Privacy policy draft

1. Data controller and contact channels

The proposed controller is Sir Tamayouz Architect for Cont. Co., at the address listed in the company profile: King Abdulaziz Road, Al-Amamrah District, Dammam. The company's published email is info@sirtamayouz.com. Confirm the full legal entity name, address, and whether this email is the designated privacy-request channel before publication.

2. Information the website may request

When forms are enabled, they may request information needed to answer an enquiry or prepare a quotation:

• Name and mobile number; company name and email are optional in the current form design.
• Contracting service area or building-material category/products and requested quantities.
• Work or delivery location and the request-scope details entered by the user.
• PDF or bill-of-quantity attachments only if the company approves them; file upload is disabled in Preview.

3. Purpose and legal basis — approval required

The proposed purpose is to review and respond to a quotation or consultation request and communicate about its details. The company and its adviser must determine the appropriate legal basis before real data is collected. This draft does not assume consent is the sole basis and does not create a legal or contractual commitment.

4. Recipients, processors and processing locations

Authorized company staff, the hosting provider and a future email-delivery provider may need to process a request. No email provider has been selected, and processing locations or subprocessors have not been confirmed. List the actual providers and countries before enabling submissions; review applicable requirements for transfers outside Saudi Arabia.

5. Retention period

The retention period for requests and attachments in the company's mailbox and the email provider's logs has not been approved. The company should define the period or the criteria used to determine it, then erase data when the purpose or period ends, subject to applicable legal obligations. The current website does not save requests to a database or persistent storage.

6. Data-subject rights

Individuals may contact the privacy channel approved by the company to exercise rights available under applicable Saudi rules, including requests to access or receive a copy of data, correction or destruction where applicable, and withdrawal of consent when processing is based on consent. The company and its adviser must finalize identity checks and response timelines.

7. Attachments and processing security

Preview does not upload files. If attachments are approved later, the file types, size limit, processing path, authorized recipients and retention period must be defined before activation. Do not attach sensitive or unnecessary personal documents.

8. Analytics and cookies

Current project settings show platform analytics enabled. Before final publication, verify what data is collected, any tracking identifiers or cookies, processing location and retention; then describe them accurately or disable analytics through an approved decision.

9. Decisions required before approval

These are owner-review items, not final customer-facing policy text:

• Confirm the legal entity name, address and designated privacy-request email.
• Approve the purpose and legal basis, and which fields are required or optional.
• Select the email and hosting providers and confirm processing locations and subprocessors.
• Approve retention for messages, attachments and provider logs, or launch without attachments.
• Verify analytics and cookies; review any transfer outside Saudi Arabia with a qualified adviser.
• Obtain legal review and approve the final wording before publication and form activation.