Privacy Policy

Privacy Policy This policy explains how personal data is collected, used, protected and otherwise processed when you visit the Ghayth website or use the Ghayth platform and services. 1. Controller identity and contact details For Ghayth website data, subscriber accounts, communications, billing, support and security data, the controller is Ghayth Al Mada Establishment, Commercial Registration 7053490558. Privacy: support@ghayth.com.sa Support: support@ghayth.com.sa 2. Ghayth processing roles Ghayth acts as a controller where it determines the purposes of processing for website visitors, prospects, subscribers, platform users, billing, support and security. Where a subscriber uses Ghayth to process its customers' or employees' personal data for purposes determined by that subscriber, Ghayth acts as a processor on the subscriber's documented instructions and under the Data Processing Agreement. 3. Personal data we may process Data may include names and business contact details; establishment, registration and branch information; users and permissions; subscription, invoice and payment status data; orders, reservations and customer data entered by subscribers; delivery address or location when required; support records; network address, device/browser information, authentication and security logs; and service-usage data necessary to operate and improve the service. Ghayth is not designed to store sensitive cardholder data such as full payment-card numbers or security codes. Sensitive payment data is handled by the relevant payment provider through the configured integration. 4. Sources and collection methods We collect data directly when a person registers, contacts us or uses the platform. We may also collect limited data indirectly through necessary cookies, server and security logs, subscriber-enabled integrations, and relevant payment, delivery or service providers where needed to provide the service. 5. Purposes and legal bases We process data for specific purposes including account creation and service delivery; subscription management; permissions and branches; billing and collection; support; security, fraud and abuse prevention; legal compliance; integrations; service reliability; and direct marketing where the required consent exists. Depending on the context, processing is based on performance of an agreement, legal obligation, legitimate interests that do not override the data subject's rights, or documented consent where required. 6. Mandatory and optional data Data required to create an account, perform a subscription or complete a security control is mandatory for the related function. Marketing data, non-essential cookie categories and other optional data are identified when requested and may be refused without disabling unrelated essential functionality. 7. Disclosures and subprocessors We may disclose the minimum data necessary to hosting, cloud infrastructure, email, messaging, payment, delivery, support and technical-integration providers under appropriate contractual and security controls. Ghayth maintains records of subprocessors and recipients where applicable. Ghayth does not sell personal data to advertisers or other third parties. 8. Transfers outside Saudi Arabia Ghayth uses Amazon Web Services (AWS) for the approved production environment. Primary hosting and the database are located in Germany / eu-central-1 (database country: Germany). Backups may be retained in Germany and technical logs in Germany according to the approved architecture. Personal data may therefore be processed or hosted outside Saudi Arabia. Ghayth applies the Saudi Personal Data Protection Law and Personal Data Transfer Regulation, uses the safeguard recorded in its compliance register (other), and documents transfer necessity, risk assessment, data minimisation, recipients and material changes. 9. Retention and deletion Ghayth retains data only for as long as necessary for the purpose, legal obligations, security or protection of rights, in accordance with the Retention and Deletion Policy and retention register. Periods vary by data category, and financial or tax records may be retained for the legally required period. When the purpose ends, data is securely deleted, destroyed or anonymised unless a legal obligation or legal hold requires continued retention. 10. Security Ghayth applies proportionate technical and organisational measures including access controls, tenant isolation, encryption where applicable, security logging, backups, vulnerability and incident management, and review of support access. No network-connected service can guarantee absolute security. 11. Data-subject rights Depending on the circumstances, data subjects may exercise rights provided by applicable law, including the rights to be informed, access, obtain their data in a clear or machine-readable form where applicable, correct data, request destruction where the legal conditions are met, and withdraw consent where consent is the processing basis. If the data is controlled by a Ghayth subscriber, we may direct the request to that subscriber and assist it in our role as processor. 12. Cookies and direct marketing Ghayth uses cookies necessary to operate the website and platform. Non-essential categories that require consent are not activated before the user's choice, and the choice can later be changed through Cookie Settings. Ghayth sends direct marketing only where a lawful basis and required consent exist, and provides an easy, free mechanism to stop such messages. 13. Complaints and contact Privacy requests and rights: support@ghayth.com.sa. Support: support@ghayth.com.sa. If a privacy complaint is not resolved, the data subject may use the complaint or appeal channels available from the competent authority under applicable law. 14. Policy updates We may update this policy when the service, legal requirements or processing providers materially change. The published version shows its version number and effective date, and Ghayth keeps historical versions where needed for consent or contractual evidence.