Privacy policy

Effective date: 15 Feb 2025 Version: 1.0

1. Who we are

This Privacy Policy is issued by Istithmar Altaqniyah, a company registered in the Kingdom of Saudi Arabia under Commercial Registration number 1010336999, with its registered address at 8646 King Abdulaziz Road, Al Ghadeer District, Riyadh, Saudi Arabia (“Experia,” “we,” “us,” or “our”). This policy explains how we collect, use, disclose, and protect personal data when you visit experiaapp.com, submit a contact or demo-booking form, or otherwise interact with us as a prospective or existing customer.

This policy is written to comply with the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its Implementing Regulations, issued by the Saudi Data & AI Authority (SDAIA). Where we process data of individuals in other jurisdictions, we also have regard to those jurisdictions’ applicable data protection laws (for example the GDPR for EU/UK visitors and the CCPA for California residents), to the extent they apply to us.

2. Lawful basis for processing

Under Article 5 of the PDPL, we process personal data only where at least one of the following applies:

Consent — you have given clear, informed consent for a specific purpose (for example, submitting the contact form or booking a demo).
Contractual necessity — processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you.
Legitimate interest — processing serves a legitimate interest of ours or a third party and does not override your rights and freedoms. We do not rely on legitimate interest as a basis for processing sensitive data.
Legal obligation / public interest — processing is necessary to comply with a legal obligation, or to protect vital or public interests, as permitted by law.

3. What data we collect, and why

We collect data from three groups of people: website visitors, contact and demo-booking form submitters, and customers/staff of customers we have an ongoing relationship with. We don’t currently process payment card data, health data, or other special categories of sensitive data as part of the website’s own operation.

Website visitors (automatic collection). Standard web server and analytics data — IP address, browser/device type, pages visited, referring site. Used to operate and secure the website and understand how it’s used.

Contact form and demo-booking submitters (voluntary). Name, email address, phone number, and any message/notes/demo-question answer you choose to provide. Used to respond to your enquiry, schedule and run the requested demo, and — with your consent — to follow up about Experia’s products and services.

Website referral journey. When you submit the contact or demo-booking form, we record, alongside your submission, the pages you visited on experiaapp.com during that visit and the site that referred you to us. This is held only in your browser for that visit, is never shared with third parties, and reaches us only if you submit a form. We use it solely to understand how enquiries reach us; see Section 7 for how this differs from advertising cookies.

Customers and their staff (ongoing relationship). Once you become a customer, we additionally process the business contact details, role, and communications of your authorized users to the extent necessary to deliver and support the Experia platform, in line with any signed agreement between us.

We do not use any of the above to train or fine-tune generic, non-custom AI or machine learning models. Where we use Google Workspace APIs internally, that use is limited to facilitating our own staff’s work (e.g., calendar, mail) and is not used to develop or improve Google’s or our own AI models.

4. Advertising cookies and conversion measurement

We advertise on Google. To measure whether those advertisements lead to enquiries, this website loads the Google tag (gtag.js) on every page and reports an event to Google Ads when you successfully submit the contact form or book a demonstration. That event records only that a submission took place, together with a nominal value — it does not include your name, email, phone number, message, or the referral journey described in Section 3.

For this purpose, Google may set and read cookies in your browser and use them to attribute your visit to a specific advertisement and to show you Experia advertisements on other sites. This processing is carried out by Google as an independent controller under its own terms — see Google’s Privacy Policy (policies.google.com/privacy) and its explanation of partner site data use (policies.google.com/technologies/partner-sites).

You can opt out by disabling ad personalisation in your Google account (adssettings.google.com) or by blocking third-party cookies or the domain googletagmanager.com in your browser. This does not affect your ability to use the website, contact us, or book a demonstration.

5. Booking a demo

If you book a demonstration, your name, email, phone number, and demo-answer are sent to Microsoft Bookings (operated under our Microsoft 365 tenant) to create the appointment and Teams meeting, and are visible to the Experia staff member assigned to your booking. Microsoft processes this data as an independent processor/controller under its own terms — see Microsoft’s Privacy Statement (privacy.microsoft.com/privacystatement). Your booking confirmation email comes directly from Microsoft Bookings.

We do not sell, rent, or trade personal data. We share it only with:

Service providers acting on our behalf — our hosting provider, our email delivery provider, and Microsoft (for demo bookings) — each bound by confidentiality and data-protection obligations, and permitted to use the data only to provide the relevant service to us.
Google, as an independent controller, solely for the advertising and conversion-measurement purpose described in Section 4.
Legal and regulatory authorities, where required by applicable law.
A successor entity, in the event of a merger, acquisition, or sale of assets — subject to that entity being bound by materially equivalent privacy commitments.

We do not share personal data with any other third party without your consent, except as described above.

7. International data transfers

Some of our service providers (for example, WhatsApp Business Platform, email provider, and Microsoft) may process data outside the Kingdom of Saudi Arabia. Where we transfer personal data internationally, we do so only where the PDPL and its Implementing Regulations permit — including transfers to a jurisdiction with an adequate level of protection, transfers subject to Standard Contractual Clauses issued by SDAIA, or another SDAIA-recognized safeguard — and only after conducting the risk assessment the Implementing Regulations require.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purpose it was collected for, or as required by applicable law, for example:

Contact/demo-booking submissions that do not lead to a customer relationship: retained for 36 months, then deleted or anonymised.
Customer and authorized-user data: retained for the duration of the customer relationship plus 10 years afterward, or as required by Saudi commercial/tax record-keeping law, whichever is longer.
Website analytics data: retained per our analytics provider’s default retention period, currently 36 months.

When data is no longer needed, we delete or anonymise it using methods consistent with SDAIA’s guidance (e.g., secure deletion or anonymisation).

9. Your rights

Under the PDPL, you have the right to:

Be informed about how your data is collected and used (this policy).
Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request destruction of your personal data, where applicable.
Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@experiaapp.com. We will respond within the timeframe required by the PDPL Implementing Regulations. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data & AI Authority (sdaia.gov.sa) or via the National Data Governance Platform (dgp.sdaia.gov.sa).

10. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, including encryption in transit, access controls limiting data to authorized personnel, and periodic security review of the systems that handle this data.

11. Data breach notification

In the event of a data breach affecting your personal data, we will notify affected individuals and the relevant regulatory authority without undue delay, in accordance with the PDPL Implementing Regulations and any applicable notification timelines.

12. Automated decision-making

We do not currently make any decision about you based solely on automated processing that produces a legal or similarly significant effect on you without human involvement. If this changes, we will update this policy and, where required, seek your explicit consent first.

13. Children’s data

experiaapp.com and its services are directed at businesses and are not intended for individuals under 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time. The “Effective date” above reflects the latest revision. Material changes will be posted on this page; where required by law, we will seek renewed consent before relying on a material change.

15. Contact us / Data protection contact

Email: privacy@experiaapp.com Phone: 920012387 Address: 8646 King Abdulaziz Road, Al Ghadeer District, Riyadh, Saudi Arabia