Your data is held in trust

Who we are

KAITECH Company (شركة كاي تك), commercial registration 7055398361, Riyadh, Saudi Arabia. National address: 3270 Alhamada St., Riyadh 12821-7570, Saudi Arabia. For anything about your data, use the contact form and choose "Privacy and data", or message us on WhatsApp.

Our principle

We use your data only for the purposes set out below: to give you the kaitech consultancy, service or product you asked for, and the other purposes this policy lists. We never share it with any third party beyond what those purposes need; the providers listed below (such as Amazon Web Services, Microsoft, Meta for WhatsApp, and Google for analytics if you agree to it) act on our behalf, for those purposes only.

What we collect

Each service asks only for what it needs: for example your name and email, and sometimes more, such as your company, department, role and the details of your request. This is what the website's forms collect today:

• When you book a call: your name, email, your company and role, the topics you would like to discuss (and what you write if you choose another topic), the size of your technical team, and the time you chose. Your mobile number is optional.
• When you send a message: your name, email, the department or topic, and your message. Your company and mobile number are optional.
• When you sign up to hear about a product launch: your email address, and the products you are interested in.
• When you send an idea: your name, email, the idea and its description, and the way of working together you chose. Your mobile number is optional, and so is what you tell us about you and your team (asked if you choose to build it with us).
• When you browse, if you agree to analytics (Google Analytics): general usage data, such as the pages you visited, your device type and country, without your name or email.
• Derived codes that don't reveal you: our application doesn't store your device's IP address, only a code derived from it, to protect our forms from abuse (daily limits on requests), and a code derived from your email for the same limits; both expire after 2 days. Our firewall keeps samples of some requests, including the IP address and the address requested, for 3 hours. The launch list keeps a code derived from your email (not the email itself) to avoid duplicate sign-ups and to respect your unsubscribe; it ends with your entry, or 180 days after you unsubscribe. No one outside kaitech can turn any of these codes back into your address.

We need the required fields to do what you ask; without them we can't reply to you or book the call. You can leave the optional fields empty, and your request goes ahead as usual.

We don't record or transcribe calls unless you agree at the time.

Why we use it, and on what basis

• Booking a call: to arrange the call you asked for, send you the invitation and follow up on your booking. Basis: doing what you asked us to do.
• Messages: to reply to you and follow up on your request; for messages to "Careers", to consider you for working with us. Basis: replying as you asked.
• Ideas: to read your idea, reply to you, and work on it with you if you chose that. Basis: replying as you asked.
• Launch list: to tell you when the products you chose launch. Basis: your consent, which you can withdraw at any time with the unsubscribe link.
• Analytics: to learn which pages help our visitors and improve the site. Basis: your consent.
• WhatsApp chats: to reply to what you send us. Basis: replying as you asked.
• Request limits: to protect the service from abuse. Basis: protecting the service.

We never sell your data, we don't use it for marketing without your consent, and we make no automated decisions about you.

Who receives it and where it is kept

Service providers process your data on our behalf, and each receives only what it needs:

• Amazon Web Services, in Ireland: hosting the site; storing what you send through the contact, ideas and launch-list forms, and the booking record (without your name, email or answers); our system logs; and sending our emails (we keep no copy there).
• Microsoft 365, with its data stored in Europe: our email and calendar, which hold your booking details (your name, email and answers, in the notice and the Teams event), copies of the messages and ideas you send, and our replies to you.
• Google, in the United States: analytics data, only if you agree to it.
• Meta (WhatsApp): if you message us on WhatsApp or follow our channel. Following happens on WhatsApp itself, and we don't see followers' numbers. If you message us, the chat happens on WhatsApp itself, under WhatsApp's policy; we see your number and the messages you send us there. You can ask us to delete the chat at any time.

So your data is stored outside the Kingdom, with these providers. We share it with no one else unless the law requires it.

How long we keep it

Messages you send through the contact form, and ideas (including what you tell us about you and your team), for up to 24 months from when you send each one. For a booking, its details (your name, email and answers) are in the notice we receive and the calendar event; we delete both 24 months after the call, or earlier if you ask. Our booking system's own record doesn't include your name, email or answers, and expires 730 days after the call. Launch-list details until you unsubscribe, and for one hour after it so that you can undo it from the same page; a sign-up you have not confirmed expires after 7 days. Unsubscribing stops launch emails. After it, we keep a marker for 180 days that holds no email address; it only limits sign-up confirmations to that address to one a week if it is signed up again. If you become a client, your contract's terms apply. Our system logs are kept for 1 year and don't include your name, email or message. Our firewall keeps samples of some requests, including the IP address and the address requested, for 3 hours. If an email from us bounces or its recipient complains, the address stays on our email provider's suppression list, so we don't write to it again, until we remove it. We review the list once a year, and remove your address if you ask us to write to you again. Data expires at the end of its period and is then removed from our systems, typically within a few days, and from our backups within 35 days. Each message and idea also reaches us as an email in our mailbox; we delete those copies, and our replies to them, 24 months after the message or idea was sent, or earlier if you ask. Careers messages are the exception: we keep them, their copy in our mailbox and our replies to them for up to 12 months from when they were sent, unless we hire you, in which case they move to your employment file. WhatsApp chats disappear automatically after 90 days, and we delete them earlier if you ask.

Keeping your data safe

We protect your data with encryption in transit and at rest, limit access to the systems and people who need it for their work, and our system logs don't include your name, email or message. If a breach affects your data, we notify the Saudi Data and AI Authority (SDAIA) within 72 hours of learning of it, and tell you without undue delay.

Cookies

We keep one small cookie that remembers your analytics choice for 6 months, so we don't ask on every visit. If you agree, Google Analytics adds its own cookies to count visits, and we keep analytics data for 14 months. You can change your choice at any time from "Analytics choices" at the bottom of every page. If you withdraw your consent, analytics stops from then on; it doesn't delete what was sent before. On pages with a form, a security check from AWS WAF runs in your browser to confirm the form is sent from a browser, not an automated program: it looks for signs of automation and inconsistent browser settings, and gathers general signals about how the page is used (such as mouse movements and key presses) that can't be tied to a person. It sends these signals to AWS WAF, which returns an encrypted token that your browser keeps in one cookie, aws-waf-token. The form sends that token to AWS WAF with what you typed, and it stays valid for 15 minutes. This cookie is strictly necessary to send the form, and we don't use it for tracking or advertising, so it needs no consent.

Children

kaitech doesn't provide consultancy to children. Some of our products may be meant for children; those are bought by a responsible adult who gives them to the child, and we collect data from the adult. Any product that processes a child's data says so in its own privacy notice and relies on the guardian's consent.

Your rights

You have the right to know why we use your data and on what basis, to know what data we hold and ask for a copy, to correct it, to ask us to delete it, and to withdraw your consent at any time. Write to us through the contact form, choosing "Privacy and data", or message us on WhatsApp, or write to us by post at our national address above. We may ask you to show the data is yours before we act on your request. We reply within 30 days; if we need longer, we tell you why before that period ends, and the extra time is at most 30 days. If you're not satisfied with our reply, you can complain to the Saudi Data and AI Authority (SDAIA) through the National Data Governance Platform, dgp.sdaia.gov.sa.

Changes

If we change this policy, we publish the new version here with its date. If a change is material, we tell you by email before it takes effect, if we have your address. The Arabic version of this policy prevails. Last updated: 25 October 2026.