Privacy Policy
Empower (“Empower”, “we”, “us”, or “our”) is a management consulting and digital transformation firm based in Riyadh, Kingdom of Saudi Arabia. This Privacy Policy explains what personal data we collect when you use our website at empower-sa.com, why we collect it, how we use and protect it, and what rights you have over it.
We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, together with its Implementing Regulation and the Regulation on Personal Data Transfer Outside the Kingdom, as supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
By using our website, you acknowledge that you have read and understood this Policy.
Who we are and how to reach us
Empower is the controller of the personal data described in this Policy.
Address: Abu Bakr Al-Siddiq Road, Al Narjis District, Riyadh, Kingdom of Saudi Arabia
Email: info@empower-sa.com
Phone: +966 55 833 0895
If you have any question about this Policy or about how we handle your data, contact us using the details above.
Scope of this Policy
This Policy applies to personal data we collect through empower-sa.com, including its Arabic and English versions, and through the forms, email addresses and phone numbers published on it.
It does not apply to data we process on behalf of our clients under a consulting or digital solutions engagement. In those cases we usually act as a processor on the client’s instructions, and the client’s own privacy notice governs that data.
Personal data we collect
Data you give us directly
When you complete the contact form on our website, we collect:
- Your full name
- Your email address
- Your phone number
- Your organization name
- Any message or comment you choose to write
When you subscribe to our newsletter, we collect your email address.
When you contact us by email, WhatsApp or phone, we collect whatever information you include in that message, together with your email address or phone number.
Data collected automatically
When you browse the website, certain information is collected automatically through cookies and similar technologies:
- Your IP address and approximate location
- Browser type, device type and operating system
- Pages you visited, time spent on each page, and the link or search that brought you to us
- Referral and campaign parameters, such as UTM tags
We do not ask for, and do not intend to collect, sensitive personal data through this website. This includes data revealing racial or ethnic origin, religious belief, political opinion, criminal records, health data, biometric or genetic data, or financial account details. Please do not submit such information through our forms.
Cookies and tracking technologies
Our website uses cookies and tracking scripts, including:
- Google Tag Manager, which loads and manages the tags described below
- Google Analytics and Google Site Kit, which measure traffic and user behaviour so we can improve the site
- LinkedIn Insight Tag, which measures the performance of our LinkedIn campaigns and helps us reach relevant professional audiences
These technologies place cookies on your device. Strictly necessary cookies keep the site functioning and cannot be switched off. Analytics and advertising cookies are optional and are used to understand how the site performs and to improve our marketing.
You can control or delete cookies through your browser settings. Blocking analytics and advertising cookies will not prevent you from using the website, but some features may behave differently.
To learn how these third parties handle data, see the Google Privacy Policy and the LinkedIn Privacy Policy.
Why we process your personal data
We use personal data for the following purposes:
- To respond to your enquiries and requests for a consultation
- To assess whether our consulting, digital solutions or training services fit your needs, and to prepare proposals
- To manage and deliver training programs and professional certification enrolments where you request them
- To send you our newsletter and updates about our services, where you have subscribed
- To measure and improve the performance of our website and our marketing campaigns
- To maintain internal records and to meet our legal, regulatory, accounting and audit obligations in the Kingdom
- To protect the security and integrity of our website and systems
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
Legal basis for processing
Under the PDPL, we rely on the following grounds:
Consent. You give consent when you submit the contact form, subscribe to the newsletter, or accept optional cookies. Consent is freely given, and you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Performance of a contract. Where processing is necessary to prepare for or perform an agreement with you or the organization you represent.
Legal obligation. Where a law, regulation or a competent authority in the Kingdom requires us to process or retain the data.
Legitimate interest. Where processing serves a legitimate interest of Empower, such as securing our systems or understanding how our website is used, provided it does not prejudice your rights and does not involve sensitive personal data.
Who we share personal data with
We disclose personal data only where it is necessary, and only to:
- Service providers who operate our website hosting, email delivery, customer relationship management, analytics and advertising platforms, acting on our instructions and under a written agreement
- Professional advisers, such as auditors and legal counsel, where they need the data to advise us
- Competent authorities in the Kingdom, where disclosure is required by law, by a judicial order, or to protect public safety or the vital interests of an individual
Any processor acting for us is contractually required to apply appropriate security measures, to process the data only for the agreed purpose, and to return or destroy it when the engagement ends.
Transfers outside the Kingdom
Some of the platforms we use, including analytics and advertising services, may store or process data on servers located outside Saudi Arabia. Where a transfer outside the Kingdom takes place, we apply the conditions of Article 29 of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.
