Legal

Privacy Policy

Last updated: 9 November 2026

This Privacy Policy explains how Navigate Saudi collects, uses, shares and protects personal data when you visit navigatesaudi.com, respond to our advertising, book an advisory session, register for a webinar, or use any of our services in Saudi Arabia. It applies to clients and prospective clients, their family members, the employees of our corporate clients, referral partners and website visitors.

The policy is written to meet three sets of laws: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) for people in the United Kingdom; US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), for people in the United States; and the Saudi Personal Data Protection Law and its Implementing Regulations (PDPL), because we are based in Riyadh. Where a section applies to one jurisdiction only, it says so.

US residents can opt out of targeted advertising at any time through the Do Not Sell or Share My Personal Information link in our website footer. UK visitors can change cookie choices at any time through the Cookie settings link. Our Cookie Policy [CONFIRM: link once the Cookie Policy page is live] lists every cookie and tracking tool we use.

1. Who we are

Navigate Saudi is an advisory firm headquartered in Riyadh that helps international businesses, investors and families with company formation, corporate compliance, real estate and premium residency in the Kingdom of Saudi Arabia. In this policy, “Navigate Saudi”, “we”, “us” and “our” mean the entity below.

Legal entity: Navigate Saudi LLC (شركة نافيغيت سعودي) [CONFIRM: exact registered legal name and legal form]
Commercial Registration: 7050723522 [CONFIRM: older proposals show CR 1010877265 under a different company name; confirm which entity contracts with clients]
Registered address: 8508 King Fahad Road, Olaya, Riyadh 12333, Kingdom of Saudi Arabia
Real estate licence: REGA FAL licence 1200048021
UK presence: 128 City Road, London EC1V 2NX, United Kingdom [CONFIRM: name of UK entity, or UK representative appointed under Article 27 UK GDPR]
ICO registration number: [CONFIRM: ICO registration number]
Privacy contact: advisory@navigatesaudi.com
Phone (Saudi Arabia): +966 53 551 7725
Phone (United States): +1 (234) 900 2526 [CONFIRM: number still active]
Data Protection Officer: [CONFIRM: whether a DPO is appointed under the PDPL, and the name or role to list]

Our role in each jurisdiction

Saudi Arabia: Navigate Saudi is the controller of your personal data under the PDPL.
United Kingdom: Navigate Saudi is the controller under the UK GDPR, which applies because we offer services to people in the UK and monitor how UK visitors use our website and ads. [CONFIRM: if a UK company exists, name it here and state whether it is the controller for UK marketing; if not, name the UK representative.]
United States: Navigate Saudi is the “business” under California law and the “controller” under other US state privacy laws.

When we act for our clients (processor role)

In our corporate compliance and government services work, a client company asks us to manage its employees’ visas, iqamas, payroll submissions and government portal records. For that employee data, the client company is the controller and Navigate Saudi is its processor (a “service provider” under California law). We use that data only on the client’s documented instructions. If you are an employee of one of our clients, please send privacy requests to your employer, and we will help them respond.

2. Summary

This summary is a short overview. The sections that follow give the full detail.

Website and advertising
What we collect: Device and browser data, IP address, cookie and ad identifiers, pages viewed, ad clicks
Why we use it: Run the site, measure visits, measure and target our ads
Who we share it with: Google, Meta, other ad and analytics providers listed in the Cookie Policy
Your choices: UK: cookie banner (off until you opt in). US: Do Not Sell or Share link and Global Privacy Control
Enquiries and advisory sessions
What we collect: Name, email, phone or WhatsApp number, country, service interest, form answers
Why we use it: Reply to you, book sessions, prepare proposals and contracts
Who we share it with: GoHighLevel, Typeform, Zoho, WhatsApp (Meta), DocuSign
Your choices: Provide only what you choose; ask us to delete it
Company formation and compliance
What we collect: Passports, iqama and ID details, addresses, nationality, corporate and ownership documents; for client companies, employee payroll and visa data
Why we use it: Prepare and file licences, registrations, visas, tax returns and portal records
Who we share it with: Saudi government authorities, banks, our partner law firm, auditors
Your choices: Required to deliver the service; you can use the rights in section 12
Real estate
What we collect: Identity documents, nationality, budget, proof of funds, financial details, property requirements
Why we use it: Source and reserve property, coordinate contracts and title transfer, run legal checks
Who we share it with: Developers, brokers, REGA, Ejar and other authorities, our partner law firm
Your choices: Required to deliver the service; you can use the rights in section 12
Premium residency and relocation
What we collect: Passports, photos, family members including children, financial and investment records, health or background documents where authorities require them
Why we use it: Prepare residency, family and relocation applications
Who we share it with: Saudi government authorities, insurers, relocation and school providers
Your choices: Sensitive data is used only with your explicit consent and only for your application
Webinars
What we collect: Name, email, phone, country, payment confirmation
Why we use it: Register you, take payment, send access details
Who we share it with: GoHighLevel and its payment processor (we never see or store your full card number)
Your choices: Opt out of follow-up messages at any time
Marketing
What we collect: Contact details, preferences, how you engage with our messages
Why we use it: Send updates, guides and invitations by email, WhatsApp and phone
Who we share it with: GoHighLevel, Meta (WhatsApp), ad platforms (as hashed lists)
Your choices: Unsubscribe link, reply STOP on WhatsApp, or email us
Referral partners
What we collect: Partner contact, ID and bank details; leads they refer
Why we use it: Register leads and pay commissions
Who we share it with: The partner and the developer or service involved
Your choices: Partners can use the rights in section 12

