Privacy & Personal Data Protection Policy

This Policy governs all personal data collected and processed via the official ScaleMarks website (scalemarks.com) and associated digital communication touchpoints. 'ScaleMarks' ('we', 'us', or the 'Data Controller') refers to ScaleMarks, an entity legally registered under the Commercial Registration laws of the Kingdom of Saudi Arabia, with its principal office situated in Al Khobar, Eastern Province.

We process your personal data strictly upon valid legal bases recognized under Articles (5) and (6) of the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations:

• Explicit Consent: When you voluntarily submit information through our consultation request forms, complimentary audit forms, or communications.
• Contractual Necessity: Where processing is necessary to take steps at your request prior to entering into a corporate engagement or partnership agreement.
• Legitimate Interests: For maintaining platform security, preventing fraudulent activity, and refining web performance where such interests do not override your statutory rights.
• Legal & Regulatory Compliance: To comply with mandatory statutory directives and regulatory obligations enforceable in the Kingdom of Saudi Arabia.

We adhere strictly to the principle of data minimization, collecting only necessary personal information directly relevant to our stated purposes:

We process collected personal data exclusively for the following lawful commercial purposes, and never in any manner incompatible with them:

• Responding to corporate inquiries and scheduling executive growth consultations.
• Preparing bespoke commercial scopes of work and corporate partnership agreements.
• Conducting in-depth website audits across UX, SEO, speed, and conversion yield.
• Facilitating pre-qualification dialogue via authorized channels (Email & WhatsApp).
• Ensuring platform cybersecurity, server stability, and automated spam prevention.
• Satisfying regulatory record-keeping standards pursuant to Saudi commercial laws.

When submitting your website URL for a complimentary digital audit (including our Saudi National Day 96 initiative), you authorize ScaleMarks to examine publicly accessible pages of your web property solely to compile diagnostic findings and growth opportunities. We never publish audit data or identify your firm in promotional case studies without your prior explicit written consent.

Our website deploys minimal, privacy-centric cookies strictly for core functionality, such as preserving your selected language preference (Arabic or English) and rendering responsive interfaces. Aggregate, non-personally identifiable telemetry may be analyzed to refine site architecture. You retain complete autonomy to disable cookies through your browser settings at any time.

We enforce comprehensive technical, physical, and administrative safeguards consistent with national standards issued by the National Cybersecurity Authority (NCA) and SDAIA, including end-to-end transport encryption (TLS/SSL), perimeter firewalls, and restricted privilege controls.

Personal data is retained only for the duration strictly necessary to fulfill the operational purpose for which it was gathered, or as required by applicable Saudi commercial regulations. Thereafter, data is securely destroyed or anonymized in an irreversible manner.

In principle, all personal data is hosted and managed within the Kingdom of Saudi Arabia. Where infrastructure workflows necessitate engagement with global cloud services involving cross-border transfer, such transmissions are strictly governed by Article (29) of the Saudi PDPL and SDAIA's Cross-Border Transfer Regulations, guaranteeing protection standards at least equivalent to those mandated domestically.

Under the Saudi Personal Data Protection Law (PDPL), you are entitled to exercise the following enforceable statutory rights without fee:

To submit a statutory request exercising any of your rights above, write directly to our Data Protection Desk. We assess and address all verified requests within the statutory timeline mandated by the Saudi PDPL (30 calendar days):

The competent national supervisory authority overseeing the enforcement of data protection legislation in Saudi Arabia is the Saudi Data & Artificial Intelligence Authority (SDAIA). If you believe your personal data has been handled contrary to the PDPL or if you do not receive a satisfactory resolution within the statutory period, you possess the right to lodge a formal complaint with SDAIA via its regulatory portals (sdaia.gov.sa).

We reserve the right to revise or update this Privacy Policy periodically to reflect technological adjustments or evolving circulars issued by regulatory authorities in Saudi Arabia. Any modifications will be posted to this URL alongside an updated effective revision date.