Data Protection Policy

1. Scope

This policy applies to all personal data processed by WhiteHelmet, including data collected from website visitors, prospective clients who submit enquiries or book demos, employees, and contractors. It covers data collected through the whitehelmet.sa website and through direct business communications.

2. Data Protection Principles

• Lawfulness and Transparency: Data is collected and processed lawfully, fairly, and transparently.
• Purpose Limitation: Data is collected only for specified, explicit, and legitimate purposes and not used in ways incompatible with those purposes.
• Data Minimization: We collect only the data that is necessary — primarily name, email, phone number, and company details submitted through our Website forms.
• Accuracy: Data is kept accurate and updated where necessary. Inaccurate data is corrected or deleted without undue delay.
• Storage Limitation: Data is retained only as long as needed for its purpose or as required by Saudi law.
• Integrity and Confidentiality: Data is protected against unauthorized access, accidental loss, or destruction through appropriate security measures.

3. Roles and Responsibilities

• Management: Accountable for overall compliance with this policy and applicable data protection law.
• Team Leads: Responsible for ensuring their teams handle personal data in accordance with this policy.
• All Staff: Required to follow this policy and report any suspected data incidents to management immediately.

4. Lawful Bases for Processing Personal Data

Lawful Bases for Processing Personal data collected through the Website is processed on the following bases: consent (when you submit a form), legitimate interests (to operate and improve our Website and respond to business enquiries), and legal obligation (where required by Saudi law).

5. Data Subject Rights

Under the Saudi PDPL, individuals have the right to access, correct, erase, and object to the processing of their personal data, and to withdraw consent at any time. Requests can be submitted to info@whitehelmet.sa. Complaints may be lodged with the Saudi Data and Artificial Intelligence Authority (SDAIA).

6. Data Security Measures

• Encrypted data transmission (TLS/HTTPS) across the Website.
• Secure hosting infrastructure with access controls limiting data access to authorized staff only.
• Regular reviews of third-party tools and services that handle Website visitor data.
• Staff awareness of data protection responsibilities.
• Documented procedures for responding to data incidents and breaches.

7. Data Breach Response

In the event of a personal data breach, WhiteHelmet will promptly assess and contain the incident, notify affected individuals without undue delay where required, report significant breaches to SDAIA in accordance with PDPL timeframes, and document all incidents for review and remediation.

8. Third-Party Service Providers

We use a limited number of third-party tools to operate the Website, including analytics and CRM platforms. Where these tools process personal data on our behalf, we ensure appropriate data processing agreements are in place. We do not use payment processors on the Website as no transactions are conducted.

9. International Data Transfers

Some third-party tools we use may process data on servers outside the Kingdom of Saudi Arabia. Where this applies, WhiteHelmet ensures appropriate safeguards are in place in accordance with PDPL requirements.

10. Policy Review

This policy is reviewed at least annually and updated whenever there are material changes to applicable law or our data handling activities.

11. Contact Us

WhiteHelmet — شركة المسح الرقمي لتقنية المعلومات

Building 8566,
Othman Bin Affan Street Al Nada District,
Riyadh 13317 Kingdom of Saudi Arabia

Email: info@whitehelmet.sa