Effective date: 01/01/2026 Last updated: 12/04/2026
Saudi ICT Shopper News (“we”, “us”, “our”) operates saudishopper.com.sa in English and Arabic. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
This policy is published under the Saudi Personal Data Protection Law (PDPL) issued by Royal Decree M/19, effective 14 September 2024, and the EU General Data Protection Regulation (GDPR) where applicable. See also our Cookie Policy for tracker-specific disclosures.
1. Who we are (the controller)
| Field | Value |
|---|---|
| Legal name | Saudi ICT Shopper News |
| Registered address | 2641 Al Fariq – Dhahrat Laban RIYADH 12564 – 8296 |
| Country | Kingdom of Saudi Arabia |
| Privacy contact | [email protected] |
| General contact | [email protected] |
We are the data controller for personal data collected through this Site. We do not currently have a designated EU representative; if you are in the EEA or UK, you may still contact us directly at the email above.
2. Data we collect
2.1 Data you give us directly
- Account data β name, email, role (if you sign in as a PR contact, editor, agency user, or administrator via Clerk).
- Press release submissions β text, attached documents, images, source URLs, brand and category metadata.
- Email correspondence β messages you send to
press@,privacy@, or any other inbox we operate, including the subject, body, and attachments. - Contact form data β name, email, message body.
- Newsletter signup β email address (if you subscribe).
2.2 Data collected automatically
- Log data β IP address, browser user-agent, referer URL, requested URL, response status, timestamp. Standard web-server logs.
- Cookies β see the Cookie Policy for the full table.
- Analytics β only if you grant consent. We use Google Analytics 4 with IP anonymization, Google signals off, and 14-month retention.
- Cookie consent record β a one-way hash of your IP, your choices, and a timestamp (see Cookie Policy section 4).
2.3 Data from third parties
- Clerk (authentication provider) β when you sign in, Clerk shares your verified email, name, and authentication metadata with us. Clerk’s policy: clerk.com/privacy.
- Google OAuth β if you sign in via Google through Clerk, your basic profile information.
- X / Twitter OAuth β if you authorize our X publishing app, an access token tied to your X user ID (encrypted at rest with AES-256-GCM).
- Gmail API (editorial inbox) β when a press release is forwarded to our ingestion inbox, we receive the sender, subject, body, and attachments. We do not read any other Gmail data.
3. Why we use it (legal basis)
| Purpose | Legal basis (GDPR) / PDPL ground |
|---|---|
| Operate the Site, serve articles | Legitimate interest / public interest in journalism |
| Authenticate editors and PR contacts (Clerk) | Contract / legitimate interest |
| Process press releases you submit | Contract |
| Send transactional emails (account, notifications) | Contract |
| Send newsletter (if you subscribe) | Consent |
| Analytics (GA4) | Consent |
| Detect abuse, prevent fraud, secure the Site | Legitimate interest |
| Comply with Saudi law, court orders, regulatory requests | Legal obligation |
We do not engage in automated decision-making with legal effect, and we do not profile users for marketing.
4. AI processing of editorial content
Press releases you submit are processed by AI systems (Claude, Gemini, OpenAI, GLM, xAI) to draft articles, generate images, and translate between English and Arabic. We disclose this in our AI Use Disclosure.
These AI providers process the submitted text and images according to their published API data-use policies. None of them train on data sent via paid API calls under their current terms (as of the “Last updated” date above). If we change AI providers we will update the disclosure page.
Personal data inside press releases (e.g. a contact name) is processed as part of the publishing workflow. We minimize what we send to AI APIs to the editorial content itself.
5. Sharing and disclosure
We share personal data only with:
- Hosting and infrastructure providers acting as our processors: Cloudflare (CDN + DNS + Worker), HostKey (servers in Paris, France), Amazon Web Services (SES for transactional email).
- Authentication and AI processors under data-processing agreements: Clerk, Anthropic, Google, OpenAI, Z.AI (GLM), xAI.
- Saudi authorities when legally compelled (court order, SDAIA request, etc.).
- Successor entities if we restructure or merge; in that case this policy will continue to bind the new entity.
We do not sell personal data. We do not share data for behavioral advertising.
6. International transfers
Our servers are in Paris, France (HostKey). Some processors are based outside the Kingdom of Saudi Arabia and the EEA β notably AI APIs (United States). Transfers from the EEA/UK rely on Standard Contractual Clauses where applicable. Transfers from Saudi Arabia comply with PDPL Articles 29-31 and SDAIA’s cross-border transfer regulations.
7. Retention
| Data | Retention |
|---|---|
| Account data (Clerk) | While account is active + 30 days after deletion |
| Press release submissions (DB + S3 backups) | 24 months from publication, then anonymized |
| Editorial inbox (Gmail) | 24 months, then archived |
| Email send logs (SES) | 12 months |
| Web-server access logs | 90 days |
| Analytics data (GA4) | 14 months |
| Cookie consent record | 24 months |
| System error logs | 6 months |
When retention expires, data is either deleted or irreversibly anonymized.
8. Security
We apply technical and organizational measures including:
- TLS 1.3 in transit; AES-256-GCM at rest for sensitive tokens
- Encryption keys held in 1Password and on the server in a 0600-mode file
- Clerk-managed authentication with role-based access control
- Rate limiting, CSRF protection, SSRF protection, magic-byte file validation
- Cloudflare WAF + bot mitigation at the edge
- UFW firewall, fail2ban, SSH key-only authentication on origin servers
- Daily encrypted database backups to S3 (
pr-autopilot-backups) - Internal security audits (most recent: 2026-02-20)
No system is perfect. If we discover a breach affecting your personal data we will notify you and the relevant authorities (SDAIA / EU DPA) within 72 hours as required by law.
9. Your rights
Under PDPL Articles 4-6 and GDPR Articles 15-22 you have the right to:
- Access β get a copy of the personal data we hold about you
- Rectification β ask us to correct inaccurate data
- Erasure β ask us to delete your data, subject to legal-hold exceptions
- Restriction β ask us to pause processing while a dispute is resolved
- Portability β receive your data in a machine-readable format
- Object β object to processing based on legitimate interest
- Withdraw consent β at any time, with no effect on past processing
To exercise any right, email [email protected] with the subject “Data Request”. We respond within 30 days (extendable to 60 if complex). We may ask for proof of identity before acting on a request.
You also have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) at sdaia.gov.sa or with your local data-protection authority in the EEA/UK.
10. Children
The Site is not directed at children under 13. We do not knowingly collect personal data from children. If we learn we have collected such data, we will delete it. Contact us at [email protected] if you believe a child has provided personal data.
11. Third-party links and embeds
Articles may link to or embed third-party content (X posts, YouTube videos, etc.). Those services have their own privacy policies; we are not responsible for their data practices. Our Cookie Policy explains how we block third-party embeds by default until you consent.
12. Changes
We update this policy when our practices change or when law requires. Material changes are flagged on the homepage and, where appropriate, by email to registered users. The “Last updated” date at the top reflects the current version.
13. Contact
Saudi ICT Shopper News
2641 Al Fariq – Dhahrat Laban, RIYADH 12564 – 8296, Saudi Arabia
Email: [email protected] Press: [email protected]