Last updated: 3 October 2026 · This policy is governed by the laws of the Kingdom of Saudi Arabia.
Nehlum Technologies ("Nehlum", "we", "us", or "our") is committed to protecting the privacy and personal data of every individual who interacts with us. This Privacy Policy explains how we collect, use, disclose, store, and safeguard personal data, and the rights available to you as a data subject.
We process personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, issued under Royal Decree No. M/19 dated 9/2/1443H and its Implementing Regulations, as administered by the Saudi Data & Artificial Intelligence Authority (SDAIA). Where we process data relating to individuals in other GCC member states, we also observe the applicable national data-protection regulations of those jurisdictions.
1. Data controller
For the purposes of the PDPL, the data controller responsible for your personal data is:
- Nehlum Technologies
- Dammam, Eastern Province, Kingdom of Saudi Arabia
- Email: privacy@nehlum.sa
- Phone: +966 55 453 5655
2. Scope of this policy
This policy applies to personal data we collect through our website, products and platforms, sales and support interactions, recruitment activities, and any other dealings with clients, partners, suppliers, applicants, and website visitors. It does not apply to third-party websites or services that may be linked from our properties; those are governed by their own privacy policies.
3. Personal data we collect
We collect personal data that you provide directly to us and data generated automatically when you use our services. Depending on your relationship with us, this may include:
Information you provide
- Identity & contact data — name, job title, employer, email address, telephone number, and business address.
- Enquiry & engagement data — the contents of forms, emails, support tickets, and project briefs you submit to us.
- Recruitment data — CVs, qualifications, and employment history when you apply for a role.
- Contractual data — billing details and information required to deliver services under an agreement.
Information collected automatically
- Technical data — IP address, browser type, device identifiers, operating system, and language settings.
- Usage data — pages viewed, time spent, referring URLs, and interactions with our website and platforms.
- Enquiry source — when you send us a form, the page where your visit began, the website that referred you and any campaign tags in the link. These are kept in your browser for that visit only and sent with your enquiry, so we know how you found us.
- Cookie data — information stored through cookies and similar technologies (see Section 6).
We do not intentionally collect sensitive personal data (such as data revealing health, religious belief, or genetic or biometric data) through our website. Where processing of sensitive data is necessary for a specific service, we will obtain your explicit consent or rely on another lawful basis as permitted under the PDPL.
4. Legal basis for processing
Under the PDPL, we process personal data only where a lawful basis applies. Depending on the context, we rely on one or more of the following:
- Consent — where you have given clear, informed consent for a specific purpose (which you may withdraw at any time).
- Performance of a contract — where processing is necessary to enter into or perform an agreement with you or your organisation.
- Legitimate interests — where processing serves our legitimate business interests and does not override your rights and freedoms, as permitted by the PDPL.
- Legal obligation — where processing is required to comply with a law, regulation, or order of a competent authority in the Kingdom.
5. How we use personal data
We use personal data for the following purposes:
- To respond to enquiries and provide the information, products, or services you request.
- To deliver, operate, maintain, and improve our platforms and engagements.
- To manage contracts, billing, and our relationship with clients, partners, and suppliers.
- To assess and process recruitment applications.
- To send service communications and, with your consent, relevant updates about our offerings.
- To secure our systems, prevent fraud, and ensure the integrity of our services.
- To comply with legal, regulatory, and contractual obligations.
We do not use personal data for automated decision-making that produces legal or similarly significant effects without appropriate safeguards and, where required, your consent.
6. Cookies and similar technologies
Our website uses cookies and similar technologies to operate essential functions, remember your preferences, and understand how the site is used so we can improve it. Cookies fall into four categories, which match the choices in our cookie banner:
- Strictly necessary — required for the website to function and cannot be switched off.
- Statistics — analytics cookies that help us measure and improve the site. These are on when you visit; you can switch them off in the cookie banner at any time.
- Preferences — remember choices such as language to personalise your experience; set only if you allow them.
- Marketing — measure the effectiveness of our campaigns; set only if you allow them.
We use Google Analytics to understand how the website is used. Unless you have switched statistics cookies off, Google Analytics sets cookies that distinguish one visitor from another and records the pages viewed, the time, the referring page, and general browser and device information. If you switch statistics cookies off, Google Analytics sets no cookies and stores nothing on your device; it then receives only limited cookieless signals with no identifier that recognises you from one visit to the next, which we use as aggregate counts.
You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.
7. Disclosure and sharing of personal data
We do not sell personal data. We may share personal data with the following categories of recipients, subject to appropriate contractual and security safeguards:
- Service providers — trusted processors who perform services on our behalf (such as hosting, infrastructure, analytics, and communications), under written agreements that restrict their use of the data.
- Professional advisors — auditors, legal, and financial advisors where necessary.
- Competent authorities — government, regulatory, or law-enforcement bodies where disclosure is required by the laws of the Kingdom.
- Corporate transactions — in connection with a merger, acquisition, or restructuring, subject to the protections of this policy.
8. Cross-border transfers
Where we transfer personal data outside the Kingdom of Saudi Arabia, we do so only in accordance with the PDPL and its Implementing Regulations and any conditions set by SDAIA. Such transfers take place only where an adequate level of protection is ensured in the destination country, or where appropriate safeguards (such as binding contractual clauses) are in place, or where another lawful transfer condition under the PDPL applies. For data relating to individuals in other GCC states, we apply equivalent transfer protections required under the relevant national regulations.
9. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, regulatory, or reporting requirements. When personal data is no longer required, we securely delete or anonymise it. Retention periods vary by data category and the nature of our relationship with you.
10. Data security
We implement appropriate organisational, technical, and administrative measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include access controls, encryption in transit and at rest where appropriate, network security, and ongoing monitoring aligned to recognised standards including ISO/IEC 27001. In the event of a personal-data breach that is likely to cause harm, we will notify the competent authority and affected data subjects in accordance with the timelines required by the PDPL.
11. Your rights as a data subject
Subject to the conditions and exceptions set out in the PDPL, you have the following rights in relation to your personal data:
- Right to be informed — to know the legal basis and purpose for collecting your data.
- Right of access — to obtain confirmation of, and access to, the personal data we hold about you.
- Right to obtain a copy — to receive your personal data in a readable and clear format.
- Right to rectification — to have inaccurate or incomplete data corrected or updated.
- Right to erasure — to request deletion of your data where it is no longer needed or processing is unlawful.
- Right to withdraw consent — to withdraw consent at any time, without affecting prior lawful processing.
To exercise any of these rights, contact us using the details in Section 13. We will respond within the period required by the PDPL. There is generally no charge, although we may apply a reasonable fee or decline manifestly unfounded or excessive requests as permitted by law. We may need to verify your identity before acting on a request.
12. Children's privacy
Our website and services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
13. Contact us and complaints
If you have questions about this policy, wish to exercise your rights, or want to make a complaint about how we handle personal data, please contact our privacy team:
- Email: privacy@nehlum.sa
- Phone: +966 55 453 5655
- Address: Dammam, Eastern Province, Kingdom of Saudi Arabia
If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent supervisory authority for personal data protection in the Kingdom.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated through our website. We encourage you to review this policy periodically.