That means we transfer data only where the transfer serves a purpose permitted by the PDPL, where it does not prejudice national security or the vital interests of the Kingdom, and where we can rely on an appropriate safeguard, such as standard contractual clauses, binding common rules or an approved certificate of accreditation. We also carry out a risk assessment of the destination and the recipient before the transfer, in line with SDAIA’s guidance, and we limit the transfer to the minimum data needed.
How long we keep your data
We keep personal data only as long as necessary for the purpose it was collected for.
- Contact form enquiries that do not lead to an engagement are kept for up to 24 months, so that we can follow up and answer any related question
- Records connected to a contract or a training enrolment are kept for the period required by Saudi commercial, tax and accounting regulations
- Newsletter subscriber data is kept until you unsubscribe
- Website analytics data is kept according to the retention settings of the analytics platform, typically no longer than 14 months
When the retention period ends, we destroy the data or anonymise it so it can no longer identify you.
How we protect your data
We apply organizational, technical and administrative measures appropriate to the sensitivity of the data, including encrypted connections to our website, access controls that limit data to staff who need it, secured hosting, confidentiality obligations on our employees and suppliers, and periodic review of our controls.
No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that poses a risk to your data or your rights, we will notify SDAIA within 72 hours of becoming aware of it, and we will notify you without undue delay where the breach poses a serious risk to you.
Your rights
Under the PDPL you have the right to:
- Be informed about the legal basis and purpose for collecting your personal data
- Access your personal data held by us
- Obtain a copy of your personal data in a readable and clear format
- Correct, complete or update your personal data where it is inaccurate or incomplete
- Request destruction of your personal data where it is no longer needed for the purpose it was collected for
- Withdraw your consent to processing at any time, where processing is based on consent
Some of these rights may be restricted in the cases set out in the PDPL and its Implementing Regulation, for example where the data is needed for a judicial claim, a security or public interest purpose, or where responding would harm the rights of others.
How to exercise your rights
Send your request to info@empower-sa.com with enough detail for us to identify you and understand what you are asking for. We may ask for proof of identity before we act, so that we do not disclose data to the wrong person.
We will respond within 30 days of receiving your request. Where the request needs exceptional effort, we may extend that period once and will tell you before the original period ends, with the reason for the extension. There is no fee for a standard request.
To unsubscribe from our newsletter, use the unsubscribe link at the bottom of any email, or write to us at the address above.
Complaints
If you believe we have handled your personal data in a way that breaches the PDPL, please contact us first so we can put it right. You also have the right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels at sdaia.gov.sa. A complaint should generally be filed within 60 days of the alleged violation or of the date you became aware of it.
Children
Our website and services are directed at organizations and working professionals, and are not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will destroy it.
Links to other websites
Our website contains links to third-party websites, including our accreditation partners and our social media profiles on LinkedIn, Instagram, X and YouTube. This Policy does not cover those websites. We are not responsible for their content or their privacy practices, and we recommend reading their own privacy policies before sharing data with them.
Changes to this Policy
We may update this Policy to reflect changes in our practices, our technology, or the regulatory requirements in the Kingdom. When we do, we will revise the “Last updated” date at the top of this page. Where a change materially affects how we use your data, we will take reasonable steps to notify you. Please review this page periodically.
Governing law
This Policy is governed by the laws of the Kingdom of Saudi Arabia. Any dispute arising from it is subject to the jurisdiction of the competent Saudi courts.
Frequently Asked Questions
Empower collects the name, email address, phone number, organization and message you enter in the contact form, the email address you give when subscribing to the newsletter, and technical data such as IP address, device type and pages visited that is collected automatically through Google Analytics, Google Tag Manager and the LinkedIn Insight Tag.
No. Empower does not sell personal data and does not share it with third parties for their own marketing. Data is shared only with service providers acting on our instructions, with professional advisers, and with competent authorities where the law requires it.
Email info@empower-sa.com stating that you want your personal data destroyed. We may ask you to verify your identity, and we will respond within 30 days. We may need to keep certain records where Saudi commercial, tax or accounting rules require it.
This Policy is written to meet the transparency requirements of the Saudi Personal Data Protection Law, its Implementing Regulation and the Regulation on Personal Data Transfer Outside the Kingdom, which SDAIA has enforced in full since 14 September 2024.
Some analytics and advertising platforms we use may process data on servers outside the Kingdom. Where that happens, we apply the safeguards required by Article 29 of the PDPL, including standard contractual clauses or an equivalent mechanism, and we assess the risk of the transfer beforehand.
Get in Touch with Our Advisors
We help our clients identify key challenges and anticipate opportunities for growth and innovation through our management consulting services.