Privacy Policy

01Who we are

Thagharat is a penetration testing company based in Riyadh, Saudi Arabia, and is responsible for the personal data described here. For any privacy question or request, write to contactus@thagharat.com.

02What we collect

• What you send us: your name, work email, phone number, company, and anything you include when you contact us by email, WhatsApp or phone.
• Technical data: when you visit the site, our hosting provider processes your IP address, browser details and the pages you request, to deliver the site and protect it from attacks.
• Usage statistics: we use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you.
• Letter verification: when you check a letter ID we process only the ID you enter. We don't ask who you are.

We don't collect sensitive personal data through this website, and the site is not directed at children.

03Why we use it

• To answer your enquiry and prepare a scope and quote.
• To deliver and manage engagements under our agreement with you.
• To keep the website secure and working.
• To meet our legal obligations, such as record keeping.

04Our legal basis

We rely on your consent when you contact us, on the need to take steps you request before entering a contract and to perform it, on our legitimate interest in keeping our services secure, and on compliance with legal obligations — each as permitted by the PDPL.

05Cookies

We don't use advertising or tracking cookies. Our hosting provider may set strictly necessary security cookies to tell people apart from automated traffic.

06Who we share it with

We don't sell personal data. We share it only with providers that help us run our business, under contract and confidentiality:

• Cloudflare — website hosting, security and analytics.
• Zoho — our email service.
• WhatsApp (Meta) — only if you choose to message us there.

We also disclose personal data where the law requires it, for example to a competent authority.

07Transfers outside the Kingdom

Some of these providers process data outside Saudi Arabia. Where that happens, we rely on the conditions and safeguards that the PDPL and its regulations on transfers outside the Kingdom allow.

08How long we keep it

• Enquiries that don't lead to an engagement: no longer than needed to respond and follow up, and in any case no more than two years after our last contact.
• Engagement records: as agreed in the engagement contract and as the law requires. Engagement data is destroyed on request after closure.
• Server and security logs: kept by our hosting provider for short periods, for security.

09How we protect it

Data is encrypted in transit, access is limited to the people who need it, and engagement data is handled under confidentiality agreements. Our Testing Safety Policy describes how we handle client data during testing.

10Your rights

Under the PDPL you can ask to:

• Be informed about how your personal data is used.
• Access your personal data and receive a copy.
• Correct inaccurate or incomplete data.
• Have your data destroyed when it is no longer needed.
• Withdraw your consent at any time.

Write to contactus@thagharat.com. We will respond within the time limits set by the PDPL regulations.

11Complaints

If you believe we have mishandled your data, please contact us first so we can put it right. You can also complain to the Saudi Data & AI Authority (SDAIA), the competent authority under the PDPL.

12Changes to this policy

We will post any update on this page and change the date at the top.