We do not sell personal data for money. Some advertising cookies count as “sharing” or “targeted advertising” under US state laws, and you can opt out of that at any time (section 7).

3. Information we collect

We collect personal data from three sources: from you, automatically when you use our website and messages, and from third parties involved in your matter.

3.1 Information you give us

Contact and profile details: name, email address, phone and WhatsApp number, country and city of residence, job title, company, and public social media or LinkedIn profile links you share with us.
Identity documents and numbers: passport scans, iqama and national ID details, Saudi national address, photographs, nationality, date of birth and signatures.
Corporate documents: certificates of incorporation, articles of association, audited financial statements, powers of attorney, owner and board resolutions, shareholder and beneficial ownership details, pitch decks, startup briefs, letters of intent and employer no-objection letters.
Financial information: investment budget, proof of funds, bank and investment records, payment and invoice details, and tax information.
Property requirements: property type, purpose, preferred city and district, budget range, payment preference and timing.
Family information: details and documents for your spouse, children and parents where you ask us to include them in a residency or relocation application.
Health, background and religious information, only where an authority requires it: for example medical test results and medical insurance for iqama and residency, background or police certificates where requested [CONFIRM: which background documents are requested in practice], and confirmation of Muslim faith where the law limits property ownership in Makkah and Madinah to Muslim individuals.
Employee data of client companies: names, iqama and passport details, nationality, job titles, salaries, payroll and social insurance (GOSI) data, employment contracts and dependants, provided by the employer.
Government portal access: where a client asks us to act for them, log-in credentials and one-time passcodes for portals such as ZATCA, GOSI, Mudad, Qiwa, Muqeem, customs and the Ministry of Foreign Affairs.
Communications: emails, WhatsApp messages, call and meeting notes, and anything you tell us during an advisory session.
Forms and registrations: answers to our Typeform and GoHighLevel forms, consultation bookings, webinar registrations and payment confirmations.

3.2 Information we collect automatically

IP address, approximate location derived from it, device type, browser, operating system and language.
Pages viewed, time on page, links clicked, the website or ad that referred you, and campaign tags such as UTM parameters and ad click identifiers (for example Google’s gclid and Meta’s fbclid).
Cookie and similar identifiers set by us and by advertising and analytics partners (see section 6 and the Cookie Policy).
Which form, link or QR code you used to reach us, through tracking fields such as “source=linkedin” or “source=website”.
Whether our emails are opened and links clicked, and delivery and read status of WhatsApp messages.

3.3 Information we receive from third parties

Advertising platforms: details you submit in lead forms on Meta (Facebook and Instagram) or Google [CONFIRM: lead forms in use], and reports on how our ads perform.
Referral and affiliate partners: contact details and requirements of people they introduce to us.
Parties involved in your matter: status updates and documents from government authorities, banks, real estate developers, our partner law firm, accelerators that issue recommendation letters, insurers and auditors.
Your employer: if you are an employee of a client company, your employer gives us the data we need to manage your visa, iqama and payroll records.
Public sources: business contact details from public professional profiles such as LinkedIn, and company registers, when we research or contact business prospects.

4. How we use your information

We use personal data only for the purposes below, and only on a lawful basis that each law recognises. Under the UK GDPR, “legal obligation” covers duties under UK law; where we follow a Saudi legal requirement, we rely on our legitimate interest in complying with the laws that govern our business.

