Privacy Policy

Controller and contact details

The controller is Meshaal Sulaiman Alrubaysh Law Firm & Legal Consultancy, Riyadh, Saudi Arabia. For privacy enquiries and rights requests, contact meshaal@alrubayshlaw.com or +966592300010. You may contact us by email or telephone without using the WhatsApp forms.

Data we handle

The contact forms contain your name, optional email address, requested service, a brief description and consent to processing. Appointment requests also contain the selected date and time in Riyadh time and the meeting method: in person, telephone or video. When you message us, we may receive your number, messaging account details and the messages you send. Field labels identify what is required to complete a form. Without those details, the form may not prepare your request, although our other contact channels remain available.

Please provide only a brief initial outline. Do not include identity documents, health, criminal or banking information, passwords, confidential documents or other people's information that is unnecessary for the enquiry. The forms do not support attachments. The client portal is currently unavailable and the website does not accept login credentials.

How the WhatsApp forms work

The forms prepare a message in your browser and open a wa.me link in a new tab. The information you enter is transmitted to WhatsApp in the link URL when it opens, before you press Send, and the URL may appear in your browser history. The firm receives the message only if you choose to send it in WhatsApp. You can review and edit it before sending, but closing the draft does not undo data already transmitted to the service when the link opened.

The form does not submit its contents to a website database, and the website does not use local storage to save them. WhatsApp's handling of data is also subject to its own policies. Preparing or sending a message does not constitute acceptance of an engagement or confirmation of an appointment.

The WhatsApp draft includes your consent statement, privacy policy version and the date and time of consent in Riyadh time. We receive this record if you send the message, and use it to document your choice of contact channel.

Purposes and legal grounds

We process enquiry and appointment details with your consent to receive and answer your request and coordinate contact. If a contractual engagement arises, processing necessary to perform it may rely on our agreement with you or an applicable legal obligation. Technical data needed to operate and protect the website may be processed for legitimate interests after assessment and satisfaction of the applicable legal conditions, without using that ground for sensitive data. We do not use form details for advertising or make decisions affecting you through the website based entirely on automated processing.

Technical data and cookies

The current website includes no site-authored analytics, advertising or cookies. Fonts and images load from the website's own files. Hosting and communications services may process technical information such as IP address, browser and device type, request time and error logs to provide and protect the service. External websites you visit may use tools or cookies under their own policies.

Sharing and international transfers

Access to your request within the firm is limited to those who need to handle it. Communications, email and hosting providers may process data according to the service used, and we may disclose necessary information to a competent authority where legally required. We do not sell your data. When appointing a processor, we undertake to apply the safeguards, agreements and oversight required by law.

External services, including WhatsApp, may involve processing outside Saudi Arabia. Any transfer we carry out must serve a legally permitted purpose, be limited to necessary data and satisfy the protection, safeguard and risk-assessment requirements that apply under Article 29 and the transfer regulation. Choosing WhatsApp or consenting to a form does not release the firm from those requirements or provide unrestricted permission for international transfers.

Retention and destruction

Messages you send are retained in the communications channels used and records needed to follow up your request. Retention depends on the need to respond and follow up, any subsequent engagement, legally required retention periods and any pending judicial case requiring the data. We undertake to destroy data without delay when its purpose ends unless retention is legally required, using methods that prevent recovery or identification.

Data security

We undertake to adopt organizational, administrative and technical measures appropriate to the data and its risks, restrict access and preserve professional confidentiality. This includes handling personal data breaches and notifying the competent authority and affected individuals in the circumstances and within the periods required by law. No electronic channel can be guaranteed free of risk, so please avoid sensitive details in initial enquiries.

Your rights and requests

Subject to the law, you may be informed of processing purposes and legal grounds, access your data, obtain a readable and clear copy, request correction, completion or updating, and request destruction where applicable. Contact us using the email or telephone above to exercise these rights. We may request information necessary to verify your identity without collecting unnecessary data, while respecting other people's rights and legal restrictions.

We act on rights requests without delay and within 30 days. An extension of no more than a further 30 days may apply where implementation requires unexpected or unusual additional effort or you submit multiple requests, with advance notice and reasons. We explain any refusal or restriction permitted by law.

Withdrawing consent

You may withdraw consent at any time by email, telephone or a message in the communications channel used. We stop consent-based processing without undue delay. Withdrawal does not affect the lawfulness of earlier processing or processing based on another legal ground. We may be unable to complete your request if the data is necessary for it. Withdrawal does not automatically undo processing an external provider has carried out for its own purposes under its policy and obligations.

Complaints and policy updates

You may raise a privacy complaint with us and lodge a complaint with the Saudi Data & AI Authority through the National Data Governance Platform's personal data complaint service: https://dgp.sdaia.gov.sa/wps/portal/pdp/services/ReportsComplaints/. The regulation provides a 90-day period from the incident or becoming aware of it, with later acceptance possible for reasons assessed by the competent authority.

We update this policy when processing practices or services change and display the revision date. Any new purpose requiring separate consent will be presented to you before that processing begins.