Privacy Policy

This policy explains how Haxset handles personal data when you visit haxset.com or contact us through it. It is written to meet the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations, the data protection laws of the other Gulf Cooperation Council (GCC) countries where they apply to you, and, for visitors in the European Economic Area, the General Data Protection Regulation (GDPR).

It covers this website only. Personal data we handle while delivering services or the Haxset Engine to clients is governed by our agreements with those clients.

1. Who is responsible for your data

The controller of your personal data is Haxset LLP ("Haxset", "we", "us"). You can reach us about anything in this policy at:

• Email: [email protected] (please put "Privacy" in the subject line)

2. What we collect

When you use the contact form

If you leave a mandatory field empty we cannot receive or answer your enquiry. Please do not include sensitive personal data (for example health or financial details) in your message.

When you email us directly

Your email address, name and whatever you choose to include in the message.

Automatically, when you browse

Like any website, our servers and our content-delivery and security provider (Cloudflare) receive technical data with each request: your IP address, browser and device type, the page requested, the referring page and the time of the request. To limit abuse, our server also keeps the IP address of each contact-form submission in memory (never written to disk) to rate-limit repeated submissions.

3. How we collect it

• Directly from you, through the contact form or by email.
• Automatically, from your browser, when you load pages on this website.

We do not buy personal data or collect it from data brokers.

4. Why we use it, and on what legal basis

We do not send marketing emails based on a contact-form enquiry, we do not sell personal data, and we do not use it for automated decision-making or profiling.

5. Who we share it with

Personal data is seen only by Haxset staff who need it to answer you. We use the following service providers (processors), who act on our instructions:

We may also disclose personal data to courts, regulators or law enforcement where the law requires it.

6. Transfers outside Saudi Arabia

As the table above shows, some of our providers process data outside the Kingdom of Saudi Arabia, including in the United States. We make these transfers only as permitted by the Saudi PDPL and its transfer regulations, other applicable GCC data laws and, where it applies, the GDPR, relying on the providers' data processing terms and the safeguards they contain. You can ask us for more information about these safeguards using the contact details in section 1.

7. How long we keep it, and where

• Enquiries and related correspondence: up to 24 months after our last exchange with you, unless the enquiry leads to an engagement (then the engagement contract governs retention) or the law requires us to keep it longer. The consent record is kept for as long as the enquiry.
• Server and security logs: only as long as needed for security and troubleshooting, and no longer than 12 months.
• Analytics: only aggregate statistics are kept; no IP addresses or identifiers.

Enquiries are stored in our Microsoft 365 mailbox. When the retention period ends, the data is deleted.

8. How we protect it

Data is encrypted in transit (TLS) between your browser, our website and our providers. Access to enquiries is limited to staff who need it, and we choose providers that maintain recognised security controls. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority where the law requires it.

9. Your rights

Depending on the law that applies to you, you have the right to:

• be informed about how your data is processed (this policy);
• access the personal data we hold about you;
• obtain a copy of it in a readable, commonly used format;
• have inaccurate or incomplete data corrected;
• have your data deleted when we no longer need it;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it;
• object to or ask us to restrict processing based on our legitimate interests, where the law that applies to you provides this right.

To exercise any of these rights, email [email protected]. We may ask you to confirm your identity before acting on the request. We reply within 30 days; if a request is complex we may extend this where the law allows, and we will tell you why. Exercising your rights is free of charge.

10. Cookies, local storage and analytics

The public website does not set cookies for visitors. We do not use advertising or tracking cookies, and we do not use cookie-based analytics, so there is no cookie banner.

• Analytics: we use Cloudflare Web Analytics. It sets no cookies, does not use local storage and does not fingerprint your device. It records aggregate page-view data: the page URL, the referrer, browser and device type, and country. Country is derived from your IP address, which is not stored.
• Security cookies set by Cloudflare: to protect the site against bots and attacks, Cloudflare may set strictly necessary cookies such as __cf_bm and cf_clearance. They are not used for tracking. See Cloudflare's cookie documentation.
• Theme preference: if you use the light/dark switch, your browser stores your choice in local storage (key theme). It stays on your device and is never sent to us.
• Staff content-management system: a strictly necessary authentication cookie (haxset-admin) is set only when Haxset staff sign in to manage website content. Visitors never receive it.

If we change how analytics or cookies work on this site, we will update this section before the change takes effect.

11. Children

This website is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

12. Complaints

If you have a concern, please contact us first at [email protected] and we will try to resolve it. You also have the right to complain to a data protection authority:

• Saudi Arabia: the Saudi Data & AI Authority (SDAIA), sdaia.gov.sa.
• Other GCC countries: the data protection authority in the country where you live or work.
• European Economic Area: the supervisory authority in the country where you live or work, or where the alleged infringement took place.

13. Changes to this policy

We will post any change on this page with a new version number and date. If a change materially affects how we use data you have already given us, we will ask for your consent again where the law requires it.

See also our Terms of Use and Vulnerability Disclosure Policy.