4.1 Company formation and market entry: MISA licence, trade name, Commercial Registration, articles of association, national address, chamber membership, government platform registrations, general manager visa and iqama, accelerator recommendation letters, bank account opening and virtual office or registered address [CONFIRM: virtual office offered]
Data used: Identity documents, nationality, addresses, contact details, corporate and ownership documents, beneficial ownership, pitch decks, financial statements
UK GDPR basis: Contract (Art. 6(1)(b)) where you are our client; legitimate interests (Art. 6(1)(f)) where you are a shareholder or manager of a client company
PDPL basis: Performance of an agreement; compliance with Saudi law; legitimate interest
4.2 Corporate compliance and government services: Qiwa, Muqeem, Mudad, GOSI, Ministry of Commerce, Saudi Business Center, Ministry of Foreign Affairs, Saudi Chambers, Ministry of Human Resources and Najiz records; visas, iqamas, exit and re-entry; Nitaqat and Saudization monitoring; payroll and wage protection submissions; VAT, withholding tax, zakat and corporate tax filings with ZATCA; bookkeeping and audit coordination
Data used: Employee identity, iqama and passport details, nationality, job title, salary and payroll, GOSI records, dependants; company financial records; portal credentials
UK GDPR basis: For employee data we act as processor on the client’s instructions (Art. 28); for client contacts, contract and legitimate interests
PDPL basis: As processor, the client’s own basis; for client contacts, performance of an agreement
4.3 Legal guidance through our partner law firm: contract review, memoranda of understanding, trademarks, disputes, and powers of attorney for filings
Data used: Identity details, contracts, dispute and intellectual property details
UK GDPR basis: Contract; legitimate interests; establishing or defending legal claims (Art. 9(2)(f)) for any special category data
PDPL basis: Performance of an agreement; consent where required
4.4 Real estate advisory: understanding requirements, sourcing and verifying property and developers, reservations, sale and purchase agreement coordination, Digital ID and Ministry of Foreign Affairs registration, title deed transfer, commercial leasing and Ejar registration, due diligence, anti-money laundering checks
Data used: Identity documents, nationality, contact details, budget, proof of funds, financial information, property requirements, payment records; confirmation of faith for Makkah and Madinah
UK GDPR basis: Contract; legitimate interests (securing units with developers, legal checks); explicit consent (Art. 9(2)(a)) for religious belief
PDPL basis: Performance of an agreement; compliance with Saudi law; consent for sensitive data
4.5 Premium residency and relocation: eligibility review, Premium Residency applications, family sponsorship and family iqamas, executive housing and compound placement, school placement [CONFIRM: school placement offered] and relocation support
Data used: Passports, photographs, family members including children, financial and investment records, medical and insurance documents, background documents where required
UK GDPR basis: Contract; explicit consent (Art. 9(2)(a)) for health data; consent under Schedule 1, Part 3 of the Data Protection Act 2018 for any criminal record data
PDPL basis: Performance of an agreement; explicit consent for sensitive data
4.6 Webinars: registration, payment, access links and reminders
Data used: Name, email, phone, country, payment confirmation
UK GDPR basis: Contract
PDPL basis: Performance of an agreement
4.7 Consultation bookings and enquiries: replying to enquiries, booking advisory sessions, proposals, contracts and invoices
Data used: Contact details, form answers, service interest, source of enquiry, call notes
UK GDPR basis: Steps at your request before a contract (Art. 6(1)(b)); legitimate interests
PDPL basis: Performance of an agreement; legitimate interest
4.8 Affiliate and partner programmes: registering referred leads, tracking and paying commissions, partner checks
Data used: Partner contact, ID and bank details; contact and requirement details of referred people
UK GDPR basis: Contract with the partner; legitimate interests for referred people
PDPL basis: Performance of an agreement; legitimate interest
4.9 Marketing communications: newsletters, guides, webinar invitations, WhatsApp updates and calls
Data used: Contact details, preferences, engagement with our messages
UK GDPR basis: Consent; or, for existing clients and people who asked about our services, the PECR soft opt-in with an opt-out in every message
PDPL basis: Consent
4.10 Website, analytics and advertising: running the site, measuring visits, measuring and targeting ads, building ad audiences
Data used: Device data, identifiers, browsing activity, hashed email and phone for audience lists
UK GDPR basis: Consent (PECR and Art. 6(1)(a)); strictly necessary cookies need no consent
PDPL basis: Consent
4.11 Running our business: record-keeping, tax and audit, security, fraud prevention, handling complaints and legal claims, responding to authorities
Data used: Any of the above, as needed
UK GDPR basis: Legal obligation; legitimate interests
PDPL basis: Compliance with Saudi law; legitimate interest

