Privacy Policy

The data controller responsible for processing your personal data is:

We collect personal data only to the minimum extent necessary for the purposes described in this Policy. The categories of data we may collect include:

• Identity data: name, job title, company name.
• Contact data: email address, telephone number, business address.
• Communications data: messages submitted through our contact form, emails and chat logs.
• Technical data: browser type, operating system and page-visit timestamps recorded in our server logs. We do not store IP addresses in our analytics records.
• Usage data: pages visited, recorded in privacy-preserving server-side logs. We do not use third-party analytics cookies, advertising trackers or browser fingerprinting.
• Explicit consent records: when you affirmatively tick the consent box on our contact form, we record that you gave explicit consent, the exact version of the wording you were shown, and the date and time. The server validates and stores this record as our proof of lawful processing under the PDPL.
• Anti-spam data: when you submit the contact form, Google reCAPTCHA collects technical signals from your browser to confirm you are not an automated bot. We never send Google the contents of your message.
• Recruitment data: if you apply for a role advertised on our Careers page, the CV and any covering message you email us — including your employment history, education and the contact details you choose to include.
• Cookie data: please see our Cookie Policy for full details.

We collect personal data directly from you. We do not buy personal data, and we do not obtain it from data brokers, social networks or other third-party sources.

We do not collect sensitive personal data (as defined by PDPL Article 2) without your explicit consent.

Under the PDPL we may process your personal data on one or more of the following grounds:

We use your personal data to:

• Respond to enquiries and provide customer support.
• Provide and improve our website and services.
• Send you relevant marketing communications (only with your prior consent).
• Analyse website usage to improve content and user experience.
• Comply with applicable legal and regulatory obligations.
• Assess job applications, contact candidates and administer our recruitment process.
• Detect and prevent fraud, security incidents, and technical issues.

Marketing communications: we send marketing only where you have given prior consent. Every marketing message identifies us as the sender, states the purpose of the message, and includes a clear and free means of opting out, in line with the rules of the Communications, Space & Technology Commission (CST) on unsolicited commercial messages. If you opt out we stop sending immediately, and opting out never affects our answer to an enquiry you have already sent us.

Job applications: applications reach us by email to our Careers address rather than through a form on this website. We use a CV only to assess you for the role you applied for and for other roles we think may suit you, and we share it internally only with the hiring team and the relevant Mannai Group HR function.

You are not legally obliged to provide us with personal data, and browsing this website does not require you to identify yourself. Where a form field is marked as required, that data is the minimum we need for the stated purpose — if you choose not to provide it, we will not be able to complete that specific request.

• Contact form: your name, work email, inquiry type and message are required in order for us to identify you and reply. Without them we cannot respond to your enquiry. Company, phone and country are optional and may be left blank.
• Consent checkbox: the contact form cannot be submitted without ticking the consent box, because consent is the legal basis on which we process your enquiry.
• Non-essential cookies: declining them has no effect on your ability to read any part of this website. Only optional conveniences, such as the embedded map on our Contacts page, will remain switched off.

We do not use your personal data to make any decision about you by automated means alone, and we do not profile visitors.

We do not sell your personal data, and we do not share it for advertising purposes. We disclose personal data only to the following categories of recipient, each of which processes it on our instructions or for the narrow purpose described:

Resend acts as our processor: it handles your data only on our instructions and solely to deliver the notification email. Google and Cloudflare provide their services under their own terms and act as independent controllers for the technical data they collect; we configure them to receive no more than the minimum necessary, and their own privacy notices govern that processing. Some of these providers operate outside the Kingdom — see International Data Transfers below.

For more information, see the providers' official pages: Google reCAPTCHA, Google Maps Platform, and Resend.

This website and the database holding contact enquiries are hosted on cloud infrastructure located in the Microsoft Azure UAE North region (Dubai, United Arab Emirates). Personal data you submit through this website is therefore stored outside the Kingdom of Saudi Arabia.

We rely on this arrangement because it is the closest available region offering the resilience and security controls we require, and we apply the safeguards described in International Data Transfers. If you would like more detail about the safeguards in place, contact our Data Protection Officer at [email protected].

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements.

Personal data collected through this website is transferred outside the Kingdom of Saudi Arabia in two situations: it is stored on the hosting infrastructure described in Where Your Data Is Stored, and it is handled by the service providers named in Who We Share Your Data With. We do not transfer personal data to any other recipient outside the Kingdom.

The PDPL and its Regulations on Personal Data Transfer permit such transfers where the transfer serves a legitimate purpose, is limited to the minimum data necessary, and does not prejudice national security or the vital interests of the Kingdom. Before engaging a provider that processes personal data outside the Kingdom we assess the transfer against those conditions and put the appropriate safeguard in place for that provider — an adequacy decision issued by the Saudi Data & AI Authority (SDAIA) where one covers the destination, contractual data-protection commitments binding the provider where it does not, or your explicit consent where the PDPL requires it.

You may ask which specific safeguard applies to a particular provider, and we will tell you. Write to our Data Protection Officer at [email protected].

Saudi Arabia's Personal Data Protection Law grants you the following rights with respect to your personal data:

To exercise any of these rights, please email [email protected]. We will respond within 30 days of receipt.

Where we rely on your consent, you may withdraw it at any time. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of any processing carried out before you withdrew it.

• Cookies: open Cookie Preferences in the website footer and switch off any category you no longer wish to allow. The change takes effect immediately.
• Contact enquiries and marketing: email [email protected] asking us to withdraw your consent. We will stop the relevant processing and, unless we are required by law to keep the record, delete the underlying data.

We keep a record of the consent you gave — including the exact wording you agreed to and the date — so that we can demonstrate compliance with the PDPL. That record is retained even after withdrawal, because it is the evidence that the earlier processing was lawful.

If you are unhappy with how we have handled your personal data or a request you have made, please contact our Data Protection Officer first at [email protected]. We take every complaint seriously and will investigate it promptly.

You also have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia, the Saudi Data & AI Authority (SDAIA), which supervises the application of the PDPL. You can reach the authority through sdaia.gov.sa. Contacting us first is not a precondition for exercising that right.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include TLS encryption in transit, access controls, regular security assessments, and staff training.

Data at rest: stored contact data is kept within our hosted infrastructure and access is restricted to authorised personnel and service processes that require it. We apply the security controls available through our hosting and database configuration, and can provide further information about the current technical safeguards on request to our Data Protection Officer.

In the event of a personal data breach that may cause harm to your personal data or conflict with your rights or interests, we will notify the competent authority (SDAIA) within 72 hours of becoming aware of the breach, as required by the Implementing Regulations of the PDPL. Where the breach is likely to cause serious harm to you, we will also notify you without undue delay, describing what happened, the data involved and the steps you can take to protect yourself.

No transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately at [email protected].

Our website is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

This Privacy Policy is published in both English and Arabic. In the event of any conflict between the two versions, the Arabic version shall prevail before the courts and competent authorities of the Kingdom of Saudi Arabia. You may contact our Data Protection Officer at [email protected] if you wish to have this policy explained to you in Arabic.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the latest revision was made. Material changes will be communicated via a notice on our website. We encourage you to review this Policy periodically.

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact our Data Protection Officer: