TRENDالعربية

Privacy policy

This draft describes data processing by [legal entity name]. Each section must match the data, services and providers actually used.

Responsible entity
[Legal entity name and registration details]
Contact
[Approved support channel and contact details]
Last updated
[Approval date for this version]

Responsible entity and contact

Data controller: [official name, address and registration details]. Activities and services: [short description]. Privacy contact and data protection officer, where applicable: [name or role and contact details].

Data categories and sources

List actual categories, whether required or optional, and their sources. Do not include data that is not collected:

  • [Account, contact and profile data]
  • [Survey answers, content and attachments]
  • [Payment references, points and rewards; distinguish platform data from data held by providers]
  • [Actual security, device, connection and cookie data]
  • [Data received from other parties and its sources, if any]

Purposes and legal grounds

For each category, specify the purpose, use, appropriate legal ground and the consequences of not providing it: [category → purpose → ground → required or optional].

Where processing relies on consent, explain how consent is obtained and withdrawn and the effect on the relevant service: [actual process]. Explain significant analytics or automated processing, where applicable: [description and controls].

Sharing and processing locations

Recipients or provider categories, their roles, the data they receive and the purposes of sharing: [approved list]. State what creators and other users can see: [actual scope].

Storage and processing locations, any transfers outside Saudi Arabia and applicable safeguards: [complete after verification]. This draft does not assume that data remains in a particular country.

Retention, security and disposal

Specify retention rules and reasons by category, disposal or anonymization methods, backups and applicable legal obligations: [approved schedule].

Technical and organizational measures actually used to protect data: [appropriate description without sensitive security details]. This draft sets no default retention periods and promises no immediate deletion.

Rights, requests and complaints

Explain applicable rights and how to exercise them, including information, access, obtaining a copy, correction, requesting erasure and withdrawing consent where applicable: [approved channels and procedures].

Explain identity verification, responses or restrictions and their reasons, internal escalation and complaints to the competent authority: [contact details, procedures and reviewed timeframes].

Policy updates

Record the version, date, material changes and notification method: [change record and process]. The displayed document must match the version referenced by consent.