Privacy Policy

01Who we are

شركة صائد الثغرات (Thagharat), registered in the Commercial Register under No. 7055275007, operates this site from Riyadh and is the controller of the personal data described in this policy. For any privacy question or request, write to info@thagharat.com or message us on WhatsApp.

02What this policy covers

This policy covers personal data about website visitors and people who contact us or work with us, including the contact details of client staff that clients give us, such as escalation contacts. For personal data we come across while testing a client's systems, the client is the controller: we process that data on the client's behalf under the engagement contract and our Testing Safety Policy.

03What we collect

• What you send us: your name, work email, phone number, company name and anything else you include when you contact us by email, WhatsApp or phone. To reply, we need only a way to contact you and a short description of what you want tested. Everything else is optional, and without contact details we cannot reply. Please do not send passwords or technical details before we have signed an NDA, and do not send us sensitive personal data, such as health information.
• Newsletter: if you subscribe, your email address and when you subscribed and confirmed. Nothing else about you is recorded with it. We email you once to confirm the address, and if you do not confirm within 3 days, we delete it. You can unsubscribe at any time with the link in any newsletter email or by writing to info@thagharat.com.
• Technical data: when you visit the site, we and our hosting provider, Cloudflare, process your IP address, browser details and the pages you request, to deliver the site, limit abuse and protect it from attacks. Your browser may also send Cloudflare short reports when a page fails to load.
• Usage statistics: we use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you.

We do not collect sensitive personal data through this website, and the site is not directed at children.

04How we use it

• To answer your enquiry and prepare a scope and quote.
• To deliver and manage engagements under our contract with you.
• To send you our newsletter, if you have subscribed.
• To keep the website secure and working.
• To meet our legal obligations, such as record keeping.

We do not use your data for any other purpose unless the PDPL allows it, and we will tell you before we do.

05Our legal basis

We process personal data only on the grounds the PDPL allows:

• Our legitimate interests: to reply to enquiries, prepare scopes and quotes, deal with our clients' staff and keep the website and our systems secure. We rely on this ground only for data that is not sensitive and in ways you would reasonably expect.
• An agreement you are a party to: when you contract with us yourself, for example as the owner of a sole proprietorship.
• Another law: when a law requires us to process or keep data, such as tax and commercial record-keeping rules.
• Your consent: for anything we ask your permission for, such as our newsletter. You can withdraw it at any time, as explained under Your rights.

06Cookies

We do not use advertising or tracking cookies. Our hosting provider may set strictly necessary security cookies to distinguish human visitors from automated traffic.

07Who we share it with

We do not sell personal data. We share it only with the following, and only as far as each needs it:

• Cloudflare, our service provider for website hosting, security and usage statistics, and for storing newsletter sign-ups.
• Zoho, our email provider, which also sends our newsletter confirmation emails.
• Competent authorities, where a law requires it.

If you choose to message us on WhatsApp, WhatsApp (owned by Meta) handles your messages under its own terms and privacy policy.

08Transfers outside the Kingdom

Some of our service providers process personal data outside Saudi Arabia:

• Cloudflare runs a global network. Website requests, security logs, usage statistics and newsletter sign-ups can be processed and stored in its data centres outside the Kingdom, including in the United States.
• If you message us on WhatsApp, Meta may process your messages outside the Kingdom. You can email us instead.

We send these providers only what their service needs. The data we handle while testing your systems stays encrypted in Saudi Arabia and is not sent to them.

09How long we keep it

• Enquiries that do not lead to an engagement: no longer than needed to respond and follow up, and in any case no more than two years after our last contact.
• Engagement records: for the retention period in the engagement contract, or longer where the law requires. Engagement data is then destroyed. You can ask us to destroy it earlier once the engagement has ended.
• Newsletter sign-ups: until you unsubscribe or ask us to delete your address. Sign-ups not confirmed within 3 days are deleted.
• Website request logs: no more than 7 days in our hosting account. Cloudflare keeps its own security logs under its terms.

When a retention period ends, we delete the data from our systems and backups, or anonymise it so that no one can be identified from it.

10How we protect it

Data is encrypted in transit and access is limited to the people who need it. Engagement data is also encrypted at rest, stored in Saudi Arabia and handled under non-disclosure agreements. Our Testing Safety Policy describes how we handle client data during testing.

11Your rights

Under the PDPL you have the right to:

• Be informed of the legal basis for collecting your personal data and the purpose.
• Access your personal data and receive a copy in a clear, readable format.
• Ask us to correct, complete or update your data, and to restrict its use while we check its accuracy.
• Ask us to destroy your data once we no longer need it, unless a law requires us to keep it.
• Withdraw your consent at any time where we rely on it. This does not affect processing already carried out, or processing on another legal basis.

To use any of these rights, write to info@thagharat.com or message us on WhatsApp. To withdraw consent, contact us the same way you gave it. We may ask you to confirm your identity. We act on requests without delay and within 30 days. If a request needs unusual effort, or you send several requests, we may extend this by up to 30 more days, and we will tell you the reason before the first 30 days end. We may refuse a request that is repetitive, clearly unfounded or would need disproportionate effort, and if we do we will explain why. Using these rights is free.

12Complaints

If you believe we have mishandled your data, please tell us at info@thagharat.com so we can put it right. We will confirm receipt within 2 working days and aim to resolve your complaint within 10 working days.

13Changes to this policy

We will post any update on this page and change the date at the top.