Privacy policy
This policy explains how Cynthra Company handles website visitors’ and inquirers’ data and the rights available under Saudi Arabia’s Personal Data Protection Law and its Implementing Regulations.
Who is responsible?
Cynthra Company, a Saudi cybersecurity and information technology company based in Riyadh, is the controller for data it receives to handle website inquiries. For privacy questions and rights requests, contact info@cynthra.sa or +966 55 127 6880.
This policy covers browsing, downloads and initial inquiries. Separate service agreements and notices specify how project and client data are handled when services are contracted.
Data we handle
The form does not request identity documents, payment details or sensitive data. Provide a general description. Do not include passwords, client data, vulnerability reports or confidential files in an initial inquiry.
- Inquiry details you provide directly: name, email, service area and a description of your needs. Organization name is optional. Required form fields are needed to prepare an inquiry, not to browse the site or download the profile.
- Correspondence you send and a record of your consent to handling the inquiry when you use the form.
- Technical connection data hosting and delivery services may process automatically, such as IP address, request time, requested page and browser information, to deliver and protect the site and investigate faults.
How the contact form works
Form fields are processed in your browser to prepare a message in your email app or download a brief to your device. The form does not automatically send details to Cynthra or save them in a website database. We receive them when you send the email yourself. Fields are cleared when you close the contact dialog or reload the page. Your email app and downloaded files remain subject to your settings.
You can email us directly without using the form. Without a reply channel, we may be unable to follow up.
Purposes and legal bases
We use inquiry details to understand and respond to your request and discuss service scope, based on your consent to handling that inquiry. An inquiry does not subscribe you to marketing.
If a contractual relationship follows, processing necessary to perform it is based on the agreement to which you are a party. Data may also be retained or disclosed to meet a legal obligation or a competent authority’s lawful request, within its limits.
Processing technical connection data necessary to operate and protect the site is based on the legitimate interest in making it available securely, subject to necessity, proportionality and protection of your rights and interests. The site code does not profile people or make decisions with significant effects on them.
Local storage and cookies
The site does not save inquiry fields or language preferences in browser storage. Any language preference saved by an earlier version is cleared when this version opens. Cynthra’s site code adds no advertising trackers or external analytics.
The hosting platform may use technical cookies for security or access to a restricted version. Platform account data is subject to the platform’s privacy policy. Linked social networks are not embedded and begin their own processing when you visit them.
Recipients
Within Cynthra, inquiry correspondence is used by those who need it to respond and follow up. Email, hosting and technical support providers may process data to the extent needed to deliver their services, subject to required legal commitments and safeguards.
We do not sell inquiry data or share it for third-party advertising. We may disclose the minimum required to a competent authority where legally required. Visiting LinkedIn or X is subject to the destination’s policy.
Processing locations
Inquiries are managed from Saudi Arabia. The hosted version uses Sites and Cloudflare delivery services, whose global infrastructure may process technical connection data outside Saudi Arabia. Email services may also involve processing outside the Kingdom, depending on service settings.
Consent to an inquiry is not blanket consent to transfer data to any country. Any transfer or disclosure Cynthra manages outside the Kingdom must meet the Law and transfer regulation, including a permitted purpose, legal basis, suitable safeguards and a risk assessment where required. Contact our privacy channel for details of recipients and processing locations.
Retention and disposal
Form fields remain on your device until you close the contact dialog or reload the page. You control downloaded files and email drafts.
We retain correspondence received until the inquiry is closed and related follow-up is complete, then delete or anonymize data no longer needed. If it becomes a contract, the contractual purpose and legal duties determine retention. Legally required records or data needed for pending proceedings are retained until that reason ends.
Technical log retention is determined by fault and abuse investigation, security needs and the provider’s legal obligations. Disposal includes deletion from the media used, accounting for backup cycles and preventing reuse after the purpose ends.
Your rights and requests
Subject to legal conditions and exceptions, you may be informed about processing, access your data, obtain a readable and clear copy, request correction, completion or updating, and request destruction of data no longer needed.
Withdraw consent at any time by emailing info@cynthra.sa with the subject “Privacy request”. Withdrawal does not invalidate earlier lawful processing. We stop consent-based processing unless another legal basis applies. Withdrawal of data needed for an inquiry may prevent further handling.
Tell us which right you wish to exercise and how to reply. We verify identity proportionately and respond within 30 days. Where a lawful extension is needed, we notify you in advance with reasons; the additional period will not exceed 30 days. We explain any lawful reason a request cannot be fulfilled.
Complaints and protection
Email info@cynthra.sa with the subject “Privacy complaint” and a short description, without unnecessary sensitive documents. We review and respond within 30 days. You retain the right to complain directly to the Saudi Data and Artificial Intelligence Authority through the National Data Governance Platform, under applicable procedures and time limits, and to seek compensation as provided by law.
Cynthra commits to appropriate safeguards, including limiting access, securing communication accounts, suitable file-sharing channels and incident handling and notices under applicable requirements. The hosted site uses HTTPS. Do not send confidential project information before suitable scope and communication arrangements are agreed.
Changes and governing rules
We review this policy when processing or services change and show the new version date here. If a new purpose requires fresh consent, we obtain it before processing. The Personal Data Protection Law and its regulations prevail in a conflict.