Al-Itqan International Consulting Company respects the privacy of its website visitors and service users.

The Company processes personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations, in a manner that ensures lawfulness, transparency, and data minimisation. This Policy explains the types of data we may collect, how we collect it, the purposes for which it is processed, the parties to whom it may be disclosed, retention periods, protection and disposal controls, and how data subjects may exercise their rights.

Important notice: This Policy does not constitute general or unlimited consent to all processing activities. Where consent is legally required, the Company will request clear, specific, and separate consent for each purpose and will allow it to be withdrawn in accordance with applicable law.

This Policy applies to the main website of Al-Itqan International Consulting Company, contact and quotation-request forms, newsletter subscriptions, and any digital service that expressly states that it is subject to this Policy.

The website may contain links to other platforms or websites, such as Al-Itqan International Training Center, the Al-Itqan System online portal, the customer services platform, or third-party websites. Those platforms are governed by their own published privacy policies unless they expressly state that this Policy applies.

• Directly from the data subject when completing the “Contact Us” form, requesting a quotation, subscribing to the newsletter, or creating an account for a service covered by this Policy.
• Through correspondence and communications initiated by the user with the Company by email, telephone, or official channels.
• Automatically when the website is used, through server logs, cookies, and similar technologies, depending on the technology and consent settings.
• From a representative of an establishment or customer who discloses data relating to employees or representatives for contracting or service-delivery purposes, provided that a lawful basis for disclosure exists.
• From publicly available sources or legally authorised entities, where permitted by law and where collection is necessary for a specific legitimate purpose.

Forms identify mandatory fields, if any, using a clear mark, while providing other data is optional. Failure to provide mandatory data may prevent submission of the form or make it impossible for the Company to respond, prepare a quotation, or provide the requested service.

Subscription to the newsletter and receipt of marketing materials remain optional. Refusing or cancelling them will not result in denial of services unrelated to that purpose.

The Company does not sell or rent personal data. It may disclose such data, to the extent necessary and for a specific legitimate purpose, to:

• Website operation, hosting, and electronic-system providers, including the website-management and technical-services provider (Babil ERP), and support and maintenance providers.
• Email, newsletter, communications, and customer relationship management providers, where their services are used and to the extent necessary.
• Consultants, lawyers, auditors, accountants, and other professionals bound by confidentiality.
• Contractors, experts, or partners whose participation is required by the nature of the service, after applying confidentiality and data-protection controls and defining the scope of disclosure.
• Government, regulatory, judicial, and law-enforcement authorities where there is a request or lawful basis.
• Any other party to whom the data subject gives valid and specific consent for disclosure.

When selecting a processor, the Company verifies that it provides sufficient guarantees to protect data and specifies in its agreement the purposes of processing, data categories, duration, confidentiality and security obligations, incident notification, and the handling of sub-processors.

Some hosting, email, technical support, or digital-tool services may require data to be processed by a service provider inside or outside the Kingdom. Where this results in transferring personal data outside the Kingdom or disclosing it to an entity abroad, the Company complies with the Personal Data Protection Law and the Regulations on Personal Data Transfer Outside the Kingdom, including determining the purpose and lawful basis, limiting transfer to the minimum necessary, assessing protection levels and risks where required, and applying appropriate safeguards such as standard contractual clauses or other approved mechanisms.

Consent to processing based on consent may be withdrawn at any time through the email address above or by using the “Unsubscribe” link in marketing messages where available. The minimum necessary data may continue to be retained where another lawful basis exists, such as compliance with a legal obligation or keeping a record demonstrating unsubscription.

In the event of a breach, unauthorised access, or damage to data, the Company takes the necessary measures to contain and investigate the incident and limit its effects. Where the legal conditions apply, the competent authority will be notified within no more than 72 hours from the time the Company becomes aware of the incident, and the data subject will be notified without undue delay if the incident is likely to cause harm to the data or conflict with the data subject’s rights or interests, together with appropriate information and recommendations.

The website may contain links to websites, applications, or services not operated by the Company. The Company does not control their privacy practices, and users should review the relevant entity’s privacy policy before providing personal data. This Policy does not apply to processing carried out by a third party on its own behalf as an independent controller.

The Company invites the data subject first to contact it through info@itqanconsult.com to investigate and address any privacy complaint or observation. If the data subject is dissatisfied with the outcome, a complaint may be submitted to the Saudi Data and Artificial Intelligence Authority, as the competent authority, through the National Data Governance Platform within 90 days from the date of the incident giving rise to the complaint or from the date the data subject became aware of it, unless the competent authority accepts the complaint after that period for reasons it considers appropriate.

The Company may update this Policy when laws, processing practices, or technical services change. The updated version will be published on this page with the date of the latest update, and an additional notification method may be used if the change is material or requires renewed consent. Amendments take effect from the date stated in the published version without affecting the lawfulness of prior processing.

This Policy is governed by the laws and regulations in force in the Kingdom of Saudi Arabia, particularly the Personal Data Protection Law and its Implementing Regulations. If a translation of this Policy is published, the Arabic version prevails in the event of any discrepancy, unless otherwise required by applicable law.