1) Introduction
The company T& Group (“we”, “our”, “us”) is committed to protecting your privacy and the confidentiality of your personal data. This Privacy Policy explains what we collect, how we use it, when we may disclose it, and the rights you have under the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations.
2) Data Controller & Contact Details (KSA)
Controller: T& Group
Email: info@tand.sa
Phone: +966 507 105 777
Address: Anas Ibn Malik Rd, Alyasmin, Riyadh 13524, Saudi Arabia
Social: LinkedIn (https://www.linkedin.com/company/tandksa/)
For any questions about this Policy or to exercise your data rights, contact us using the details above.
3) Personal Data We Collect
We may collect and process the following categories of personal data depending on how you interact with us:
– Identity & Contact Data: name, company, role, email, phone number.
– Account Data: login credentials, preferences, and settings.
– Usage & Technical Data: device and browser information, IP address, pages visited, session analytics, referral URLs, cookies/SDK identifiers.
– Location Data: approximate geolocation derived from IP or device settings (if enabled).
– Communications: contents of inquiries, support requests, feedback, and our responses.
We obtain data directly from you (e.g., when submitting a form) and automatically via our website/app (e.g., through cookies and similar technologies). Where we request personal data, providing it may be necessary for us to deliver the requested service; if you choose not to provide it, some features may be unavailable.
4) Purposes of Processing
We process personal data for the following purposes permitted by PDPL:
1. Provide and improve services: operate our site/app, deliver requested features, ensure availability/performance, and conduct analytics to enhance user experience.
2. Account & support: create/manage accounts, authenticate users, respond to inquiries, and provide customer support.
3. Notices & updates: send important notices about material changes to services, terms, or this policy.
4. Security & fraud prevention: protect accounts, investigate suspicious activity, and maintain service integrity.
5. Legal & compliance: comply with applicable laws and regulations, respond to competent authorities, exercise or defend legal claims. 6. Marketing (where permitted): send newsletters and announcements with your consent where required; you may opt out at any time.
6. Legal bases: We rely on your consent where required and on other PDPL‑permitted grounds (e.g., to comply with legal obligations, meet judicial requirements, protect public health/safety, or protect vital interests). We do not use your data for incompatible purposes without obtaining additional consent or ensuring a PDPL‑permitted basis applies.
5) Use and Disclosure of Personal Data
Access to your personal data is restricted to authorized T& personnel and service providers (processors) acting on our instructions. We require processors to implement appropriate security and confidentiality measures and to process data only for the purposes we specify.
We do not disclose personal data without your consent except where permitted or required by PDPL, including:
– Security or legal compliance (e.g., applying another law, meeting judicial requirements);
– Public interest (e.g., protecting public health or safety);
– Vital interests (e.g., to protect the life or health of an individual);
– Other cases expressly permitted by PDPL and its Regulations.
6) Cross‑Border Transfers
Where feasible, we aim to process and store personal data in the Kingdom of Saudi Arabia. If it becomes necessary to transfer personal data outside the Kingdom, we will do so only as allowed by PDPL and applicable regulations, such as when:
– The destination jurisdiction ensures an adequate level of protection; or
– We implement appropriate safeguards (e.g., SDAIA‑recognized standard contractual clauses or binding corporate rules), maintain transfer records, and conduct risk assessments; or
– A PDPL exception applies (e.g., vital interests, fulfillment of a statutory requirement, or public interest).
We will document international transfers and apply additional measures where appropriate.
7) Your Rights under PDPL
Subject to conditions in PDPL and its Regulations, you may have the right to:
– Be informed about processing activities and legal bases;
– Access your personal data and obtain a copy;
– Request correction/update of inaccurate or incomplete data;
– Request deletion (destruction) where PDPL conditions apply;
– Restrict certain processing in scenarios provided by law;
– Withdraw consent where processing relies on consent;
– Complain to the competent authority in the Kingdom.
To exercise your rights, contact info@tand.sa. We may request information to verify your identity and will respond within the timeframes required by law.
8) Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, comply with legal/accounting/reporting obligations, resolve disputes, and enforce agreements. When retention is no longer necessary, we will delete personal data or irreversibly anonymize it in line with PDPL requirements.
9) Cookies & Similar Technologies
We use cookies and similar technologies to:
– Keep you signed in and enable core site functions;
– Operate and secure the website (e.g., load balancing, fraud prevention);
– Understand usage through analytics to improve content and features.
You can manage your preferences via our Cookie Settings (footer link) or through your browser. Some strictly necessary cookies are required for the site to function and cannot be disabled.
10) Security Measures
We implement technical and organizational measures designed to protect personal data against unauthorized access, use, disclosure, alteration, and destruction. While no system is completely secure, we regularly review and enhance our safeguards, limit access on a need‑to‑know basis, and conduct risk assessments (including for cross‑border transfers where applicable).
11) Personal Data Breaches
If a personal data breach occurs that may harm personal data or individuals’ rights/interests, we will notify the competent authority within 72 hours of becoming aware and notify affected individuals without undue delay, in accordance with PDPL and its Regulations.
12) Children’s Privacy
Our services are not directed to children under the age permitted by applicable law. We do not knowingly collect personal data from such individuals without appropriate consent/authorization. If you believe a child has provided personal data, please contact us to request deletion.
13) Third‑Party Links
Our website may contain links to third‑party sites or services. Their privacy practices are governed by their own policies; we encourage you to review them before providing personal data.
14) Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where required, notify you of material changes (e.g., via email, SMS, or an in‑product notice). Continued use of our services after changes take effect constitutes acceptance.
15) How to Contact Us
T& Group (“T&”) – Privacy Office
Email: info@tand.sa
Phone: +966 507 105 777
Address: Anas Ibn Malik Rd, Alyasmin, Riyadh 13524, Saudi Arabia
Social: LinkedIn (https://www.linkedin.com/company/tandksa/)
If you are not satisfied with how we handle your request, you may have the right to lodge a complaint with the competent authority in the Kingdom under PDPL.