Privacy Policy

Compliance Manager is operated by Allied International Management (AIM), a Saudi company headquartered in the Kingdom of Saudi Arabia (“AIM”, “we”, “us”). For personal data you provide to create and use your account, AIM is the Controller. For personal data contained in documents and answers you upload about your own organization, your organization is the Controller and AIM acts as a Processor on its instructions.

Privacy enquiries: privacy@alliedim.sa · alliedim.sa

• Account data — name, work email address, job title, organization name, phone number, password (stored only as a salted hash).
• Assessment data — the answers you give in an audit questionnaire and the names and contents of documents you attach (policies, procedures, evidence). These may incidentally contain personal data of your staff or customers.
• Usage and security data — sign-in times, IP address, browser type and pages visited, kept in server logs to secure the service.
• Contact-form data — what you send us through the Contact page.

We do not knowingly collect data from anyone under 18, and we do not collect biometric, genetic or credit data.

• To provide the service (accounts, running AI-assisted gap analyses, generating reports) — performance of the agreement with you (PDPL Art. 6).
• To secure the platform and prevent misuse — our legitimate interest, balanced against your rights, and our legal duties under the NCA Essential Cybersecurity Controls.
• To respond to enquiries and provide support — performance of the agreement, or your consent where you contact us before becoming a customer.
• To comply with the law — legal obligation, including responding to lawful requests from Saudi authorities.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by solely automated means that have a legal or similarly significant effect.

Questionnaire answers and document extracts are sent to an AI model to produce the gap analysis. The model provider is contractually prohibited from using your data to train its models. Before submitting a document you should remove personal data that is not needed for the assessment; the report only requires the control evidence.

The platform, its database and its authentication service are hosted inside the Kingdom of Saudi Arabia on SCCC (Alibaba Cloud, operated by stc) in Riyadh. Personal data is not transferred outside the Kingdom except where strictly necessary to provide the AI analysis described in section 4, and then only under the conditions of PDPL Article 29 and the Regulation on Personal Data Transfer outside the Kingdom (appropriate safeguards, data minimization, and no prejudice to national security or the vital interests of data subjects).

• Service providers acting on our instructions under written data-processing terms: cloud hosting (SCCC / stc), AI analysis, transactional email.
• Authorities where required by Saudi law or a binding order, including SDAIA and sector regulators.
• Your organization — reports you generate are visible to other administrators of your organization’s account.

We never share your data with advertisers or data brokers.

• Account data: for as long as your account is active, then deleted or anonymized within 90 days of closure.
• Assessment data and reports: until you delete them or close the account; audit drafts saved in your browser expire after 7 days.
• Security logs: 12 months, in line with NCA logging requirements.
• Records we must keep by law (for example, billing records): the period the law requires.

You have the right to:

• be informed about how your data is processed (this policy);
• access your personal data and obtain a copy in a readable format;
• request correction, completion or updating of inaccurate data;
• request destruction of data that is no longer needed for the purpose it was collected for;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the Saudi Data & AI Authority (SDAIA) if you believe your rights have been infringed.

To exercise a right, email privacy@alliedim.sa from your registered address. We respond within 30 days, extendable once by a further 30 days for complex requests, and free of charge unless a request is manifestly repetitive.

Data is encrypted in transit (TLS) and at rest, access is restricted by role with multi-factor authentication for administrators, and the platform is assessed against the NCA Essential Cybersecurity Controls. If a breach is likely to harm your data or rights, we will notify SDAIA within 72 hours of becoming aware of it and inform you without undue delay, as PDPL Article 20 requires.

We use only strictly necessary cookies: a session cookie that keeps you signed in and a token that protects forms against cross-site request forgery. We set no advertising, analytics or third-party tracking cookies. Some preferences (such as your acknowledgement of the cookie notice and unsent audit drafts) are kept in your browser’s local storage and never leave your device.

We will post any material change here and update the date at the top. Where a change affects how we use data already collected, we will notify account holders by email before it takes effect.

Allied International Management (AIM) · Riyadh, Kingdom of Saudi Arabia · privacy@alliedim.sa · Contact form