ELPHLY PRIVACY POLICY
Effective date: 10 October 2026 · Last updated: 10 October 2026 · Replaces the version dated 9 September 2024 and all later drafts.
1. Who we are. Elphly Company, One Person Company, LLC (“Elphly”, “we”, “us”), registered in the Kingdom of Saudi Arabia under CR (Unified) No. 7041635413 (formerly CR No. 1009095554), 2896 Al Marj, Al Wadi District, Riyadh 13313-7464, is the controller of the personal data described in this Policy. This Policy explains how we collect, use, share, store and destroy personal data through our websites (including elphly.com and its subdomains), forms, communications, events, recruitment and business dealings (the “Services”). Privacy requests: legal@elphly.com (subject “Privacy Request”). General enquiries: hello@elphly.com.
2. Scope. This Policy does not cover personal data we process on a client’s behalf under a services contract; there we act as the client’s processor, the client’s own privacy notice applies, and our duties are set only by that contract. An Elphly platform, application or brand may publish its own notice, which prevails for it. Third-party websites, tools and social media pages linked from the Services follow their own policies, and we are not responsible for them.
3. Personal data we collect.
- Data you give us: name, job title, organisation, email, phone, country and the content of your messages, enquiries, proposals, tender documents, feedback and meeting notes; details needed to contract with, invoice or pay you or your organisation (for example legal entity details, authorised signatories, billing and bank details); CVs and profiles of candidates and experts; event or experience registrations; and your marketing preferences.
- Data collected automatically: technical data that devices send when visiting a website, such as IP address, device and browser type, pages visited, referring page and the date and time, used for security, operation and aggregate statistics. Cookies and similar technologies are described in the Cookie Policy.
- Data from others: your organisation, referrers and partners; public sources and registers (such as the commercial register and government procurement platforms); professional networks; and our service providers.
- Sensitive data and third-party data: please do not send sensitive data (such as health, religious belief, criminal records or biometric data), identity documents or other people’s personal data through our forms or email unless we ask for it for a specific lawful purpose. If you give us another person’s data, you confirm you are entitled to do so and that they have been informed.
4. How we use it and our legal bases. We use personal data to: answer enquiries and prepare proposals (steps you request before a contract, or our legitimate interests); provide, manage, invoice and collect payment for our services (contract and legal obligation); run, secure and improve our websites and business, and prevent fraud and misuse (legitimate interests); assess candidates and experts (steps before a contract, or consent where required); send insights, invitations and marketing (consent where the law requires it, otherwise legitimate interests, with an opt-out in every message); keep records and meet legal, tax, regulatory and court requirements (legal obligation); establish, exercise or defend legal claims (legitimate interests); and for any other purpose we tell you about when collecting the data, or with your consent. Where the law of your country makes consent the main basis, we rely on consent unless an exception applies.
5. Marketing. You can unsubscribe at any time through the link in any marketing email or by writing to legal@elphly.com. Unsubscribing does not stop messages we must send about an enquiry, contract or invoice.
6. Sharing. We share personal data only as needed for the purposes above, with: our service providers (for example hosting, cloud, email, communications, customer management, accounting, security and analytics providers); partners and experts working with us on your matter; our professional advisers, insurers, banks and collection agents; our affiliates; a buyer, investor or successor in a reorganisation, merger or sale of business; courts, regulators and authorities where required or permitted by law or to protect our rights; and others with your consent. We do not sell personal data.
7. Storage and international transfers. Personal data is stored and processed electronically, with paper records only where needed, in our own accounts and with the service providers we use, which may be located in or outside the Kingdom of Saudi Arabia. We transfer or disclose personal data outside the Kingdom only as the Personal Data Protection Law and its transfer regulations permit, and apply the safeguards that law requires.
8. Protecting your data. We take reasonable organisational and technical measures, appropriate to our size and to the nature of the data, to protect personal data, and we rely on established service providers for hosting, email and business systems. No method of transmission or storage is fully secure, so we cannot guarantee security; you send information over the internet at your own risk. If a personal data breach occurs, we will notify the competent authority and affected individuals where and as required by applicable law.
9. Retention and destruction. We keep personal data only for as long as needed for the purpose it was collected for, and afterwards for as long as the law, our legitimate interests in keeping business records or a pending or likely claim or dispute require. We then destroy it or anonymise it so that it no longer identifies anyone.
10. Your rights. Under the Personal Data Protection Law, and other laws where they apply to you, you may have the right to: be informed about how your data is processed; access your data and obtain a copy; ask us to correct, complete or update it; ask us to destroy data we no longer need; withdraw consent at any time, without affecting processing already carried out; and complain to the Saudi Data and AI Authority or another competent authority. To make a request, email legal@elphly.com with the subject “Privacy Request”. We may ask you to verify your identity, and we respond within the periods set by applicable law. We may refuse or limit a request where the law permits, for example where we must keep the data, where it would reveal another person’s data or confidential business information, or where the request is manifestly unfounded or excessive.
11. Technology and AI tools. We use third-party software, cloud services and AI tools to run our business, for example for email, documents, drafting, translation and enquiry handling. These providers process data for us under their terms and the safeguards in section 7. We do not use your data to make decisions about you with legal or similarly significant effects based solely on automated processing.
12. Children. The Services are intended for adults and organisations. They are not directed at people under 18, and we do not knowingly collect their data online. If you believe a child has sent us personal data, contact us and we will delete it.
13. Anonymised data. We may create anonymised or aggregated information that does not identify anyone and use it for any lawful purpose, including statistics, research and improving our services.
14. Limitation. To the maximum extent permitted by applicable law, Elphly is not responsible for loss or harm caused by unauthorised access, interception or events beyond its reasonable control, by the acts of third-party providers or websites, or by information you choose to make public or send without being asked. Nothing in this Policy limits a right you have under a law that cannot be excluded by agreement.
15. Changes. We may update this Policy at any time by posting a new version with a new “Last updated” date. Where a change is material and the law requires it, we will also give notice on the Services or by email. Your continued use of the Services after the update means you have read the updated Policy.
16. Contact. Privacy requests: legal@elphly.com (subject “Privacy Request”) · General enquiries: hello@elphly.com · Post: Elphly Company, 2896 Al Marj, Al Wadi District, Riyadh 13313-7464, Saudi Arabia.
17. Language. This Policy is issued in Arabic and English. If they differ, the Arabic prevails.
Regional note. If you are in the United Arab Emirates (outside the DIFC and ADGM), the European Union, the United Kingdom or another country whose data protection law applies to our processing of your data, you have the rights that law gives you, and you may complain to its data protection authority. We process your data on the legal bases in section 4 that the law recognises and transfer it under the safeguards it requires. We do not sell or share personal information for targeted advertising.