We adhere to the highest standards of transparency and security in processing and protecting your personal data in accordance with applicable regulatory frameworks.
Elmgal Digital (Elmgal Digital for Information Technology, CR No. 4030358009), referred to herein as "we", "us", or "our". This policy explains the personal data we collect through elmgal.com, why we collect it, how we safeguard it, and your rights regarding it.
For any inquiries regarding your data and privacy rights:
We only collect personal information that you voluntarily provide through our website forms:
We process your data to respond to your inquiries, prepare custom technical and commercial proposals, deliver the contracted services (custom web design, cloud hosting, domain registration, business email), issue regulatory tax invoices, administer and protect your account, and fulfill our legal obligations. We do not send marketing communications unless you explicitly opt in, and you can withdraw consent at any time.
We process personal data based on your explicit consent when submitting website forms, where necessary for the performance of a service agreement, or to comply with mandatory statutory and regulatory obligations.
We strictly do not sell, rent, or trade your personal data. We only share it with vetted third-party service providers essential for service delivery to the extent strictly necessary: cloud infrastructure hosts, accredited domain registrars, business email providers, authorized payment gateways, and OTP SMS providers. We may also disclose data to official government or judicial authorities if required by binding law.
Our servers are located in state-of-the-art data centers in Finland (European Union), outside the Kingdom of Saudi Arabia and the United Arab Emirates. Transfers are carried out strictly in accordance with applicable data protection laws, backed by appropriate security safeguards, encryption, and institutional protocols.
Inquiries that do not materialize into contracts are retained for 12 months from receipt. For active clients, data is retained for the contract duration and thereafter for the mandatory period required by tax, accounting, and billing laws (such as ZATCA regulations). Afterward, data is securely deleted or irreversibly anonymized.
You have the right to be informed about how your data is processed, obtain a copy, request correction or updates, request destruction when no longer required, and withdraw consent at any time. UAE clients also enjoy the right to object, restrict processing, and request data portability.
You also have the right to lodge a complaint with the competent supervisory authority: the Saudi Data & AI Authority (SDAIA) in Saudi Arabia, or the UAE Data Office in the United Arab Emirates.
We implement rigorous organizational and technical measures to safeguard your personal data, including encrypted HTTPS communication, advanced password hashing, enterprise firewalls, and role-based access restrictions. In the unlikely event of a security incident affecting your data, we will notify you and the competent regulatory authorities as required by law.
Our website uses strictly necessary cookies essential for website functionality, such as maintaining secure user sessions, theme preferences (dark/light mode), and language choice. Analytical and tracking tools are only enabled after presenting you with clear options.
We may update this policy periodically to reflect evolving legal and technological standards. The latest revision date is prominently displayed at the top of the page. Significant updates will be communicated to account holders via email or a prominent website notice.
Our data protection officer and support team are available to answer your questions and assist you.
