Saudi Personal Data Protection Law (PDPL) Notice

1. Controller Identity

Etlaq operates the Etlaq Platform from Dhahran, Kingdom of Saudi Arabia. Privacy requests may be sent to studio@etlaq.sa.

2. PDPL Principles We Apply

• Purpose limitation: we define why personal data is collected before processing it.
• Data minimization: we collect only what is reasonably needed to provide, secure, bill, support, and improve the service.
• Transparency: we disclose categories, purposes, recipients, transfers, retention, rights, and complaint channels in our legal pages.
• Accuracy: we allow users to request correction or completion of inaccurate account data.
• Storage limitation: we retain data only as long as needed for service, legal, security, accounting, dispute, and recovery purposes.
• Security: we use technical and organizational safeguards appropriate to the nature of the data and the service.
• Accountability: we review vendors, access, logging, and privacy-impact areas as the platform evolves.

3. Collection and Notice

Before or at collection, we aim to make clear what data is collected, why it is collected, whether it is required, who may receive it, how long it is retained, whether it may be transferred outside Saudi Arabia, and how rights can be exercised.

4. Lawful Use and Consent

We rely on the appropriate lawful basis for each processing activity, such as providing the service you request, performing a contract, meeting legal obligations, protecting security, serving legitimate operational interests where allowed, or obtaining consent where consent is required.

Where processing is based on consent, such as optional analytics cookies, you may withdraw that consent without affecting processing that occurred before withdrawal.

5. Data Subject Rights

Subject to legal limits and identity verification, you may request:

• Information about how your personal data is processed.
• Access to your personal data.
• A copy of your personal data in a readable format where technically feasible.
• Correction, completion, or updating of inaccurate personal data.
• Destruction of personal data that is no longer needed or that must be deleted under applicable law.
• Withdrawal of consent where processing is based on consent.

6. Rights Request Workflow

• Send your request to studio@etlaq.sa from the email or phone number connected to your account where possible.
• We may request information to verify identity and protect against unauthorized disclosure.
• We will evaluate the request under the PDPL and respond within the period required by applicable law.
• If we cannot fulfill a request fully, we will explain the reason where legally permitted.

7. Transfers Outside Saudi Arabia

Some services needed to operate Etlaq may be provided from outside Saudi Arabia. We use cross-border processing only when needed for service delivery, support, security, payment, analytics with consent, deployment, AI processing, or legal compliance, and we apply safeguards intended to satisfy PDPL transfer requirements.

8. Processor and Vendor Oversight

We use vendors for payment processing, analytics, infrastructure, storage, deployment, communications, AI model processing, monitoring, and support. We select vendors based on service need and require appropriate confidentiality, security, and data-protection commitments where applicable.

9. Breach Handling

If we become aware of a personal data incident, we investigate, contain, assess risk, and take remedial steps. Where the PDPL or other applicable law requires notification to the competent authority or affected individuals, we will provide notification in accordance with legal requirements.

10. Complaints

You may contact us at studio@etlaq.sa with any PDPL concern. If you are not satisfied with our response, you may submit a complaint to the competent Saudi data protection authority, currently the Saudi Data & AI Authority (SDAIA), or any successor authority designated under the PDPL.