and we do not knowingly collect their personal data.

If you become aware that a minor has provided personal data to us, please let us know via the Contact page on this website so that we can take steps to destroy it.

We may update this Policy to reflect changes in our practices or in legal requirements. The date of the latest update appears at the top of this page. If we make a material change, we will publish a clear notice on the website and seek your consent again where the law requires it.

This Policy is issued in Arabic and English. In the event of any inconsistency between the two versions, the Arabic version prevails.