# Privacy Policy

**Nusware website**

**Version:** 1.0
**Effective date:** 10 September 2026
**Last updated:** 10 September 2026
**Governing framework:** Saudi Personal Data Protection Law and its Implementing Regulations

> **Language notice.** This Policy is published in Arabic and English. The Arabic text is the official and binding version. If the two versions differ, the Arabic text prevails.

---

## 1. Scope

This Privacy Policy explains how **Ahmed Khalaf Al-Malki Establishment**, trading under the **Nusware** brand (**Nusware**, **we**, **us**, or **our**), collects, uses, discloses, transfers, retains, and protects personal data when you visit [nusware.com](https://nusware.com/) (the **Website**) or contact us about the company.

This Policy applies to the Nusware corporate Website. Nusware products, including nusuq, may collect different information and provide their own privacy notices.

## 2. Who is responsible for your data

| Item | Detail |
| --- | --- |
| Data controller | Ahmed Khalaf Al-Malki Establishment, trading as Nusware |
| Commercial Registration No. | 7055084417 |
| Website | https://nusware.com |
| Privacy and data-subject contact | info@nusware.com |

We act as the **Controller** for the processing described in this Policy. Terms such as **Personal Data**, **Processing**, **Controller**, **Processor**, and **Data Subject** have the meanings assigned to them by the Saudi Personal Data Protection Law, issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H (**PDPL**), and its Implementing Regulations.

## 3. Data we collect

The Website has no account registration, payment form, or embedded contact form. We may process:

- **Information you send us:** your email address, name, message, attachments, and any other information you choose to provide when contacting us by email or through a linked social account.
- **Basic technical records:** our hosting and security providers may automatically process an IP address, request time, requested page, browser or device information, referrer, and security events to deliver and protect the Website.
- **Language preference:** the Website stores your Arabic or English selection in your browser's local storage. This remains on your device and is not an advertising cookie.

Please do not send sensitive personal data unless it is necessary for your request.

## 4. Why we use data

We use personal data only as needed to:

- respond to messages, enquiries, feedback, and legal requests;
- operate, secure, troubleshoot, and improve the Website;
- prevent misuse and investigate security incidents;
- maintain appropriate business and legal records; and
- comply with applicable laws and lawful requests.

We do not sell personal data. We do not use Website visitor data for targeted advertising, and the current Website does not include third-party advertising or analytics scripts.

| Category | Principal purpose | Typical lawful basis |
| --- | --- | --- |
| Correspondence and contact details | Responding to and administering your request | Your consent, taking steps at your request, or our legitimate interests in managing communications |
| Technical and security records | Delivering, securing, and troubleshooting the Website | Our legitimate interests in reliable and secure operations, or compliance with a legal obligation |
| Legal and business records | Establishing, exercising, or defending rights and meeting recordkeeping duties | Compliance with law or a legitimate interest recognised by the PDPL |
| Language preference | Displaying the Website in your selected language | Your request and our legitimate interest in providing the requested experience |

Where we rely on a legitimate interest, we assess the necessity and proportionality of the processing and its effect on your rights and interests. We will obtain consent where the PDPL requires it.

## 5. How data is collected and whether it is required

We collect data directly from you when you contact us; automatically from your browser and device when they request Website resources; and from service providers that support hosting, delivery, or security. We may also receive information from a social platform when you choose to contact us through it, subject to that platform's settings and policy.

Providing correspondence data is voluntary, but we may be unable to respond without the information necessary to understand and administer your request. Basic technical processing is necessary to deliver and secure the Website.

## 6. Legal basis

We process personal data where you consent or ask us to respond, where processing is necessary for a legitimate interest that does not override your rights—such as Website security—or where we must comply with a legal obligation. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.

## 7. Disclosure, processors, and international transfers

We may share only the data necessary with service providers that host, secure, or support the Website and our communications; professional advisers; or public authorities where disclosure is legally required. Links to other websites and social networks are governed by their own privacy practices.

A service provider may process data outside Saudi Arabia. Any transfer or disclosure outside the Kingdom is subject to the PDPL, the Regulation on Personal Data Transfer Outside the Kingdom, and any applicable assessment, adequacy requirement, exemption, or appropriate safeguard. Where required, those safeguards may include approved standard contractual clauses or another mechanism recognised by the competent authority.

We require processors to act on documented instructions, protect confidentiality and security, and process data only for the contracted purpose. We do not disclose personal data for another party's independent marketing.

## 8. Retention, destruction, and anonymisation

We retain correspondence and technical records only for as long as reasonably necessary for the purposes above, including security, dispute resolution, and legal recordkeeping. In setting a period, we consider the nature and sensitivity of the data, the purpose of processing, limitation periods, security needs, and mandatory retention obligations. When data is no longer required, we securely destroy it or anonymise it in accordance with applicable requirements, unless continued retention is required by law or necessary for a pending judicial claim.

## 9. Security and personal-data breaches

We maintain reasonable administrative, organisational, and technical controls appropriate to the nature of the data and foreseeable risks. These include access limitation, service-provider controls, and measures intended to preserve confidentiality, integrity, and availability. No internet transmission or storage system can be guaranteed absolutely secure.

If a personal-data breach occurs, we will assess it, take appropriate containment and remediation steps, and notify the competent authority and affected Data Subjects where and within the time required by the PDPL and its Implementing Regulations.

## 10. Your rights

Subject to the Saudi Personal Data Protection Law and its exceptions, you may have rights to be informed about processing, access your personal data, obtain it in a clear format, ask us to correct or complete it, and request its destruction when there is no lawful reason to retain it.

Your rights may include the right to be informed of the legal basis and purpose of collection; access your Personal Data; request a copy in a clear and readable format; request correction, completion, or updating; and request destruction where the applicable conditions are met. You may also withdraw consent at any time where consent is the legal basis, without affecting processing lawfully carried out before withdrawal.

To exercise a right, email **info@nusware.com** and describe your request. We may request information reasonably necessary to verify identity and protect data against unauthorised disclosure. We will respond within the period required by Applicable Law and will explain any lawful restriction or refusal.

You may submit a complaint to the **Saudi Data & AI Authority (SDAIA)** through its official channels. We encourage you to contact us first so that we have an opportunity to address the concern.

## 11. Automated decisions, marketing, and tracking

We do not use Website data to make decisions based solely on automated processing that produce legal or similarly significant effects. We do not use Website data for behavioural advertising or direct electronic marketing. If these practices change, we will provide the notice and obtain consent required by law before the relevant processing begins.

The Website currently uses no advertising or analytics cookies. The language preference stored locally in your browser is functional. Because the Website does not conduct cross-site behavioural tracking, it does not respond differently to browser “Do Not Track” signals.

## 12. Children

The Website is intended for a general business audience and is not directed to children. We do not knowingly seek personal data from children through the Website. If you believe a child has provided data to us, contact us so we can address it.

## 13. Other websites

The Website contains links to Nusware products, social platforms, and other websites. Their operators determine their own processing, and this Policy does not govern their practices. Review the privacy notice presented by the relevant service before providing data.

## 14. Changes and contact

We may update this Policy when our Website, practices, or legal obligations change. We will post the revised version here and update the date above.

For privacy questions or requests, contact **info@nusware.com**.