Our partner law firm

Legal matters are handled by our partner firm, Al Ajaleen Law & Intellectual Property. When you ask for legal support, or when filings need a power of attorney in favour of lawyers, we share the documents and facts the firm needs. The firm handles that data as an independent controller under its own professional confidentiality duties. [CONFIRM: data sharing terms in place with Al Ajaleen]

Real estate commissions

When you buy or lease property through us, the developer, landlord or seller may pay us a commission or referral fee, and a referral partner who introduced you may receive a share. We share your details with a developer or broker only to progress a property you have asked us to pursue.

5. Sensitive personal data and extra safeguards

Some of our services need data that the law treats as sensitive, or that could cause harm if misused. We collect it only when a Saudi authority, bank or developer requires it for your matter, and we apply stricter controls to it.

What we treat as sensitive

Passport, iqama and national ID numbers and scans
When we collect it: Company formation, visas, real estate, residency
How the law classifies it: Sensitive personal information (California); high-risk data we protect as sensitive (UK, KSA)
Financial records, proof of funds, bank and investment statements
When we collect it: Real estate, residency, company formation
How the law classifies it: Sensitive personal information (California) where account details are included; credit and financial data (KSA)
Health data, such as medical test results and medical insurance
When we collect it: Iqama and residency applications
How the law classifies it: Special category data (UK); sensitive data (KSA); sensitive personal information (California)
Background or police certificates
When we collect it: Only where an authority requests them
How the law classifies it: Criminal offence data (UK); security data, which is sensitive (KSA)
Religious belief
When we collect it: Confirming eligibility to own property in Makkah or Madinah
How the law classifies it: Special category data (UK); sensitive data (KSA); sensitive personal information (California)
Nationality, citizenship and residency status
When we collect it: Most services
How the law classifies it: Sensitive personal information (California)
Children’s and other family members’ data
When we collect it: Family residency, relocation and school placement
How the law classifies it: Data of minors and dependants, given extra protection in all three jurisdictions
Government portal log-in credentials
When we collect it: Compliance services and portal registrations
How the law classifies it: Sensitive personal information (California)

Our extra safeguards

We ask only for the documents the relevant authority, bank or developer requires, and we tell you why each one is needed.
We ask for your explicit consent before collecting health, background or religious information, and you can withdraw it at any time. Withdrawing may mean we cannot complete an application that depends on it.
Sensitive documents are exchanged through [CONFIRM: secure upload method, for example an encrypted client portal or restricted shared drive], not in group chats, and are stored with access limited to the team members working on your file.
Portal credentials and passcodes are used only for the filing you asked for and are not kept after the task ends [CONFIRM: practice].
We never use sensitive data for marketing, never upload it to advertising platforms, and never use it to build ad audiences.
Family members’ and children’s data is collected only from the parent, guardian or main applicant, who confirms they are authorised to share it.
We delete or return sensitive documents when the retention period in section 10 ends.

Under California law, we use sensitive personal information only to provide the services you request and for other purposes the law permits, so the “right to limit” its use does not arise. We do not infer characteristics about you from it.

6. Cookies and tracking

We use cookies, pixels and similar technologies on navigatesaudi.com. Our Cookie Policy lists each one with its provider, purpose and duration.

Strictly necessary: keep the site secure, remember your cookie choices and make forms work. These are always on.
Analytics: show us how visitors use the site so we can improve it.
Advertising: measure our Google and Meta ads, show our ads to people who visited the site, and build audiences for our campaigns.

UK visitors: analytics and advertising cookies stay off until you opt in through our cookie banner. Rejecting them is as easy as accepting them, and you can change your choice at any time through the Cookie settings link in the footer.

US visitors: you can opt out of advertising cookies through the Do Not Sell or Share My Personal Information link, and we treat a Global Privacy Control signal from your browser as an opt-out (section 7).

You can also block or delete cookies in your browser settings. Some parts of the site may not work properly if you block strictly necessary cookies.

7. Advertising and analytics

We advertise on Google and Meta (Facebook and Instagram) to reach people in the United Kingdom and the United States, and we use the tools below to measure and target those ads.

