¶ Legal — privacy notice
What we collect, why, and your control over it.
A confidentiality-first firm should hold itself to a clear standard. This notice explains what personal data ANSARA processes, on what basis, how it is protected, and the rights you hold under Saudi data-protection law.
The controller of your data
ANSARA is an independent advisory practice based in Riyadh, Saudi Arabia ("we", "us"). For personal data submitted through this website or in the course of an enquiry, ANSARA is the data controller. Questions about this notice, or any request concerning your data, can be sent to hello@ansara.sa.
Only what an enquiry or engagement needs
We practise data minimisation — we collect what is necessary to respond to you and, where you proceed, to deliver an engagement. Specifically:
Purpose and legal basis
We process personal data to: respond to your enquiry and provide a consultation; scope and deliver an engagement if you proceed; meet legal, regulatory, and record-keeping obligations; and maintain the security and proper functioning of the site. Our legal bases align with the Saudi Personal Data Protection Law (PDPL) — principally your consent and the performance of, or steps toward, an engagement, together with our legitimate interest in responding to enquiries and any legal obligation we are subject to.
Security and confidentiality
Confidentiality is foundational to how we work: an NDA can precede any specifics, and your identity, intent, and figures travel on a need-to-know basis — including inside our licensed-partner network. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, and we limit access to those who require it for the purposes above.
Who sees it, and who never does
We do not sell personal data, and we do not share it for advertising. Where an engagement requires regulated work, we share only what is necessary with the specific licensed professionals coordinating that work, under confidentiality obligations. We may disclose data where required by law or a competent authority. Otherwise, your data stays with us and the specific parties an engagement requires.
Kept only as long as needed
We retain personal data for as long as necessary to fulfil the purpose for which it was collected and to meet any legal or regulatory retention requirement. After an engagement, materials are returned or destroyed on instruction, subject to what the law requires us to retain — as stated in our engagement terms before you share anything.
Access, correction, deletion, and more
Under the PDPL you have rights over your personal data, which may include: the right to be informed of how your data is processed; to access it; to request correction of inaccurate data; and to request its deletion where there is no lawful basis to retain it. To exercise any right, contact hello@ansara.sa; we will respond within the timeframe the law requires. You may also raise concerns with the competent Saudi data-protection authority.
Cross-border handling and updates
Where personal data is transferred outside the Kingdom — for example to a licensed professional or service provider — we do so in line with the PDPL's requirements for cross-border transfer. We may update this notice as our practices or the law evolve; the current version always lives at this address. Material changes will be reflected here.
This notice is a clear, good-faith statement of practice and is aligned to the PDPL; it should be reviewed and finalised with qualified counsel before publication and kept current as regulations develop.
Questions about your data?
Write to hello@ansara.sa and a principal will respond. For a confidential first conversation, an NDA can precede any specifics.