Legal

Privacy policy

What we collect, why, where it is held, and what you can ask us for.

Draft

This document is a draft, not a document in force

What you are reading is a structure written from what is actually known about this website, pending review by Saudi counsel. Every passage that needs a legal judgement is marked as such. Do not rely on this page as a binding document; it may change entirely.

Last revised: 9 September 2026

The controller

The party responsible for processing your personal data through this website is:

Full legal name: [xxx]
Commercial registration: [xxx]
National address: [xxx]
Controller registration with the Saudi Data and AI Authority: [xxx]
Data protection officer: privacy@fkah.sa

What this policy covers

How this policy relates to any future customer agreement, and which prevails if they conflict: [TODO — counsel]

What we collect

We collect what you type, and the technical data a visit produces on its own. We buy no data from third parties.

Waitlist form: Company name, commercial registration number, work email, mobile number, your role, and a rough band for your monthly B2B invoicing, along with which side of a trade you are on.
Contact form: Name, company, email, mobile number, what the enquiry is about, and the text of your message.
Complaint form: Name, company, commercial registration number, email, mobile number, the category of complaint, and the details as you write them.
Consent record: The wording you agreed to, the date, and which form it came from.
Technical data: IP address, browser and device type, the page you arrived from, and the time of the visit.
Cost estimator: The numbers you enter are calculated in your browser and are not sent to us as you change them. If you send a form with the estimator's context attached, we receive the values that were on screen.

What we never ask for

No form asks for a bank account number, a card number, an identity document, or any sensitive data. Please do not send them to us.

Why we process it

To answer your message or request.
To tell you when the service is available, if you explicitly agreed to that.
To receive, handle and follow up complaints.
To measure and improve the website in aggregate.
To stop abuse of the forms and automated submissions.
To meet our legal obligations and keep the records they require.

We use your data for nothing else. Any further purpose needs its own lawful basis and prior notice: [TODO — counsel]

Lawful basis

Where we stand today: marketing contact rests on your explicit consent, which you may withdraw at any time. Withdrawal does not affect processing carried out before it.

Handling complaints and keeping their records rests on our legal obligations.

Technical data and form protection rest on a legitimate interest in running the site safely.

The precise lawful basis for each purpose under the Personal Data Protection Law and its Implementing Regulation: [TODO — counsel]

Who processes data on our behalf

We do not sell your data and do not share it with advertisers. We use service providers to run the site, and this is the list as it stands today:

Neon: The managed database that form submissions are written to today. Its regions are outside Saudi Arabia. See the transfers section below.
Cloudflare: Content delivery, and checking that the sender of a form is a person rather than a script.
Hosting provider: [TODO]
Email provider: [TODO]
Analytics: Anonymous visit measurement. Provider and configuration: [TODO]

The complete processor list, the processing agreements with them, and their data protection obligations: [TODO — counsel]

Transfers outside the Kingdom

We state this plainly because it is a real gap, not a settled position.

The requirement we build to: customer and financial data is stored and processed inside the Kingdom, including its backups and its disaster-recovery environment.

Where we are today: submissions from this site's forms are written to a Neon database in Frankfurt, Germany. That is a transfer of data outside the Kingdom.

Before any financing product launches: this data moves to in-Kingdom infrastructure, is deleted from the external store, and the move is documented.

The lawful basis for this transfer at the present stage, the safeguards required, and whether an impact assessment or prior approval is needed: [TODO — counsel]

Your rights

Under the Personal Data Protection Law, you may ask:

To know how your data is processed and why.
To access the data we hold about you.
To receive a copy of it in a readable format.
To correct anything wrong, incomplete or out of date.
To have your data destroyed once it is no longer needed for the purpose it was collected for.
To withdraw your consent to marketing contact at any time.
To complain to the competent data protection authority if our answer does not satisfy you.

To exercise any of these: privacy@fkah.sa. The statutory response deadline and how we verify a requester's identity: [TODO — counsel]

How long we keep it

We keep data for as long as the purpose requires, then destroy it. The exact periods are to be settled with counsel:

Waitlist submissions: [TODO — counsel]
Contact messages: [TODO — counsel]
Complaint records: [TODO — counsel]
Marketing consent records: [TODO — counsel]
Technical logs: [TODO — counsel]

Data security

We publish our security controls in their real state: what is live today, and what is planned and not yet built.

We claim no certificate, audit or penetration test that has not happened.

The detail is on the security page under Trust.

Data about minors

This site is aimed at businesses and the people who represent them. We do not knowingly collect data from anyone under the age of majority.

What the Personal Data Protection Law requires in respect of minors and people lacking capacity, and what that means for our forms: [TODO — counsel]

Changes to this policy

We update this page when what we collect, where it is held, or who processes it changes.

The date of the last revision is at the top. Where a change materially affects the basis of your consent, we tell you directly before it takes effect.

Contact

For any question or request about your data: privacy@fkah.sa

To make a formal complaint with a deadline and a reference number, use the complaints page.