Tools we use

Google Ads conversion tracking and remarketing
Provider: Google
What it does: Records when someone who clicked our ad books a session or registers, and lets us show ads to past visitors
Google Analytics
Provider: Google
What it does: Measures site visits and, when linked to Google Ads, helps build ad audiences [CONFIRM: installed and linked to Google Ads]
Google Tag Manager
Provider: Google
What it does: Loads the other tags; sets no cookies of its own [CONFIRM: installed]
Meta Pixel and Conversions API
Provider: Meta
What it does: Records visits and conversions from our site and sends them to Meta to measure and target ads [CONFIRM: installed]
LinkedIn Insight Tag
Provider: LinkedIn
What it does: Measures LinkedIn ad performance and builds retargeting audiences [CONFIRM: installed; delete this item if not]

How we use them

Retargeting: showing our ads to people who visited our site or engaged with our content.
Custom audiences and Customer Match: uploading lists of email addresses or phone numbers to Google or Meta so they can show our ads to matching users or leave existing clients out of campaigns. We convert the details into a hashed (scrambled) code on our side before upload, and the platforms use them only for matching. We only upload people who have not opted out, and never sensitive data.
Lookalike audiences: asking a platform to find new people with similar characteristics to an audience list. The platform does this analysis; we do not receive data about those people.
Lead forms: if you submit a lead form inside a Meta or Google ad, the platform passes your answers to us.
Conversions API: our systems send event data, such as a webinar registration together with a hashed email or phone number, directly to Meta, so that ad results are measured accurately.

The platforms also use this data under their own privacy policies, including to improve their advertising services. See Google’s privacy policy and Meta’s privacy policy.

United Kingdom

Under PECR, we must have your consent before setting non-essential cookies. Advertising and analytics tags load only after you opt in. UK law exempts some analytics used purely to improve a website from the consent requirement. Our analytics is linked to our advertising, so we do not rely on that exemption: analytics also stays off until you consent. [CONFIRM: Google Consent Mode v2 configured so tags respect the banner choice]

United States

We do not sell personal data for money. However, letting advertising partners collect identifiers and browsing data on our site for cross-context behavioural advertising is “sharing” under California law, and “targeted advertising” (and in some states possibly a “sale”) under other state privacy laws. You can opt out at any time by:

clicking Do Not Sell or Share My Personal Information in our website footer;
enabling a Global Privacy Control (GPC) signal in your browser, which we honour as an opt-out for that browser and, if we know who you are, for your account; or
emailing advisory@navigatesaudi.com with the subject “Opt out”.

When you opt out, we stop advertising tags on your browser and remove you from any audience lists we upload. Our site does not respond to “Do Not Track” browser signals, because there is no common standard for them, but we do honour GPC.

We do not use advertising to profile people for decisions with legal or similarly significant effects, and we do not target ads based on sensitive data.

8. Who we share your information with

We share personal data only where it is needed for the purposes in section 4, and we share the minimum each recipient needs.

Saudi government authorities
Examples: Ministry of Investment (MISA), Ministry of Commerce and Saudi Business Center, ZATCA, Qiwa and the Ministry of Human Resources and Social Development, Muqeem and the General Directorate of Passports (Jawazat), Mudad, GOSI, Ministry of Foreign Affairs, Saudi Chambers, Najiz and the Ministry of Justice, REGA, Ejar, the national address service, and the Premium Residency Center [CONFIRM: authorities to list]
Why: To file the applications, registrations and returns you or your employer asked us to handle, and when the law requires disclosure
Banks
Examples: Saudi banks where you or your company open accounts
Why: Account opening and know-your-customer checks
Partner law firm
Examples: Al Ajaleen Law & Intellectual Property
Why: Legal advice, powers of attorney, filings and disputes
Auditors and accounting partners
Examples: External auditors appointed for a client company [CONFIRM: any accounting partner firms to name]
Why: Audits and financial statement filings
Accelerators
Examples: MISA-accredited accelerators and incubators
Why: Recommendation letters for Entrepreneur licence applications
Delivery partners
Examples: INTERMAX Consultancy for ISO certification work [CONFIRM: name in policy or keep generic]
Why: Delivering a service you engaged us for
Real estate developers, brokers and landlords
Examples: Developers we work with, such as Al Majdiah, Dar Global, First Projects, Retal, Zood, Osus, Aleen and Aidan, and brokers and listing platforms [CONFIRM: developers and platforms to name]
Why: Checking availability, reserving units, contracts, handover and leases
Referral and affiliate partners
Examples: Real estate collaboration partners and market partners who introduced you
Why: Coordinating your matter and calculating commissions
Relocation providers
Examples: Medical insurers, medical centres, schools, compounds and serviced residences [CONFIRM: providers used]
Why: Residency, insurance, housing and school applications you ask for
Technology service providers (processors)
Examples: GoHighLevel (CRM, email, calendars, payments), Typeform (forms), Zoho (bookings), Meta (WhatsApp Business API), DocuSign (contract signing), Framer (website hosting), Google Workspace (files and email) [CONFIRM: full vendor list]
Why: Running our systems, under contracts that limit their use of the data
Payment processor
Examples: [CONFIRM: payment processor connected to GoHighLevel]
Why: Taking webinar and service payments; we never see or store full card numbers
Advertising and analytics platforms
Examples: Google, Meta, LinkedIn [CONFIRM]
Why: Measuring and targeting our ads (section 7)
Our team and affiliates
Examples: Navigate Saudi staff in Riyadh, our team in Bangalore, India, and any Navigate Saudi entity in the UK or France [CONFIRM: entities and which staff can access client files]
Why: Delivering services and running the business
Professional advisers and insurers
Examples: Lawyers, accountants, auditors and insurers of Navigate Saudi
Why: Advice, audits, insurance and legal claims
Buyers of our business
Examples: A purchaser or successor in a merger or sale
Why: Continuing the services, under this policy
Authorities and courts
Examples: Regulators, law enforcement and courts
Why: When the law requires it, or to protect rights and safety

