Privacy
Privacy Policy
PACTIS Legal is committed to protecting your personal data and processing it in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations. This policy explains how we handle personal data connected with this public website.
Last updated: 13 June 2026
Data controller
The data controller is PACTIS Legal, a licensed professional legal company (شركة مهنية) based in Riyadh, Kingdom of Saudi Arabia. For any privacy enquiry, or to exercise your rights, contact us at info@pactis.legal.
What this policy covers
This policy covers personal data processed through this public, informational website — principally the consultation-request form and the careers application form, together with limited technical data created when you visit. It does not cover our separate, access-controlled client systems, which are governed by their own terms agreed directly with clients.
Consultation form — current status
Submission through the consultation form is not yet active, pending completion of a Data Protection Impact Assessment (DPIA). At present no enquiry data is transmitted or stored through the form. The terms in this policy govern that processing once the form is activated, and this notice will be updated at that time.
Personal data we process
We collect only what you provide or what is technically necessary. (1) Consultation enquiries (once active): your name, email, phone (optional), organisation, area of need, and message. (2) Careers applications: the details you complete and email to us — including name, contact details, professional status and licence, years of experience, languages, your written statements, your professional-profile link, and any CV you attach. The careers form opens your own email application, so we receive only what you choose to send. (3) Technical data: when you visit, our hosting and security provider processes limited connection data such as IP address and request logs to deliver and protect the site.
Purposes and legal basis
We process consultation enquiries to respond and arrange a consultation, on the basis of your consent. We process careers applications to assess your candidacy and take steps at your request prior to any possible engagement, on the basis of your consent and our legitimate interest in recruitment. We process limited technical data to deliver, secure, and maintain the website, on the basis of our legitimate interest and any applicable legal obligation. We do not process your data for advertising or behavioural profiling.
Cookies and technical data
This website does not use advertising or cross-site tracking cookies. It is delivered through a content-delivery and security network (Cloudflare), which may process limited technical connection data (such as IP address and request logs) to serve and protect the site. If the consultation form is activated, an anti-abuse check (Cloudflare Turnstile) may run to prevent automated misuse.
Data minimisation
We ask for no more than is necessary for the stated purpose. We do not request sensitive personal data, except where you choose to include it within an application. We collect data with your consent and do not use it for marketing or profiling.
Retention
We retain enquiry data only for as long as needed to handle and respond to your enquiry — up to twenty-four months unless an ongoing relationship requires otherwise. We retain careers applications for the duration of the assessment and, where you consent, for future opportunities for up to twenty-four months. After these periods, data is deleted or anonymised. Technical logs are kept only for the short periods applied by our provider.
Recipients, processors and transfers
We apply the principle of data minimisation. We do not sell your data or share it for commercial purposes. We keep the personal data we hold within the Kingdom; the public website is delivered through a global network (Cloudflare) that processes technical connection data but does not store the personal data you submit to us. If any processor or cross-border transfer is later used, it will comply with the PDPL transfer rules and be disclosed in this policy.
Your rights under the PDPL
Subject to the PDPL, you have the right to be informed of how your data is processed, to access it, to obtain a copy of it, to request its correction, to request its destruction, and to withdraw your consent at any time — without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA). To exercise any right, email info@pactis.legal; we respond within the period required by the PDPL and its Implementing Regulations.
Automated decision-making
We do not carry out automated decision-making or profiling that produces a legal or similarly significant effect on you based on your data.
Children
This website and our services are directed to professional and business users, not to children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
Data security
We apply appropriate organisational and technical measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, consistent with the limited processing this website involves and the in-Kingdom storage of the data we hold.
Changes to this policy
We may update this policy to reflect changes in our practices or the law. The "last updated" date above shows the current version, and any material change will be reflected here. Your continued use of the site after an update constitutes acknowledgement of the revised policy.
How to contact us
For any question about this policy, or to exercise your data-protection rights, email us at info@pactis.legal