Privacy Policy

Introduction and Scope

The Personal Data Protection Law was issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, and its provisions and implementing regulations apply under the supervision of the Saudi Data and Artificial Intelligence Authority (SDAIA) in its capacity as the competent authority. In implementation of the Law, this policy sets out the personal data the Company collects through this website, the purpose of its collection, how it is processed, stored, and destroyed, and the rights of data subjects and how those rights are exercised.

This policy applies to the hhab.com.sa website and to the data collected through it. It does not apply to third-party websites to which pages of this website may refer.

The Data Controller

The data controller for the personal data collected through this website is HHAB Professional Services Company, a professional limited liability company licensed by the Saudi Organization for Chartered and Professional Accountants, commercial registration No. 7052005753, with its head office at Building 4400, Omar Ibn Abdulaziz Branch Road, Al Rabwah District, Riyadh 12816, Saudi Arabia.

The Data Collected

The website collects the data that the user provides directly through the contact form, comprising:

• The name and email address.
• The mobile number, which is an optional field.
• The service concerned by the enquiry, the subject and text of the message, and any information the sender may include in it.

Through the careers form, the website also collects the data the applicant provides with the application, comprising the applicant's identifying details, professional field, years of experience, qualifications, CV, and any information included in the application.

Technical data is also generated automatically when the website is browsed, within the operational server logs, such as the Internet Protocol (IP) address, browser type, time of visit, and pages requested; it is used for the purposes of operating and securing the website.

The website does not seek to collect sensitive data and does not ask its visitors to provide it. Providing data through the contact form is a choice that rests with the individual; however, withholding the minimum data, namely the name, email address, and message text, prevents the request from being processed and answered.

Purposes of Processing and Their Legal Basis

The Company processes the personal data collected through the website for the following purposes:

• Receiving, answering, and following up on enquiries and requests submitted through the contact form, based on the consent of the data subject expressed by completing and submitting the form.
• Reviewing employment applications submitted through the careers form and contacting applicants when employment opportunities become available that match their qualifications, based on the consent of the applicant expressed by submitting the application.
• Operating and securing the website and monitoring attempts at misuse, based on the legitimate interest of the data controller under the provisions of the Law and without prejudice to the rights of data subjects.
• Meeting statutory requirements where they exist.

The Company does not use the data collected through the website for direct marketing, and does not send promotional material except with prior consent, which the data subject may withdraw at any time.

Cookies and Embedded Content

The website does not create cookies of its own to track visitors. The website may use statistical measurement tools that present the number of visits and the way pages are used in an aggregate form that does not directly identify individuals, and this policy will be updated upon the introduction of any tool that changes the nature of the data processed.

The contact page includes a map embedded from the Google Maps service to display the location of the head office, and the provider of that service may create cookies or collect browsing data governed by its own privacy policy. WhatsApp links on the website's pages likewise lead to an external application governed by the policies of its operator, and reviewing the policies of those parties before using their services is advisable.

Disclosure and Sharing of Data

The Company does not sell personal data and does not disclose it to any party for marketing purposes. Disclosure is limited to the following cases:

• Technical service providers engaged by the Company to host the website and operate the corporate email service, who process the data on the Company's behalf, on its instructions, and under confidentiality obligations.
• The competent authorities, where the law requires disclosure or pursuant to a statutory request issued by an authorized body.

Transfer of Data Outside Saudi Arabia

Some data may be processed or stored with technical service providers whose processing centers are located outside Saudi Arabia, including the corporate email service. In doing so, the Company complies with the provisions of the Law and of the regulation governing the transfer of personal data outside Saudi Arabia, ensuring a level of protection for the data no lower than the level prescribed by the Law.

Data Retention and Destruction

The Company retains personal data for the period necessary to achieve the purpose of its collection. Contact form messages and the correspondence connected with them are kept for the period necessary to process and follow up on the request and to document professional dealings, and are then destroyed in accordance with the provisions of the Law, taking into account the retention periods required by the related laws and by professional requirements.

Employment applications and the CVs attached to them are kept in the applicant database for reference when suitable employment opportunities become available, and the data subject may request their destruction at any time through the contact channels set out below.

Rights of Personal Data Subjects

The Law guarantees the personal data subject rights that may be exercised at any time, including:

• The right to be informed of how the data is collected and of the legal basis for its collection and processing.
• The right to access the data held by the Company and to request a copy of it in a clear format.
• The right to request the correction, completion, or updating of the data.
• The right to request the destruction of the data when it is no longer needed, unless a statutory basis for retaining it exists.
• The right to withdraw, at any time, the consent on which processing is based, without affecting the lawfulness of the processing that preceded the withdrawal.

Requests to exercise these rights are submitted through the contact channels set out below and are handled free of charge within the statutory periods. Where needed, the data subject may lodge a complaint with the authority competent for personal data protection in Saudi Arabia.

Data Security

The Company applies appropriate organizational and technical measures to protect personal data from unauthorized access, disclosure, alteration, or loss, and access to it is limited to those whose duties so require. In the event of an incident affecting personal data, the incident is handled and notified in accordance with the provisions of the Law and its regulations.

Updates to This Policy

This policy is reviewed periodically and updated whenever the need arises or statutory requirements change, and the date of the most recent update is published at the bottom of this page.

Contact Regarding This Policy

Enquiries and requests relating to this policy, or to the exercise of the rights set out in it, are directed to HHAB Professional Services Company by email at info@hhab.com.sa, by telephone on +966 11 238 7398, or in writing to the head office address stated above.

This policy was last updated on 30 July 2026.