No sale of data

We do not sell personal data for money, and we do not let any recipient use client documents for its own marketing. The only “sharing” or “sale” under US state laws is the advertising activity in section 7, which you can opt out of.

9. International transfers

We are based in Saudi Arabia and serve clients worldwide, so your data moves between countries. It is held and accessed mainly in Saudi Arabia, the United Kingdom and India (where part of our team works), and by service providers in the United States, the European Union and other countries [CONFIRM: France, if the French market team accesses client data].

Transfers out of the UK

Where we send UK personal data to a country without UK adequacy regulations, we use one of these safeguards:

the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses;
for certified US companies, the UK Extension to the EU-US Data Privacy Framework; or
where no safeguard is available, a legal exception, such as a transfer needed to perform a contract with you.

Saudi Arabia and India do not have UK adequacy regulations, so transfers to our teams there are covered by an IDTA or the UK Addendum [CONFIRM: agreements signed].

Transfers out of Saudi Arabia

Under the PDPL and its transfer regulation, we transfer personal data outside the Kingdom only where:

the destination provides adequate protection as determined by the Saudi Data and AI Authority (SDAIA); or
we use appropriate safeguards, such as SDAIA’s standard contractual clauses, binding common rules or certification; or
an exception applies, such as a transfer needed to perform an agreement with you.

Where the regulation requires it, we carry out a risk assessment before the transfer, and we transfer only the minimum data needed.

You can ask for a copy of the safeguards we use by contacting us (section 18).

10. How long we keep your information

We keep personal data only as long as we need it for the purposes in section 4, including meeting legal, tax, anti-money laundering and government filing duties. When the period ends, we delete or anonymise the data, or return it to the client.

Enquiries and leads that do not become clients
Retention period: [CONFIRM: 24 months] after our last contact
Reason: Following up on your enquiry
Marketing contacts
Retention period: Until you unsubscribe or withdraw consent; we keep a minimal suppression record so we do not contact you again
Reason: Respecting your opt-out
Webinar registrations
Retention period: [CONFIRM: 24 months] after the webinar; payment records as for client files
Reason: Access, support and tax records
Client files (company formation, compliance, real estate, residency)
Retention period: For the engagement, then [CONFIRM: 10 years]
Reason: Saudi commercial record-keeping duties and legal claims
Identity and anti-money laundering records
Retention period: [CONFIRM: 10 years] after the relationship or transaction ends
Reason: Saudi anti-money laundering law
Invoices and tax records
Retention period: [CONFIRM: at least 6 years, longer for real estate transactions, per ZATCA rules]
Reason: Saudi tax law
Health, background and religious documents
Retention period: Until the application is decided, then [CONFIRM: 90 days] unless an authority requires longer
Reason: Completing your application
Family and children’s data
Retention period: As for the residency file it belongs to
Reason: Completing your application
Client employee data (processor role)
Retention period: For the term of the client’s service agreement, then returned or deleted on the client’s instruction, unless the law requires us to keep it
Reason: Client’s instructions
Government portal credentials
Retention period: Until the task is complete [CONFIRM]
Reason: Completing the filing
Referral partner records
Retention period: For the agreement, plus the 12-month tail period, then as for tax records
Reason: Paying commissions
Communications (email, WhatsApp, call notes)
Retention period: [CONFIRM: period]
Reason: Service records and disputes
Ad audience lists (Customer Match, custom audiences)
Retention period: Refreshed every [CONFIRM: period]; people who opt out are removed at the next refresh
Reason: Advertising
Analytics data
Retention period: [CONFIRM: 14 months, set in Google Analytics]
Reason: Measuring site use
Cookies
Retention period: See the Cookie Policy
Reason: As listed for each cookie
Records of privacy requests
Retention period: 24 months
Reason: Showing we handled requests properly

