Privacy Policy

1. Scope of this policy

This policy applies to the personal data that Roundout Company processes through its website at roundout.sa and roundout.com.sa, in Arabic and English, through its contact, consultation booking and careers forms, and through the emails we exchange with you as a result.

It does not apply to: (a) our products, which have their own websites and privacy policies (FLARE, RUH Watch and Satview); (b) personal data we process on our clients' behalf while carrying out their projects, which is governed by our agreement with them (see section 16); or (c) websites and services run by others that we link to.

2. The controller and how to contact us

The controller of your personal data is:

Name

Roundout Company (شركة راوندآوت)

Legal form

Limited liability company

Activity

Information technology services

Commercial Registration (unified number)

7055349612

Email

[email protected]

For any question or request about your personal data, email [email protected] with "Privacy request" in the subject line. Privacy requests reach the person responsible for personal data protection at Roundout.

3. Definitions

Words and expressions in this policy have the meanings given to them in the Personal Data Protection Law and its regulations, including:

The Law

The Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H, together with its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom.

The Authority

The Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority for the Law.

Personal data

Any data, whatever its source or form, that leads to identifying you specifically or makes it possible to identify you directly or indirectly, such as your name, email address, mobile number or IP address.

Sensitive data

Personal data relating to a person's racial or ethnic origin, or religious, intellectual or political belief, as well as security and criminal data, biometric data that identifies a person, genetic data, health data, and data indicating that one or both of a person's parents are unknown.

Processing

Any operation carried out on personal data by any means, manual or automated, including collecting, recording, storing, using, disclosing, transferring and destroying it.

Controller

The entity that determines the purpose and manner of processing personal data: in this policy, Roundout Company.

Processor

An entity that processes personal data for the controller's benefit and on its behalf, such as our service providers.

Disclosure

Enabling any person, other than the controller or the processor, to obtain, use or view personal data.

Destruction

Any action on personal data that makes it impossible to view or recover again.

4. The personal data we collect

We collect only what is needed for the purposes in section 6. Fields marked optional in our forms really are optional; if you leave out a required field, we can't reply to you, book the consultation or consider your application.

5. Cookies and browser storage

Our website, at roundout.sa and roundout.com.sa, doesn't set cookies in your browser, and we use no cookies for advertising, tracking or profiling. What is used in your browser is limited to the following:

• The site keeps a single timestamp in your browser's session storage while you move between its pages, so the loading sign isn't shown twice. It is deleted as soon as the next page reads it, and it doesn't identify you.
• On pages with a form, a security check provided by our network-protection provider analyses technical signals from your browser and your IP address to tell people from automated programs. It does not read what you type in the form and is not used for tracking or advertising.
• If our network-protection provider needs to verify a visit, for example during an attack, it may set a strictly necessary security cookie for that purpose alone.

Because these are necessary for the site to work securely, we don't ask for consent to them. You can clear storage and cookies at any time in your browser settings.

6. Purposes and legal grounds

We process personal data only for the following purposes, on the legal grounds the Law allows:

• Replying to your message (contact form data): your consent, which you give by ticking the consent box in the form before sending. If you email us directly, your consent expressed by writing to us.
• Arranging and holding the consultation you book (booking data): your consent, which you give by ticking the consent box in the booking form.
• Considering your job application (careers form data): your consent, which you give by ticking the consent box in the careers form.
• Delivering the site, protecting its security and information, preventing abuse of its forms, and counting visits in aggregate (technical data and the two booking codes): our legitimate interests in running the site, and in protecting network and information security and detecting fraud, both of which the Implementing Regulations recognise as legitimate interests, without prejudice to your rights or conflict with your interests, and without processing any sensitive data.
• Meeting legal obligations (any of the data, as far as needed): where processing is carried out under another law, or a competent authority requests it in accordance with the law.

Each form asks for your consent for its own purpose only. You can withdraw it as easily as you gave it: by emailing [email protected] or, for a booking, by cancelling it with the link in your confirmation email.

We will not process your data for a purpose incompatible with the above before notifying you, and obtaining your consent where the Law requires it.

7. Sharing and disclosure of personal data

Your data is seen only by our team members who need it for the purposes above, who are bound by confidentiality. We share it outside the company only with:

• Service providers who process data on our behalf (processors): hosting and infrastructure, network protection and content delivery, bot protection, email delivery, and our company email and video-meeting provider. They process data on our instructions, under agreements that oblige them to protect it. Some also use limited technical data, such as security signals and delivery logs, to run and secure their own services.
• Professional advisers, such as lawyers and auditors, where needed, under a duty of confidentiality.
• Competent authorities, such as judicial and regulatory bodies, where a law, a judgment or an order requires it.

We don't sell, rent or trade personal data, and we don't disclose it to anyone for marketing. On request, we will give you the names of the service providers that process your data.

8. Transfers outside the Kingdom

Most of the processors in section 7 process data outside Saudi Arabia, or on servers in more than one country, to host, protect and deliver the site and to deliver email.

