Privacy policy

Who is responsible for your data

The controller of personal data collected through this website is [NEEDS CLIENT INPUT: legal entity name, registered address and registration number]. In this policy, "Nawa", "we" and "us" refer to that entity.

This policy applies to visitors and to people who contact us through the website. It is written to meet the EU General Data Protection Regulation (GDPR) and, for people in Saudi Arabia, the Personal Data Protection Law (PDPL).

What we collect

• Booking form Your name, email address, phone or WhatsApp number, company name, country, and the message you write. Please do not include sensitive information, such as health data, in the message.
• WhatsApp and email If you contact us directly, we receive your number or address, your name as shown, and the content of your messages.
• Analytics Only if you accept analytics cookies, Google Analytics 4 collects information about how you use the site: pages viewed, approximate location, device and browser type, and how you arrived. We do not use this to identify you personally.
• Technical data Our hosting provider processes your IP address and browser details to deliver the site securely. [NEEDS CLIENT INPUT: hosting provider and server location].

Why we use it, and on what legal basis

We use booking form, WhatsApp and email data to reply to your request, arrange a consultation and, if you go ahead, prepare a proposal. Under the GDPR, the legal basis is the steps you ask us to take before entering into a contract (Article 6(1)(b)) and, where you give it, your consent (Article 6(1)(a)). Under the PDPL, we process this data with your consent or where it is needed to respond to the request you made.

We use analytics data to understand which pages are useful and improve the site. The legal basis is your consent (GDPR Article 6(1)(a)), which you give or refuse through the cookie banner.

We do not sell your personal data and we do not use it for automated decisions about you.

Cookies and analytics consent

When you first visit, a banner asks whether you accept analytics cookies. Google Analytics 4 loads only after you click Accept. If you decline, no analytics cookies are set. You can change your choice at any time through [NEEDS CLIENT INPUT: cookie settings link location]. The site also uses a small number of strictly necessary cookies or local storage entries, for example to remember your cookie choice and language.

How long we keep it

We keep enquiry data for [NEEDS CLIENT INPUT: retention period for enquiries that do not become clients], and longer only if you become a client, in which case contractual and legal retention periods apply. Analytics data is kept for [NEEDS CLIENT INPUT: GA4 data retention setting]. After these periods we delete or anonymise the data.

Who we share it with, and international transfers

We share personal data only with service providers that help us run the site and respond to you: our hosting provider, our email provider, Google (for analytics, if you consent) and WhatsApp (if you contact us there). [NEEDS CLIENT INPUT: list of processors, e.g. form handling and email provider]. Each processes data under a contract that limits its use.

Your data may be processed in the European Union, where we are based, and some providers may process it in other countries, including the United States. Where data leaves the EU, we rely on safeguards recognised under the GDPR, such as adequacy decisions or the European Commission's Standard Contractual Clauses. Where the PDPL applies to data transferred outside Saudi Arabia, we follow its transfer rules.

Your rights

Depending on the law that applies to you, you can:

• Access Ask what personal data we hold about you and receive a copy.
• Correction Ask us to correct data that is inaccurate or incomplete.
• Deletion Ask us to delete your data when we no longer need it or you withdraw consent.
• Withdraw consent Withdraw consent at any time, including for analytics cookies. This does not affect processing that took place before.
• Object or restrict Under the GDPR, object to certain processing, ask us to restrict it, or ask for your data in a portable format.
• Complain Complain to a data protection supervisory authority in the EU, or in Saudi Arabia to the Saudi Data and Artificial Intelligence Authority (SDAIA). We would welcome the chance to resolve your concern first.

How to contact us about privacy

Send privacy requests to [NEEDS CLIENT INPUT: privacy contact email]. We will reply within the time the applicable law requires. We may ask you to confirm your identity before acting on a request.

Changes to this policy

We will update this policy when our practices or the law change, and show the date of the latest version here. Last updated: [NEEDS CLIENT INPUT: publication date].

See also our Terms of Use. For any question about your data, contact us.