11. Security

We protect personal data with technical and organisational measures suited to its sensitivity, including:

encryption of data in transit, and at rest where our systems support it;
access limited to staff who need it for your file, with multi-factor authentication on our core systems [CONFIRM];
confidentiality agreements with staff, contractors and partners;
written data processing terms with our service providers;
secure handling of identity documents and portal credentials (section 5); and
a process for investigating and reporting security incidents.

If a breach is likely to put your rights at risk, we will notify the UK Information Commissioner’s Office within 72 hours where the UK GDPR requires it, notify SDAIA within the time the PDPL requires, notify affected people where required, and meet US state breach notification laws.

No system is completely secure. Please send documents only through the channels we give you, and tell us at once if you think your data has been exposed.

12. Your rights

Your rights depend on where you live. Section 13 explains how to use them.

12.1 United Kingdom

Under the UK GDPR you have the right to:

access your personal data and receive a copy;
rectify inaccurate or incomplete data;
erase your data in certain circumstances;
restrict how we use your data in certain circumstances;
data portability, to receive data you gave us in a machine-readable format or have it sent to another organisation;
object to processing based on legitimate interests, and to object at any time to direct marketing;
withdraw consent at any time, without affecting processing that took place before; and
not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make none, see section 15).

You can complain to us first and we will acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

12.2 United States

Depending on your state of residence, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws, you have the right to:

know and access the personal information we hold about you, including the categories and specific pieces;
delete personal information we collected from you;
correct inaccurate personal information;
portability, to receive your data in a portable format;
opt out of the sale or sharing of personal information and of targeted advertising (section 7);
opt out of profiling for decisions with legal or similarly significant effects (we do not carry out such profiling);
appeal if we refuse your request (section 13); and
not be discriminated against for using these rights. We will not deny services, charge different prices or give a lower quality of service because you exercised a right.

12.3 California disclosures

In the past 12 months we collected the categories of personal information below. Sources are described in section 3, purposes in section 4, the recipients we disclose to for business purposes in section 8, and retention periods in section 10.

Identifiers
Examples: Name, email, phone, IP address, cookie and advertising IDs, passport and ID numbers
Sold or shared in the last 12 months: Yes, online identifiers shared with advertising partners; ID numbers never
Customer records (Cal. Civ. Code 1798.80(e))
Examples: Signature, address, bank and financial details, passport number
Sold or shared in the last 12 months: No
Characteristics of protected classifications
Examples: Age, nationality and citizenship, marital status, sex, religion where needed for Makkah and Madinah property
Sold or shared in the last 12 months: No
Commercial information
Examples: Services enquired about or bought, webinar purchases, property requirements
Sold or shared in the last 12 months: Yes, conversion events shared with advertising partners
Internet or other electronic network activity
Examples: Pages viewed, clicks, ad interactions
Sold or shared in the last 12 months: Yes, with advertising partners
Geolocation data
Examples: Approximate location from IP address only
Sold or shared in the last 12 months: Yes, as part of IP address data
Sensory data
Examples: Photographs for applications [CONFIRM: whether calls are recorded]
Sold or shared in the last 12 months: No
Professional or employment information
Examples: Job title, employer, salary and payroll details (as processor for client companies)
Sold or shared in the last 12 months: No
Education information
Examples: Children’s school details for school placement [CONFIRM]
Sold or shared in the last 12 months: No
Inferences
Examples: Lead qualification notes, service interests
Sold or shared in the last 12 months: No
Sensitive personal information
Examples: Passport, iqama and ID numbers; financial account details; citizenship and residency status; health data; religious belief; portal log-in credentials
Sold or shared in the last 12 months: No

We do not collect biometric information. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

12.4 Saudi Arabia

Under the PDPL you have the right to:

be informed about how and why your data is collected and used, which this policy does;
access your personal data held by us;
obtain a copy of your data in a clear and readable format;
correct, complete or update your data;
request destruction of your data when it is no longer needed, unless the law requires us to keep it; and
withdraw consent at any time where we rely on consent.

