Data Subject Requests

1. Your rights

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia you hold the following rights over your personal data. Exercising them is free, and doing so never disadvantages your account.

• Right to be informed — To know what personal data we hold, why we process it, on what legal basis, and who receives it. The Privacy Policy answers this in full.
• Right of access — To obtain confirmation that we process your data and to receive a copy of it.
• Right to rectification — To have inaccurate or incomplete data corrected.
• Right to erasure — To have your personal data deleted, subject to the retention exceptions we publish.
• Right to portability — To receive your data in a readable, structured format that you can take elsewhere.
• Right to restrict or object — To ask us to limit a particular processing activity, or to object to it, where the law gives you that ground.
• Right to withdraw consent — Where processing rests on your consent, to withdraw it at any time. Withdrawal affects future processing, not what was lawfully done before.

2. How to make a request

Some rights you can exercise yourself, immediately, without contacting anyone: correcting your profile details, ending an active session, disconnecting a linked account, and deleting content from your workspace.

For anything else, send your request to privacy@saimahub.ai from the email address registered on the account. State which right you are exercising and, if it concerns part of your data rather than all of it, say which part. A precise request is answered faster.

3. How we verify you

We must be sure the request comes from you. Sending it from the registered email address is normally sufficient.

Where a request is high-risk — erasure of an entire account, or export of a complete data set — we may ask you to confirm from within your signed-in account, or ask for additional detail only the account holder would know. We do not ask for a copy of an identity document unless there is no other reasonable way to verify, and we do not keep such a copy after verification.

If we cannot verify you, we refuse the request and tell you why. Handing your data to someone impersonating you would be the greater harm.

4. Our timetable

• Acknowledgement — Within 3 business days of receiving the request.
• Completion — Within 30 days of verification.
• Extension — Where a request is complex, we may extend once, and will tell you before the first 30 days expire, with the reason.
• Refusal — If we cannot act on a request, we say so within the same 30 days, explain the ground, and tell you how to escalate.

5. If you belong to an organisation

Where your account sits inside a company or agency workspace, that organisation determines how the data in its workspace is used. In that case it is the controller and SAIMA acts on its instructions.

You may still contact us directly, and we will help. But requests concerning workspace content are normally routed to your organisation's administrator, and we will tell you when we do that so you are not left waiting.

6. If you are not satisfied

If you are dissatisfied with our response, reply and ask for it to be reviewed; a person who was not involved in the original decision will look at it again.

You also retain the right to complain to the competent supervisory authority in the Kingdom of Saudi Arabia. Contacting us first is not a precondition to doing so.