PRIVACY POLICY

Expillar Consulting Firm
 

1. Introduction and Consent

Expillar Consulting Firm is committed to protecting the privacy of our website visitors and clients. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree No. M/19, as amended) and its Implementing Regulations ("PDPL").

By accessing or using our Website, or by providing your personal data to us through any channel, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent as the legal basis for processing, we will seek that consent clearly and separately before collecting your data, and you may withdraw it at any time as described in Section 9.
 

2. Who We Are

Expillar Consultancy is the data controller responsible for the personal data described in this Policy.

Registered name: Expillar Consulting Firm
Address: Riyadh, King Abdullah Financial District (KAFD), Financial Boulevard Street, Kingdom of Saudi Arabia
Privacy contact: info@Expillarconsultancy.com
 

3. Information We Collect

We may collect the following categories of personal data:

• Information you provide directly: name, email address, phone number, company name, job title, and the content of any inquiries, messages, or documents you submit through contact forms, newsletter sign-ups, proposals, or direct communications.

• Information collected automatically: IP address, browser type, device and operating system information, referring URLs, pages viewed, and date/time of visits, collected through cookies and similar technologies as described in Section 8.

• Sensitive data: We do not seek to collect sensitive personal data (such as health information, financial account details, or other data classified as sensitive under the PDPL) through this Website. If any such data is ever submitted to us, it will only be processed with your explicit, separate consent and with additional safeguards appropriate to its sensitivity.

• Children's data: This Website is intended for business use by adults and is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will delete it promptly.

​

4. Legal Basis for Processing

We process your personal data on one or more of the following legal bases, as permitted under the PDPL:

• Your consent, for example when you sign up to a newsletter or submit an inquiry.

• Performance of a contract, where processing is necessary to deliver advisory, brand, or transaction services you have engaged us for.

• Legal obligation, where processing is required to comply with KSA law or regulatory requests (including from SDAIA).

• Legitimate interest, for example to maintain the security of our Website, provided this does not override your fundamental rights and freedoms.

Where consent is the basis relied upon, it will be specific, informed, and freely given, and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

​

5. How We Use Your Information

We use personal data only for the specific purposes for which it was collected, including to:

• Respond to your inquiries and provide the advisory, brand development, investment brokerage, or management consulting services you request.

• Operate, maintain, and secure our Website.

• Communicate with you about your engagement with us, including service updates.

• Send marketing or newsletter communications, but only where you have given prior explicit opt-in consent, and with an easy means to opt out at any time.

• Comply with applicable legal, regulatory, and contractual obligations.

• Detect, investigate, and prevent fraud, misuse, or security incidents.

We do not use your personal data for purposes incompatible with those stated above without first notifying you and, where required, obtaining your consent.

​

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, in line with PDPL requirements and our internal data retention schedule:

• General inquiry and contact form data: retained for 12 months from the last interaction, unless a client relationship is established;

• Client and engagement records (contracts, advisory deliverables, correspondence): retained for 10 years, in line with standard KSA commercial record-keeping practice;

• Marketing consent records: retained until consent is withdrawn, plus a reasonable period to evidence compliance.

Once the retention period expires and no other legal basis for retention applies, personal data is securely deleted or anonymized.

​

7. Disclosure of Personal Data and Cross-Border Transfers

We do not sell personal data. We may share personal data with:

• Service providers who support our operations (such as website hosting, IT, or analytics providers), under contractual obligations to protect the data and use it solely for the purposes we specify;

• Professional advisors or regulators, where required by law;

• A successor entity in the event of a merger, acquisition, or restructuring of Expillar, subject to equivalent privacy protections.

Cross-border transfers: Expillar uses certain international service providers (including cloud hosting, email, and software platforms) located outside the Kingdom of Saudi Arabia to support our operations. Any transfer of personal data outside the Kingdom is carried out in accordance with the PDPL's Regulations on Personal Data Transfers outside the Kingdom, and we ensure appropriate safeguards are in place, which may include contractual data protection obligations imposed on the receiving party, transfer to a jurisdiction recognized as providing an adequate level of protection, or another mechanism approved by SDAIA. We take reasonable steps to ensure that any such transfer does not compromise the level of protection guaranteed to you under the PDPL.

​

8. Cookies Policy

Our Website currently uses only essential cookies, which are necessary for the Website to function properly (for example, to maintain basic site navigation and security) and do not require consent.

We do not currently use analytics or marketing cookies. If we introduce any such cookies in the future, we will update this Policy and request your explicit consent through a cookie banner before they are set, giving you the option to accept, reject, or manage your preferences at any time, including through your browser settings.

​

9. Your Rights Under the PDPL

As a data subject, you have the right to:

• Be informed of the purpose, legal basis, and recipients of your personal data;

• Access and obtain a copy of the personal data we hold about you;

• Request correction or completion of inaccurate or incomplete data;

• Request deletion or destruction of your data where it is no longer necessary, or where you withdraw consent;

• Withdraw your consent at any time, without affecting the lawfulness of prior processing;

• Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your rights under the PDPL have been violated.

To exercise any of these rights, please contact us at info@Expillarconsultancy.com. We will respond within the timeframe required under the PDPL.

​

10. Data Security and Breach Notification

We implement appropriate administrative, organizational, and technical measures to protect personal data against unauthorized access, loss, alteration, or disclosure. In the event of a personal data breach that poses a risk to your rights or interests, we will notify SDAIA and affected individuals in accordance with PDPL requirements and within the applicable statutory timeframe.

​

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be posted on this page with a revised "Last Updated" date, and where required, we will seek your renewed consent.

​

12. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Expillar Consultancy
info@expillar.com
Riyadh, King Abdullah Financial District (KAFD), Financial Boulevard Street, Kingdom of Saudi Arabia