Effective and last updated: 16 October 2026. This notice is designed with reference to the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations and SDAIA privacy-policy guidance. It is not a legal opinion or a certification of compliance; applicable law and official regulatory requirements prevail.
1. Who handles your website data
For enquiries submitted through this website, GPR KSA determines why and how the submitted information is used for website enquiry handling and business correspondence. Our public correspondence address is Building 4317, Ibn Shaddad Street, 3rd Floor, Office 304, Al Malaz District, Riyadh 12629, Saudi Arabia.
2. Personal data we may collect
We collect only information that you choose to submit or that is technically generated when the website is used. Depending on your interaction, this can include:
- name, business or company name, phone number and email address;
- city or project region, requested service and project details;
- documents or information you later provide during project correspondence;
- technical server information such as IP address, browser or device information, date/time, requested page and security logs generated by the hosting environment;
- your privacy-choice value stored locally in your browser.
Please do not submit passwords, payment-card information, national identity information, health information or other sensitive personal data unless it is specifically and lawfully required for a later project process.
3. Why we process information and the legal basis
| Purpose | Typical data | Basis / reason |
|---|---|---|
| Review and respond to project enquiries | Contact details, company, project scope and location | Your request and the steps needed to respond to it; consent where consent is the appropriate basis. |
| Prepare quotations and technical coordination | Project details, drawings and correspondence | Steps requested before a possible contract and, where applicable, performance of project-related obligations. |
| Website security and abuse prevention | Technical logs and anti-spam signals | Protecting the website, systems and communications, subject to applicable legal requirements. |
| Optional analytics if activated in the future | Usage and device information | Only after the relevant privacy choice/consent is obtained where required. |
4. Required and optional information
The project form marks information needed to review and respond to an enquiry. Company and city details may be optional. If required contact or project information is not provided, we may be unable to evaluate or respond to the request.
5. Who may receive the data
Access is limited to people and service providers who need the information for the purposes above. This can include authorized project-coordination personnel, website hosting and security providers, and email/communications providers. We do not publish enquiry data on the website and we do not sell personal data.
6. Processing and transfers outside Saudi Arabia
Some technology providers may operate infrastructure or support services outside the Kingdom. Where a transfer of personal data outside Saudi Arabia is involved, it should be assessed and handled in accordance with the PDPL, its transfer regulation and any applicable safeguards or exemptions. We aim to minimize the data sent to third parties.
7. Retention and destruction
Personal data is kept only for as long as it is reasonably needed for the purpose for which it was collected and for applicable legal, contractual, accounting, dispute or security requirements. Website enquiries that do not become active project records should normally be reviewed for deletion or anonymization within 24 months after the last relevant interaction. Project or contractual records may need to be retained for longer where another lawful requirement applies. When data is no longer needed, it should be securely deleted, destroyed or anonymized as appropriate.
8. Browser storage, cookies and Google technologies
This version of the website uses essential browser storage to remember your privacy choice. It does not include an active Google Analytics measurement ID. Optional analytics is therefore disabled by default and will remain non-operational unless analytics is later configured.
If Google Analytics or Google Ads tags are added later, the implementation should use the website's consent choice so optional Google tags do not load before the required consent state is obtained. Google services may process device, usage and network information according to their own terms and privacy documentation.
The Arabic version requests the Cairo web font from Google Fonts to provide the requested Arabic typography. Loading a remote font can disclose technical request information such as IP address and browser information to the font provider. No project-form content is intentionally sent with that font request.
9. Security
We use reasonable administrative and technical measures appropriate to the website enquiry process, including server-side form validation, anti-spam fields, input limits and restricted handling of enquiry data. No internet transmission or storage system can be guaranteed to be completely secure.
10. Your data-protection rights
Subject to the PDPL, its Implementing Regulations and applicable exceptions, individuals may have rights including the right to be informed about processing; access personal data; request a readable copy; request correction, completion or updating; request destruction where applicable; and withdraw consent where processing depends on consent. Requests may require reasonable identity verification before information is disclosed or changed.
11. How to make a privacy request
Use our project/contact form, select Other / Not sure, and begin the project-details field with Privacy Request. Please identify the information or enquiry involved so we can locate it without collecting unnecessary additional data. You may also write to our Riyadh correspondence address shown above.
12. Complaints
If a privacy concern is not resolved, you may have the right to raise a complaint with the competent Saudi data-protection authority through the Saudi Data & AI Authority (SDAIA) / National Data Governance Platform, subject to the applicable procedure.
13. Children
This is a business-to-business project website and is not intended to collect personal data from children. Do not use the project form to submit a child's personal data.
14. Changes to this notice
We may update this notice when our website, processing activities or legal obligations change. The current version and update date will be published on this page.
15. Official references
For authoritative requirements, refer to the SDAIA National Data Governance Platform, the Personal Data Protection Law and its Implementing Regulations. For Google consent controls, refer to Google's Consent Mode documentation.