We transfer your data outside the Kingdom, or process it there, only in accordance with Article 29 of the Law and the Regulation on Personal Data Transfer outside the Kingdom: for a purpose the Law allows, such as providing what you ask of us through the site; without prejudice to national security or the vital interests of the Kingdom; limited to the minimum data needed; and to recipients that offer a level of protection no lower than the Law guarantees, or with the appropriate safeguards the Regulation sets where they apply.

You can ask us for information about these transfers, the recipients that process your data, and the safeguards that apply.

9. Retention and destruction

We keep personal data only as long as needed for the purpose it was collected for, then destroy it:

• Messages through the contact form or by email: 12 months after our last reply. If they lead to an agreement with you, they are kept with the project records for as long as the law requires.
• Job applications and CVs: one year from receipt, then destroyed. If you join us, they become part of your employment file.
• Booking details: 12 months after the consultation in our email; the booking system deletes its record automatically once the booked time has passed.
• Technical and security logs: kept by our service providers for short periods for security, then deleted or anonymised.
• Copies of the emails the site sends: kept by our email delivery provider for 30 days, then deleted.

We keep data after its purpose has ended only in the two cases the Law requires: where a legal ground requires keeping it for a set period, in which case it is destroyed at the end of that period or of the purpose, whichever is later; or where it is closely connected to a case before a judicial authority, in which case it is destroyed once the judicial proceedings are complete.

Destruction includes backups, and we ask the processors that received the data to destroy it too.

10. How we protect your data

We apply organisational, administrative and technical measures suited to the nature and sensitivity of the data, in line with recognised controls and standards, including:

• encrypting data in transit to and from the site;
• limiting access to the team members who need it, with multi-factor authentication on our accounts;
• controlling booking abuse with one-way codes instead of storing your email address or IP address; and
• contracting with processors that give the guarantees needed to protect data, verifying their compliance, and reviewing our measures regularly.

No transmission of data over the internet is completely secure. If personal data is leaked, damaged or accessed unlawfully, and this may harm your data or conflict with your rights or interests, we will notify the Authority within 72 hours of becoming aware of it, notify the other competent authorities where the law requires, and notify you without undue delay in plain language, explaining what happened, what we have done and what you can do to protect yourself.

11. Your rights

The Law and its regulations give you the following rights:

• The right to be informed, including of the legal ground and purpose for collecting your personal data, which this policy provides.
• The right of access to your personal data that we hold.
• The right to request your data that we hold in a readable and clear format; we provide it electronically in a commonly used format.
• The right to request correction of your data, or that it be completed or updated, and to ask that its processing be restricted while its accuracy is checked.
• The right to request destruction of your data that is no longer needed, without prejudice to what the Law requires us to keep (section 9).
• The right to withdraw your consent at any time, without affecting processing carried out before you withdraw it.

To exercise any of these rights, email [email protected] with "Privacy request" in the subject line. We record every request, and may ask for information to verify your identity before acting on it, which we use only for that purpose. We don't charge for these requests.

We reply within 30 days of receiving your request. This may be extended by up to 30 more days if the request needs unexpected or unusual effort or you make several requests, in which case we tell you in advance of the extension and the reason.

We may decline a request in the cases the Law and its regulations set, for example where it is repeated without justification, needs unusual effort, would harm others or their rights, or where a law requires us to keep the data. We will tell you why if we do.

12. Complaints

If you're not satisfied with how we handle your data or your request, please contact us first so we can try to put it right.

You have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform within 90 days of the incident or of becoming aware of it, under the Implementing Regulations. You may also claim compensation before the competent judicial authority for damage you suffer as a result of a breach of the Law.

13. Marketing messages

We don't send marketing or promotional messages through the site, and we use your contact details only to deal with your message, booking or application. If we ever want to send you news about our services, we will ask for your express consent to that separately, not as part of accepting this policy or any contract. Every message will include an easy, free way to stop receiving them, and we stop within 24 hours of your request.

14. Automated decisions

We don't make decisions about you based solely on automated processing, and we don't build profiles of visitors; a member of our team deals with every message, booking and application. Automated checks only protect the forms from abuse, such as limiting how many upcoming times one person can book.

15. Minors and persons lacking full capacity

The site and its forms are intended for people who have reached the age of majority, which is eighteen full Hijri years under the Civil Transactions Law. We don't knowingly collect personal data from anyone below that age, or from anyone who lacks full or partial legal capacity, without the consent of their legal guardian. If you learn that we have received such data, contact us and we will destroy it.

16. Our role in client projects

When a client engages us to build, host, integrate or support its systems, we may process personal data on the client's behalf. In that case the client is the controller and we are the processor, acting under our written agreement and the client's instructions. Requests about such data should go to the client, and we help the client respond to them.

17. Links to other websites

The site links to our product websites and to other websites. Their owners process data under their own policies, which we encourage you to read; this policy does not cover them.

18. Changes to this policy

We review this policy regularly, and may update it to reflect changes in our practices or in the law. We will publish the updated version on this page with its date at the top. If a change is material, we will draw attention to it on the site and notify you or ask for your consent where the Law requires.

Update record:

• 23 October 2026: roundout.com.sa added as the site's second domain.
• 22 October 2026: full revision of the policy, with the summary added.
• 15 October 2026: first version.

19. Language

This policy is published in Arabic and English. If the two differ, the Arabic text prevails.