You can complain to the Saudi Data and AI Authority (SDAIA) through its official channels at sdaia.gov.sa.

13. How to exercise your rights

Where to send a request

Email advisory@navigatesaudi.com with the subject “Privacy request”.
Use our online request form at [CONFIRM: form URL].
Call +1 (234) 900 2526 (United States) [CONFIRM: number, or a toll-free number if required] or +966 53 551 7725 (Saudi Arabia).
To opt out of targeted advertising, use the Do Not Sell or Share My Personal Information link or a Global Privacy Control signal. To change cookie choices, use Cookie settings.
To stop marketing messages, use the unsubscribe link in any email or reply STOP to any WhatsApp message.

Please tell us which right you want to use and which country or US state you live in. If you are an employee of one of our corporate clients, please send your request to your employer (section 1).

Verifying your identity

To protect your data, we confirm your identity before acting on a request to access, correct or delete it. We will usually ask you to confirm details we already hold, such as your email address and phone number. For requests involving identity documents or financial records, we may ask for more. We use the information you give for verification only for that purpose. Opt-out requests do not need verification.

Authorised agents

You can ask someone else to make a request for you. We will ask the agent for your signed permission or a valid power of attorney, and we may ask you to confirm your identity directly with us.

Response times

United Kingdom: within one month; up to two further months for complex or numerous requests, and we will tell you if we need the extension.
California: we acknowledge within 10 business days and respond within 45 calendar days, extendable once by a further 45 days with notice. Opt-outs are actioned within 15 business days.
Other US states: within 45 days, extendable once by a further 45 days with notice.
Saudi Arabia: within 30 days, extendable only where the PDPL Implementing Regulations allow, with notice to you.

We respond without charge. Where a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why.

Appeals (United States)

If we decline your request, you can appeal by replying to our decision with the subject “Appeal” within [CONFIRM: 60 days]. Someone not involved in the original decision will review it and reply within the time your state’s law sets, usually 45 to 60 days. If your appeal is denied, we will tell you how to contact your state Attorney General.

Complaints

In the UK you can complain to the ICO, and in Saudi Arabia to SDAIA (section 12). We would welcome the chance to resolve your concern first.

14. Children

Our website and services are not directed at children, and we do not knowingly collect personal data directly from anyone under 18. We process children’s data only as dependants in a residency, relocation or school placement file, and only when a parent or legal guardian provides it. We never use children’s data for marketing or advertising. If we learn that we have collected a child’s data in any other way, we will delete it.

15. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our team reviews every application, proposal and engagement. Advertising platforms use automated profiling to decide which ads to show; you can opt out of this as explained in section 7. Saudi authorities may use their own automated systems to process applications, which is outside our control.

16. Third-party links and platforms

Our website and messages link to other sites and platforms, such as LinkedIn, Instagram, Facebook, YouTube, TikTok, Trustpilot [CONFIRM: Trustpilot profile exists], real estate developers’ websites, government portals and our partners’ sites. These have their own privacy policies, and we are not responsible for how they handle your data. Embedded content, such as videos, may set its own cookies, which our cookie banner controls where possible.

17. Changes to this policy

We will update this policy when our services, tools or legal duties change. The “Last updated” date at the top shows the latest version. If we make a material change, we will tell you by email or by a notice on our website before it takes effect.

18. Contact us

Company: Navigate Saudi, Commercial Registration 7050723522
Riyadh address: 8508 King Fahad Road, Olaya, Riyadh 12333, Kingdom of Saudi Arabia
UK address: 128 City Road, London EC1V 2NX, United Kingdom [CONFIRM: UK entity or representative name]
Email: advisory@navigatesaudi.com
Phone: +966 53 551 7725 (Saudi Arabia), +1 (234) 900 2526 (United States)
Data Protection Officer: [CONFIRM: name or role, if appointed]

Regulators

UK: Information Commissioner’s Office, ico.org.uk, 0303 123 1113
Saudi Arabia: Saudi Data and AI Authority (SDAIA), sdaia.gov.sa
United States: your state Attorney General, or for California, the California Privacy Protection Agency at cppa.ca.gov