Privacy Policy

This Privacy Policy explains how Cyber Shields collects, uses, shares and protects personal data through this website and our related business activities, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations. We collect only what we need, use it only for the purposes below, and never sell it.

1. Who We Are

The data controller responsible for the personal data described in this policy is:

• Entity: Cyber Shields (دروع سايبر)
• Commercial Registration: 7050439160
• National Address: Building 6591, Al Hassan St., West Oraija District, Riyadh 14921, Kingdom of Saudi Arabia
• Contact: info@cybershields.com.sa

2. Personal Data We Collect

• Contact and quote forms: your name, job title, organization, email address, phone number, the services you are interested in, how you heard about us, your message, and the language of the page.
• Technical data sent with a form: your browser type, and a one-way, salted fingerprint of your IP address that cannot be turned back into the address. We do not store your IP address itself.
• Call bookings: when you book a call through our Google Calendar booking page, your name, email address, phone number, organization and the time you choose.
• Correspondence: emails, calls and WhatsApp messages you exchange with us, and the contact details they contain.
• Website assistant: the questions you type into the chat assistant. We do not store these conversations (see section 5).
• Security data: your IP address and browser signals, processed briefly by our hosting provider to protect the website and its forms from abuse, and kept in security logs for up to 7 days.
• Cookies and similar technologies: see section 8.

We do not collect payment card details, passwords or government identity numbers through this website. Please do not send sensitive or confidential data through the website; we will agree a secure channel, under a Non-Disclosure Agreement, when an engagement needs it.

3. Why We Use Your Data and Our Legal Basis

• Responding to your enquiry, preparing a proposal and arranging a call: based on your request and consent when you submit a form or book a call, and on the steps needed before entering into a contract with you.
• Delivering the services you engage us for: based on the contract with you or your organization.
• Protecting the website and forms from bots, spam and attacks: based on our legitimate interest in keeping our services secure.
• Counting visits without cookies: based on our legitimate interest in understanding how the website is used, without identifying you. Optional analytics and advertising measurement run only with your consent.
• Sending you news or marketing messages: only with your prior consent, which you can withdraw at any time.
• Meeting legal and regulatory obligations: where the law requires us to keep or disclose information.

We do not sell personal data, and we do not make decisions about you based solely on automated processing.

4. How Long We Keep It

• Enquiries, quote requests and call bookings that do not lead to an engagement: up to 24 months from our last contact with you, then deleted.
• Client engagement records: for the duration of the engagement and afterwards for the periods required by Saudi law, including up to 10 years for commercial records.
• Security logs: up to 7 days.
• Assistant feedback: only counts of "helpful" and "not helpful" votes per page, which contain no personal data.

When data is no longer needed, we delete it securely or anonymize it.

5. Who We Share It With

We share personal data only with the service providers we need to run our business, under their data protection terms, and only to the extent each service requires:

• Cloudflare, Inc.: hosts the website, stores the messages sent through our forms, runs the security check that blocks bots, counts visits without cookies, and runs the website assistant's AI model (Workers AI).
• Google LLC (Google Workspace): our business email and the calendar used for call bookings. Google Analytics and Google Ads run only if we switch them on and you consent.
• Anthropic, PBC: may run the website assistant's AI model when that model is in use. The assistant sends the text of your conversation to the model provider only to generate an answer; we do not store the conversation on our systems, and it is cleared when you close the browser tab.
• WhatsApp (Meta Platforms): only when you choose to contact us on WhatsApp, under WhatsApp's own terms.
• Authorities: where a law, a court order or a competent authority requires disclosure.

6. Transfers Outside the Kingdom

Some of these providers process data on servers outside the Kingdom of Saudi Arabia. We transfer only the data each service needs, in accordance with the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, relying on the providers' contractual data protection commitments and on safeguards such as encryption in transit and replacing your IP address with a one-way fingerprint.

7. Your Rights under the PDPL

Subject to the conditions set out in the PDPL and its Implementing Regulations, you have the right to:

• Be informed of how and why your personal data is processed.
• Access your personal data held by us.
• Obtain a copy of your personal data in a clear and readable format.
• Request correction, completion or update of your personal data.
• Request destruction of your personal data when it is no longer needed.
• Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before it.

To exercise a right, email info@cybershields.com.sa with the subject "Personal data request". We may need to verify your identity, and we respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

8. Cookies

We keep cookies and similar technologies to a minimum. Today the website sets no analytics or advertising cookies. The table lists everything that runs and why.

When an optional tool is in use, a cookie bar offers "Accept all", "Necessary only" (with the same prominence) and "Customise", with nothing pre-ticked. Optional tools run only after you accept them. You can change or withdraw your choice at any time from Cookie settings at the bottom of every page: measurement stops at once and the Google cookies are deleted. You can also block or delete cookies in your browser settings.

9. How We Protect Your Data

We apply technical and organizational measures appropriate to the data we hold, including encrypted connections (TLS 1.2 or later), access limited to authorized team members with two-factor authentication, strict input validation on every form, security monitoring, and confidentiality commitments from our team and providers. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it, and the affected individuals where the law requires.

10. Children

Our services are intended for organizations and are not directed at anyone under 18. We do not knowingly collect personal data from children.

11. Contact for Data Requests

For any question about this policy or how we handle your personal data:

• Email: info@cybershields.com.sa
• Address: Building 6591, Al Hassan St., West Oraija District, Riyadh 14921, Kingdom of Saudi Arabia

12. Changes to This Policy

We may update this policy to reflect changes in our practices, services or legal obligations. We will update the date below and, for material changes, give additional notice on the website. If the Arabic and English versions differ, the Arabic version prevails.

Last updated: November 2026