Privacy Policy

At TSC (“TSC,” “we,” “us,” or “our”), your privacy matters. We handle your personal information with care, transparency, and responsibility in line with the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL). 

This Privacy Policy explains how we collect, use, protect, and manage your personal data when you interact with our websites, apps, tools, services, premises, and any other activities where TSC acts as the data controller. We update this policy periodically to reflect changes in our practices or legal requirements. 

If a TSC entity responsible for your data is based outside the Kingdom of Saudi Arabia (KSA), TSC in Riyadh (or a designated local representative, where required) will represent it for PDPL purposes. 

1. How TSC protects your personal data 
   When you interact with our site—such as submitting forms or leaving comments—we collect the information you provide along with technical details like your IP address and browser information to help prevent spam and maintain security. 
   If you use a third‑party avatar service (e.g., Gravatar), an anonymized identifier may be shared to display your profile image. Once your submission is approved, your profile image may appear publicly next to your content. 

2. Data we process when you visit TSC’s website 
   To improve, secure, and personalize your experience, we may collect: 

• Technical details: IP address, browser type/version, operating system, device identifiers, referring URLs, and browsing activity on our pages. 

• Cookies and tracking: We use cookies and similar technologies (see Section 3). 

• Contact information: If you fill in forms, subscribe, or request information, we collect the details you provide. 

3. Cookies and tracking technologies 
   We use cookies and similar technologies to: 

• Enhance experience: Remember preferences and settings. 

• Analyze traffic: Understand how visitors use our site to improve it. 

• Personalize content/ads: Show relevant content and communications. 

• Enable essential features: Security, load balancing, and accessibility. 

You can adjust cookie preferences in your browser settings. Disabling certain cookies may affect site functionality. 

4. Data we process when you visit our offices 
   If you visit a TSC office (e.g., Riyadh HQ), we may collect: 

• Visitor details: Name, contact information, company, and purpose of visit. 

• Identification: Government-issued ID, where required by site security. 

• CCTV footage: Video/images from security cameras for safety and asset protection. 

• Access logs: Records of entry/exit times and access card usage. 

5. How we use your data for marketing 
   With your consent (as required under PDPL), we may use your information to keep you updated about TSC products, services, events, and insights, including: 

• Email marketing: Newsletters, offers, event invitations. 

• Targeted ads: Relevant ads on our site and third‑party platforms. 

• Personalized content: Messages tailored to your interests. 

You can opt out at any time via the “unsubscribe” link in our emails or by contacting us (see Section 13). We do not send direct marketing without the necessary consent. 

6. Other ways we may use your personal data 
   We may also use personal data to: 

• Comply with law: Meet legal and regulatory obligations in KSA and other relevant jurisdictions. 

• Run our business: Accounting, audits, billing, and risk management. 

• Improve services: Research, testing, and product/service development. 

• Security and fraud prevention: Detect, investigate, and prevent fraud, abuse, and security incidents. 

• Protect rights: Enforce contracts and defend legal claims. 

• Recruitment: Evaluate applications, manage hiring and onboarding. 

• Client support: Provide support and respond to inquiries. 

7. Types of personal data we collect 
   Depending on your interactions with TSC, we may collect: 

• Personal and contact details: Name, address, email, phone, country. 

• Professional information: Job title, employer, industry, professional memberships. 

• Technical data: IP address, device identifiers, browser/OS details, usage data. 

• Communications and preferences: Marketing preferences and communication history. 

• Financial/transaction data: Payment details for purchases or services. 

• Sensitive personal data (only if necessary and with safeguards): For example, biometric data for secure access or health information related to site safety. We apply heightened protections and process such data only where permitted by PDPL. 

• Any other information you choose to share with us. 

8. Sharing your personal data 
   We may share data with: 

• Service providers: Trusted vendors for hosting, security, analytics, communications, payments, and customer support—bound by confidentiality and data protection obligations. 

• Business partners: Joint initiatives or co‑branded offerings (we’ll tell you when this applies). 

• Professional advisors: Lawyers, auditors, and insurers under duty of confidentiality. 

• Affiliates: TSC subsidiaries and related entities, for purposes described in this policy. 

• Legal authorities: Government bodies, regulators, or courts when required by law or to protect rights. 

• Corporate transactions: In connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards. 

We require recipients to protect your data and use it only for specified purposes. 

9. Data security 
   We use appropriate technical and organizational measures to safeguard personal data, including: 

• Encryption: Protecting data in transit and at rest where appropriate. 

• Access controls: Role‑based access, authentication, and least‑privilege principles. 

• Security monitoring: Vulnerability management, logging, and intrusion detection. 

• Vendor due diligence: Security and privacy assessments for third parties. 

• Incident response: Procedures to investigate, mitigate, and notify in accordance with PDPL. 

10. International data transfers 
    Where we transfer personal data outside KSA, we do so in compliance with PDPL and applicable regulations issued by the Saudi Data & AI Authority (SDAIA). Safeguards may include: 

• Approved contractual clauses and data transfer agreements, 

• Risk assessments and technical/organizational controls, 

• Transfers allowed by law for contract performance, protection of vital interests, or other permitted grounds. 

We transfer only what is necessary, ensure adequate protection, and keep required records of transfers. 

11. Data retention 
    We keep personal data only for as long as needed for the purposes described in this policy or as required by law, regulation, or legitimate business needs. When data is no longer needed, we securely delete or irreversibly anonymize it. 

12. Your rights under KSA’s PDPL 
    Subject to PDPL and applicable exceptions, you have the right to: 

• Be informed: Receive clear information about how your data is used. 

• Access and obtain a copy: Know whether we process your data and obtain a copy. 

• Correction/update: Request correction of inaccurate or incomplete data. 

• Deletion: Request deletion where PDPL allows (for example, when the purpose has ended or consent is withdrawn and there is no other legal basis). 

• Restriction: Request limiting processing to the minimum necessary in certain circumstances. 

• Object to direct marketing: Object or withdraw consent for marketing at any time. 

• Withdraw consent: Where processing is based on consent, you may withdraw it at any time. 

We will verify your identity before fulfilling requests and respond within timelines required by PDPL. You also have the right to lodge a complaint with SDAIA if you believe your rights have been infringed. 

13. Contact us 
    Questions, requests, or concerns about this Privacy Policy or your personal data? 

• Data Controller: TSC 

• Address: [TSC Headquarters], Riyadh, Kingdom of Saudi Arabia 

• Email: privacy@tsc.com  

For faster processing of rights requests, please specify the right you wish to exercise and provide sufficient information for identity verification. 

14. Updates to this Privacy Policy 
    We may update this policy from time to time. We will post the latest version on our website with the effective date. Material changes will be communicated through appropriate channels. 

Additional notes on legal basis and children’s data 

• Legal basis: We process personal data under PDPL on grounds including consent, performance of a contract with you, compliance with legal obligations, protection of vital interests, and legitimate interests where permitted and not overridden by your rights. 

• Children’s data: We do not knowingly collect personal data of children without appropriate authorization consistent with PDPL. If you believe a child has provided us with data without such authorization, contact us and we will take appropriate steps. 

Regulatory references 

• Personal Data Protection Law (PDPL), as administered by the Saudi Data & AI Authority (SDAIA) 

• PDPL Implementing Regulations and Cross‑Border Data Transfer provisions (SDAIA) 

This policy is intended to be clear and practical; it does not constitute legal advice. For specific obligations under PDPL, consult the law, implementing regulations, and official SDAIA guidance.