Privacy policyPrivacy policy

1. Who is responsible for your data

The data controller is HAFNEX Consulting Company, a company registered in the Kingdom of Saudi Arabia (Commercial Registration No. 7032885308), Al Malqa, Riyadh. For any matter concerning personal data, contact [email protected] or +966 55 289 9898. Personal data matters are handled by the designated data protection contact at HAFNEX, reachable at the same address.

2. What this policy covers

This policy covers the website www.hafnex.com.sa and its three forms: the capability challenge enquiry, partner capability registration, and expert network registration. It does not cover data exchanged under a signed engagement, which is governed by that engagement's terms.

3. What we collect, and why

We collect only what you submit through the forms, plus minimal technical data needed to operate the site securely.

• Capability challenge enquiry: full name, organization, role, business email, phone, country, area of interest, your description of the challenge, and preferred contact method. Purpose: to understand and respond to your enquiry and assess whether HAFNEX can help.
• Partner capability registration: company name, country, website, capability description, the problem it addresses, Saudi presence, sectors, your objectives, contact name, role, business email, phone, and an optional capability profile document. Purpose: to assess a potential partnership against HAFNEX capability areas and opportunities.
• Expert network registration: full name, country and city of residence, email, mobile, LinkedIn profile, current or most recent role, years of experience, areas of expertise, professional summary, defense or national-security experience, industry experience, certifications, languages, availability, preferred engagement type, willingness to work in Saudi Arabia or the GCC, an optional CV, and your answer to the key capability question. Purpose: to consider you for relevant future engagements and to contact you when one arises.
• Technical data: our hosting provider records standard server logs (IP address, browser type, requested page, time) for security and to keep the site available. We do not use analytics or marketing cookies.

We do not collect payment data, identity documents, security-clearance evidence or classified information, and we ask you not to submit them. Every form carries a notice to that effect.

4. Legal basis

We process the data you submit on the basis of your explicit consent, which you give by ticking the consent box on each form. We also have a legitimate interest in responding to business enquiries addressed to us. You may withdraw your consent at any time (see section 9); withdrawal does not affect processing that took place before it.

5. Where your data is stored, and who processes it

HAFNEX uses the following service providers ("processors") to operate this website. Each is bound by a data processing agreement and acts only on our instructions.

• Database and file storage: Supabase Inc., servers located in Frankfurt, Germany.
• Notification email: your submission is emailed to our team mailbox at Zoho Mail. [If the Resend service is in use, add: transmitted via Resend Inc.]
• Website hosting and content delivery: Cloudflare, Inc., served from its global network.

Some of these providers are located outside the Kingdom of Saudi Arabia. Such transfers are carried out in accordance with the Regulation on Personal Data Transfer Outside the Kingdom, on the basis of [contractual safeguards agreed with each provider / a documented transfer risk assessment], and are limited to what is necessary to operate the forms. [HAFNEX to confirm the safeguard relied on, or to state that storage has been relocated to the Kingdom.]

6. Who we share data with

We do not sell personal data. We do not share it with third parties for their own purposes. Your data is seen by HAFNEX personnel who need it to handle your submission, by the processors listed above, by professional advisers under a duty of confidentiality where necessary, and by a competent authority where the law requires it.

7. How long we keep it

We keep personal data only as long as the purpose requires, then delete it, including any uploaded file, automatically.

• Capability challenge enquiries: 24 months from submission.
• Partner capability registrations: 36 months from submission.
• Expert network profiles: 36 months from submission, or earlier if you withdraw.
• Server logs: as retained by the hosting provider for security purposes, typically no more than 30 days.

Where a submission leads to an engagement, the relevant data may be retained under that engagement's terms and applicable record-keeping obligations.

8. How we protect it

The website is served only over HTTPS. Submissions are transmitted encrypted, stored encrypted at rest, and are not accessible from the public internet. Access is limited to authorized HAFNEX personnel. If a personal data breach occurs that may cause harm, we will notify the Saudi Data & Artificial Intelligence Authority within 72 hours of becoming aware of it and, where the risk to you is high, notify you without undue delay.

9. Your rights

Under the Personal Data Protection Law you have the right to:

• be informed about how your data is processed (this policy);
• access the personal data we hold about you and obtain a copy;
• request correction of inaccurate or incomplete data;
• request deletion of your data where it is no longer necessary for the purpose, or where you withdraw consent;
• withdraw your consent at any time;
• object to, or request restriction of, processing in the circumstances the law provides;
• lodge a complaint with the competent authority, the Saudi Data & Artificial Intelligence Authority (SDAIA).

To exercise any right, email [email protected] from the address you used, or write to us at the address above. We may ask you to confirm your identity. We respond within 30 days of a verified request, and there is no charge for a reasonable request.

10. Children

This website is directed at organizations and professionals. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy to reflect changes in law or in how the website works. The date at the top shows the current version. Material changes will be highlighted on this page.

12. Contact

HAFNEX Consulting Company, Al Malqa, Riyadh, Kingdom of Saudi Arabia. [email protected] · +966 55 289 9898.