This policy explains how we collect, use and protect your personal data when you use this website or contact us, under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations.
Who we are
The controller of your data is Sadeq Mohammed Al Hubail Professional Consultations (Professional company), licensed by the Saudi Organization for Chartered and Professional Accountants (SOCPA) under licence No. 999, commercial registration (unified number) 7037869141, national address: Makasib Building – First Floor – Office No. 6, 6598 Prince Mohammed Bin Fahd Rd, Ash Shati Al Gharbi Dist., Dammam 32413.
For anything about your personal data, write to info@smh-cpa.com.
Scope of this policy
This policy covers the smh-cpa.com website in Arabic and English, and what reaches us through the contact form, e-mail, telephone and WhatsApp. Client data after an engagement begins is governed by the engagement letter and the professional regulations.
The data we collect
- Contact form data: full name, mobile number, e-mail address and the details of your request (required); company name, service of interest and preferred contact method (optional).
- What you send us by e-mail, WhatsApp or telephone.
- Technical data the server records automatically for security, such as the IP address, browser type and time of visit.
- Map service data, only if you choose to load the map on the contact page.
The form never asks for ID numbers, bank accounts or financial documents, and the website does not accept file uploads.
How and why we use your data
- To answer your requests and questions, and to prepare service proposals when you ask for them.
- To arrange meetings and contact you the way you prefer.
- To keep the website safe and secure.
- To meet our legal obligations.
We do not use your data for marketing without your consent.
Legal basis for processing
- Your consent when you send the contact form; the consent text and its time are kept with your request.
- Steps you ask us to take before an engagement.
- Our legitimate interest in keeping the website safe and secure.
- Legal obligations that apply to us.
Disclosure and sharing
We share your data with the following, and only as far as necessary:
- Service providers who process data on our behalf: the website hosting and maintenance provider, the website's e-mail delivery service (Brevo) and our e-mail service (Microsoft 365).
- Independent services you choose to use, such as WhatsApp (Meta) and Google Maps, which are subject to their own privacy policies.
- Public authorities where the law requires it.
We do not sell your data or disclose it to anyone for their marketing.
Transfers outside the Kingdom
Some of our systems are hosted outside the Kingdom, including the website server, the e-mail delivery service and our e-mail service. We transfer data to them only to answer your requests, with the safeguards set by the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, including standard contractual clauses and data processing agreements with our providers, and after a transfer risk assessment.
Retention and destruction
- Contact form data is not stored in the website's database; it is sent straight to our e-mail.
- We keep correspondence about requests that do not lead to an engagement for 24 months, then destroy it.
- We keep server security logs for 90 days.
- Client records after an engagement are kept for the period set by the Law of the Profession of Accounting and Auditing.
When the purpose ends, we destroy the data securely, so that it cannot be recovered.
Data security
We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted access with multi-factor authentication, regular updates and backups. If an incident affects your data, we notify the competent authority within the legal time limit and notify you without undue delay where required.
Your rights
- To be informed of how your data is collected and processed.
- To access your data and obtain a copy of it.
- To have your data corrected and updated.
- To ask for your data to be destroyed once it is no longer needed.
- To withdraw your consent at any time.
To exercise any of these rights, write to info@smh-cpa.com. We verify your identity and reply within 30 days; this may be extended by another 30 days, with notice to you.
Complaints
If you have a concern about how we process your data, please contact us first. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) within 90 days through the National Data Governance Platform (opens in a new tab).
Cookies
The website uses no analytics or advertising cookies and sets no cookies for visitors; the only cookies it creates are for the sign-in of the people who manage the website.
If you choose to load the map on the contact page, Google may set its own cookies under its own policy.
Links to other websites
The website links to other websites, such as LinkedIn, WhatsApp, Google Maps and the SOCPA register. We do not control these websites, and their own privacy policies apply.
Marketing
We send marketing messages or newsletters only with your prior consent, and you can unsubscribe at any time through the link in each message or by writing to us.
Professional confidentiality
Our clients' information is further protected by the duty of confidentiality in the Law of the Profession of Accounting and Auditing and the international code of ethics adopted in the Kingdom.
Please do not send confidential documents or financial data through the contact form or WhatsApp; ask us for a secure way to exchange them.
Minors
This website is not directed at people below the legal age, and we do not knowingly collect their data.
Changes to this policy
We may update this policy when our practices or the law change. The date of the last update appears at the top of this page, and for any material change we explain here what changed.
Language
This policy is published in Arabic and English; the Arabic text prevails if the two differ.