Jodfay Solutions
عربي Start Your Project
Legal

Privacy Policy

In plain terms: what we collect, why we collect it, who we share it with, and what you can ask us to do about it at any time.

Last updated: 11 August 2026

1. Who we are and who controls your data

This site is owned and operated by Jodfay Solutions Group ("Jodfay", "we"), a Saudi business that designs and builds e-commerce stores, websites and digital platforms.

Jodfay is the data controller for personal data collected through this site, within the meaning of the Saudi Personal Data Protection Law (Royal Decree M/19) and its Implementing Regulations.

2. What we collect

Data you give us directly

When you submit a project enquiry, use the automated Jodfay Assistant, or reach us by email or WhatsApp, we may collect:

  • Your name and company name
  • Email address and phone number
  • Project type and approximate budget
  • Any details you choose to share about your project

Automated Jodfay Assistant

The assistant answers from approved information and is not a human adviser. You may ask general questions without sharing personal data. If you choose to prepare a project request, the assistant asks for your consent first and collects only the minimum data listed above. Nothing is submitted until you review and explicitly confirm the summary.

We do not retain a full transcript of your chat. We retain only the request summary you confirm, including contact details, service, budget, timing and brief. It is emailed to authorised Jodfay staff and displayed in the secure enquiries dashboard. Do not enter passwords, verification codes, payment data or identification numbers in the chat.

Data collected automatically

Our hosting server may log limited technical data — IP address, browser type, time of visit, pages viewed — strictly for operations, security and performance.

We do not collect payment data. All payments happen off this site through the banking channels agreed in your contract. Your card details never pass through our servers.

3. Why we process it, and on what legal basis

We process your data for these purposes only:

  • To answer your enquiry, schedule a discovery call and prepare a proposal — based on your explicit request and pre-contractual steps.
  • To perform the contract, run your project and communicate during it — based on performance of a contract you are party to.
  • To meet legal obligations such as retaining invoices and tax records — based on a statutory obligation.
  • To protect the site and detect abuse — based on legitimate interest that does not override your rights.

We do not use your data for marketing and will not add you to any mailing list without your separate, explicit consent, which you may withdraw at any time.

4. Who we share it with

We do not sell, rent or trade your personal data in any form.

We disclose it only in these narrow cases:

  • Technical service providers we rely on to operate (hosting, email) — only as needed, and under a contractual duty of confidentiality.
  • Competent authorities where there is a lawful request, court order, or obligation under Saudi law.
  • Our professional advisers (accountant or legal counsel) when necessary, under professional confidentiality.

5. Transfers outside the Kingdom

Data may be hosted or processed inside or outside Saudi Arabia, depending on the server locations used by our hosting, email and operational providers. Any cross-border transfer of personal data is handled under the Saudi PDPL and its regulations, using appropriate legal and contractual safeguards.

6. How long we keep it

  • Enquiries that did not become contracts: kept no longer than 12 months, then destroyed.
  • Client data under contract: for the term of the engagement, then for the period accounting and tax rules require.
  • Technical logs: ordinarily no longer than 90 days, unless they relate to an active security incident or legal claim.

Once the purpose ends and no legal obligation remains, we destroy or anonymise the data.

7. Your rights under the PDPL

The law gives you the following rights, exercisable free of charge:

  • The right to be informed of the legal basis and purpose of collection.
  • The right to access your data and receive a copy in a readable format.
  • The right to rectification — to correct, update or complete inaccurate data.
  • The right to destruction once the data is no longer needed for its purpose.
  • The right to withdraw consent at any time, without affecting lawful processing already carried out.

To exercise any right, email info@jodfay.com.sa. We respond within the period the law prescribes. We may ask you to verify your identity — to protect your own data.

8. Cookies

The site uses only strictly necessary cookies to secure sessions, validate forms and prevent abuse. We currently use no advertising, tracking or third-party analytics cookies, and the site's fonts are self-hosted on Jodfay's servers.

Names, purposes and retention periods are listed in our Cookie Policy. If non-essential analytics are added later, we will update the policy and request consent where required.

9. Data security

We apply appropriate organisational and technical safeguards: encryption in transit over HTTPS, access limited to those who need it to do their job, and regular backups. That said, no method of transmission over the internet is 100% secure. Should a breach affect your data, we will notify you and the competent authority as the law requires.

10. Children's data

Our services are aimed at businesses and adults. We do not knowingly collect data from anyone under eighteen. If we learn we have, we destroy it immediately.

11. Changes to this policy

We may update this policy as our services or the applicable laws change. The revised date appears at the top of this page, and if a change is material and affects your rights, we will tell you directly.

12. Contact and complaints

For any question, request or complaint about your privacy, email info@jodfay.com.sa or message us on WhatsApp at +966 55 587 3878.

We acknowledge a privacy complaint within two business days and target resolution within 10 business days. If our response does not satisfy you, you may escalate through the National Data Governance Platform of the Saudi Data & AI Authority (SDAIA), or another official SDAIA channel. See also our Complaints & Feedback Policy.

Chat on WhatsApp