Privacy Policy | Gulf Entries

1. Who controls your data

For data collected directly through this public website, the controller is GULF ENTRIES COMPANY LIMITED (Gulf Entries), 3680 Abdullah Al Hadhli Street, Jeddah 23826, Kingdom of Saudi Arabia. Privacy requests and notices may be sent to support@gulfentries.com. We will use reasonable measures to verify a requester before releasing, correcting or deleting personal data. If a written proposal or contract identifies another Gulf Entries legal entity as controller for an engagement, that document governs that engagement-specific processing.

2. Personal data we collect

Project Planner data: name, company or organization, work email, phone number, selected project outcome, requested disciplines, project stage, technical environment, scale, constraints or notes, requested timeline, support preference, language and consent record. The planner marks the fields required to submit; currently the project selections, name, email and request-processing acknowledgment are required, while company, phone, scale and free-form notes are optional.
Contact requests: name, company or organization, work email, phone number, message, language and consent record. Name, email, message and the request-processing acknowledgment are required to submit the contact form; company and phone are optional.
First-party usage data: a randomly generated browser session identifier, page path, viewed section, interaction label, language, referring site origin/path and browser user-agent. We do not intentionally place advertising trackers on the public website.
Technical and security data: the web service may transiently process network and request information, including an IP address where available, to operate the service, prevent abuse and apply rate limits. The first-party analytics table does not intentionally store an IP address.
Language and draft preferences stored on your device as described below.

3. How we collect data

We collect data when you provide it through forms, when your browser sends ordinary technical requests to the website, and through the first-party analytics described in this policy. We do not ask you to submit passwords, access credentials or other secret information through the Project Planner or contact form.

4. Why we process data and the legal basis

To receive, review and respond to an enquiry, Project Planner brief or request you submit.
To scope potential services, prepare follow-up communications and administer a resulting business relationship.
To keep the website reliable, secure and protected from misuse, duplicate submissions and excessive traffic.
To understand aggregate website usage and improve content, navigation and service design through first-party analytics.
To comply with applicable legal, regulatory, accounting, dispute-resolution or record-keeping obligations.
Depending on the processing activity, the legal basis may include your consent where required, processing necessary to respond to a request you initiate, compliance with a legal obligation, and other grounds permitted by the PDPL, including legitimate interests where the statutory conditions for relying on them are satisfied.
If you do not provide information marked as required, we cannot receive or meaningfully respond to the relevant website request. Leaving an optional field blank does not prevent submission, although it may limit the detail available to us for follow-up.

5. Cookies, local storage and analytics

A language preference cookie named ge-lang may be stored for up to one year so the site can reopen in your chosen language.
The browser may also store the language preference under gulfentries-language-v6.
The Project Planner may save non-contact project selections on your device for up to seven days. The saved draft excludes your name, company, email, phone number, free-form project notes and consent value.
A first-party analytics session identifier may be stored under ge-analytics-session-v1. If your browser reports Do Not Track as enabled, the website does not send these first-party analytics events.
You can clear cookies or local storage through your browser. Doing so may reset language, draft or analytics-session preferences.

6. Who may receive personal data

Access is limited to authorized Gulf Entries personnel and, where necessary, relevant Gulf Entries affiliates or subsidiaries involved in responding to or delivering the requested work. We may also use contracted infrastructure, hosting, database, email/SMTP, security or other service providers acting for operational purposes. The website may send a stored enquiry through the SMTP service configured by Gulf Entries. We do not sell personal data.

We may disclose data where required by Saudi law, a competent authority, court order or to establish, exercise or defend legal rights.
A service provider receives only the data reasonably needed for its function and is expected to handle it under applicable contractual and legal requirements.

7. Processing or transfers outside Saudi Arabia

Hosting, email or other approved service providers may in some deployments process data outside the Kingdom. Where a transfer or disclosure outside Saudi Arabia occurs, Gulf Entries will apply the requirements of the PDPL, its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom, including applicable transfer purposes, safeguards and protection requirements.

8. Retention and destruction

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and as permitted or required by applicable law. The retention criteria include the time needed to respond to and administer an enquiry, scope or perform a resulting engagement, maintain appropriate business and contractual records, resolve disputes, protect legal rights and meet regulatory, tax, accounting or other record-keeping duties. When data is no longer needed and no lawful reason requires continued retention, it is deleted, destroyed or anonymized using methods appropriate to the data and system involved. Device-stored Project Planner drafts expire after seven days as described above.

9. Security

We use administrative and technical measures designed to protect personal data against unauthorized access, loss, misuse or alteration. Current controls include input validation, request-size limits, rate limiting, same-origin protection for private administrative mutations, authenticated support access, network-isolated PostgreSQL, encrypted storage for saved SMTP credentials and private operational access by default. No internet service can guarantee absolute security.

10. Your rights under the PDPL

The right to be informed of the legal basis and purpose for collecting your personal data.
The right to access personal data held about you, subject to applicable statutory limits.
The right to request a readable and clear copy of your personal data in the circumstances provided by law.
The right to request correction, completion or updating of inaccurate personal data.
The right to request destruction of personal data when the legal conditions are met, subject to lawful retention requirements.
Where processing depends on consent, the right to withdraw consent in accordance with applicable law, without affecting processing already lawfully carried out before withdrawal.

11. Exercising rights, questions and complaints

Send a request to support@gulfentries.com and describe the data or request involved. We may request information reasonably necessary to verify identity and protect your data from unauthorized disclosure. We will handle requests within the periods and subject to the exceptions provided by applicable Saudi law. If you believe your personal data has been handled contrary to the PDPL, you may also use the complaint channels made available by the competent Saudi data-protection authority.

12. Children

This business website is not designed to collect personal data from children. If you believe a child has submitted personal data without appropriate authorization, contact us so the matter can be reviewed.

13. External links and third-party marks

The site may refer or link to external websites and may display third-party marks. Their websites and services have their own privacy practices. This policy applies to personal data processed by Gulf Entries through this website and does not replace a third party’s privacy notice.

14. Updates and language

We may update this policy to reflect changes in law, services or processing. The current version and update date will be published on this page. Arabic and English versions are provided for convenience and accessibility; if an interpretation differs, the Arabic version prevails to the extent permitted by applicable law.