1. Introduction

FirmSanad ("FirmSanad," "we," "our," or "us") provides a structured digital platform for company formation and compliance in the Kingdom of Saudi Arabia.

We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL), under the oversight of the Saudi Data and Artificial Intelligence Authority (SDAIA), where applicable.

2. Scope of This Policy

This Privacy Policy applies to:

Users of the FirmSanad platform
Prospective clients
Individuals associated with client entities (e.g., shareholders, directors, authorized representatives)

This Policy does not apply to:

Third-party services accessed through external links
Employment-related data processing
Services governed by separate contractual agreements

3. Role of FirmSanad

FirmSanad operates within a controlled digital workflow and acts as:

Data Controller: for platform operations, account management, and service design
Data Processor: when executing company formation and compliance processes on behalf of clients

4. Personal Data We Collect

FirmSanad collects only the data necessary to execute defined regulatory and operational processes.

4.1 Identity and Account Data

Name, email, phone number
Government-issued identification (passport, national ID)

4.2 Business and Corporate Data

Company structure and ownership
Articles of association and incorporation documents
Licensing and regulatory information

4.3 Compliance and Verification Data

Shareholder and beneficial ownership details
KYC/AML documentation required for regulatory submission

4.4 Financial Data

Payment and transaction information
Billing and invoicing details

4.5 Technical Data

IP address, device and browser information
Platform usage and interaction data

4.6 Communications

Customer support inquiries
Platform messaging records

5. Data Collection Methods

We collect data through:

Direct input via structured platform workflows
Secure document uploads
Automated collection through cookies and system logs
Approved third-party verification providers, where required

6. Purpose of Processing

FirmSanad processes personal data within defined operational pathways to:

Execute company formation and incorporation processes
Facilitate regulatory approvals (including MISA and Commercial Registration)
Complete compliance requirements (e.g., KYC, AML, tax registration)
Communicate with relevant Saudi government entities
Provide account management and customer support
Process payments and maintain financial records
Improve platform performance and process efficiency
Fulfill legal and regulatory obligations

7. Legal Basis for Processing

Where applicable, FirmSanad processes personal data on the basis of:

Contractual necessity
Legal and regulatory obligations
Legitimate business interests in operating a secure and efficient platform
User consent, where required

8. Data Sharing and Disclosure

FirmSanad shares personal data strictly within defined operational requirements:

Saudi Government Authorities: for licensing, incorporation, and compliance
Technology Providers: secure hosting, infrastructure, and platform operations
Verification Providers: identity and compliance verification services
Professional Service Partners: notarization, translation, and legal coordination
Financial Institutions: where relevant to payments or banking facilitation
Regulatory Authorities: where disclosure is required by law

FirmSanad does not sell personal data.

9. International Data Transfers

Where necessary, personal data may be processed outside Saudi Arabia. In such cases, FirmSanad applies appropriate safeguards in accordance with applicable legal requirements.

10. Data Retention

Data is retained based on operational necessity and regulatory requirements, including:

Active client data: retained for the duration of service delivery
Compliance and regulatory records: retained as required by law
Financial records: retained for statutory reporting obligations

Data is securely deleted or anonymized when no longer required.

11. Data Security

FirmSanad operates a controlled digital environment designed to minimize risk and reduce manual handling errors.

We implement appropriate technical and organizational safeguards, including:

Encrypted data transmission (SSL/TLS)
Role-based access controls
Secure infrastructure and monitored systems
Structured workflows to reduce incomplete or inconsistent submissions

12. Cookies and Tracking Technologies

FirmSanad uses cookies to:

Enable essential platform functionality
Monitor performance and improve user experience

Users may control cookie settings through their browser or platform tools.

13. User Rights

Subject to applicable law, users may:

Access their personal data
Request correction or deletion
Withdraw consent where applicable
Object to specific processing activities

Requests may be submitted to: solutions@firmsanad.com

Identity verification may be required before fulfilling requests.

14. Data Breach Procedures

FirmSanad maintains structured incident response procedures. In the event of a data breach, we will:

Investigate and contain the issue
Mitigate potential impact
Notify relevant authorities and affected parties where required

15. Changes to This Policy

FirmSanad may update this Privacy Policy to reflect operational or regulatory changes. Updates will be communicated through appropriate channels.

16. Contact

Email: solutions@firmsanad.com
Address: 6683 Irqah, Riyadh 12541, Saudi Arabia