Who we are and the scope of this policy
The controller of your data is DIT Information Technology, Commercial Registration 1010817301 · Unified National Number 7030169697 · VAT Number 311628983800003, located at Building 7774, Prince Abdulaziz bin Musaed bin Jalawi St., Al Sulaimaniyah, Riyadh 12221, Kingdom of Saudi Arabia.
This policy applies to the website and its pages in both languages, and to the general payment portal and the payment portals of the Riwaak, Tarsiya, NEXA and Moyasar platforms. Data processed inside the platforms themselves after subscribing is governed by the subscription terms and each platform's data processing agreement.
Data we collect
- Contact data you send yourself: name, organization name, email, mobile number and a description of your need.
- Order and billing data: the requested service or subscription, quantities and terms, the organization's name, VAT number and address, and the invoice number and amount.
- Payment transaction data: the transaction status and reference number, payment method, card type and only its last four digits.
- Limited technical data: IP address, browser type and request time, in server logs for security and troubleshooting.
We do not receive or store the full card number or the security code (CVV). Card details are entered directly with a payment provider licensed by the Saudi Central Bank and certified to PCI DSS. We do not collect sensitive data, and we do not target anyone under 18.
Cookies and local storage
The website uses no tracking or advertising cookies, and no third-party analytics. Your browser stores only one preference — the font you choose for the site — and you can delete it from your browser settings at any time.
Why we process your data, and the legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your request and preparing an offer or consultation | Your consent, and taking steps at your request before contracting |
| Performing the contract or subscription, issuing invoices and collecting payments | Performing an agreement you are party to |
| E-invoicing and tax and commercial obligations | Legal obligation |
| Protecting the website, preventing fraud and troubleshooting | A legitimate interest that doesn't affect your rights |
| Sending offers or marketing news | Only your explicit consent, which you can withdraw at any time |
Who we share your data with
- The licensed payment provider to process the payment, and installment providers when you choose to pay in installments.
- Hosting and technical infrastructure providers that process data on our behalf under contracts binding them to confidentiality and security.
- The Zakat, Tax and Customs Authority and other government bodies when required by law.
- Auditors and professional advisers bound by confidentiality.
We do not sell your data, and we do not share it with anyone for their marketing purposes.
Where data is stored and transferred
We store and process your data inside the Kingdom of Saudi Arabia wherever possible. If one of our providers needs to transfer it outside the Kingdom, this is only done in accordance with the Personal Data Protection Law and the regulation on transferring data outside the Kingdom, with safeguards ensuring an equivalent level of protection.
Retention period
- Consultation requests not followed by a contract: up to 12 months from the last contact, then destroyed.
- Contract, invoice and payment data: the period required by tax and commercial laws.
- Technical server logs: up to 90 days, unless needed to investigate a security incident.
Your rights
- To be informed of how your data is processed and the legal basis for it.
- To access your data and obtain a copy in a clear format.
- To request correction, completion or updating of your data.
- To request destruction of your data once it's no longer needed, unless the law requires its retention.
- To withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any right, email us at info@dit.sa with the subject "Personal data request". We verify your identity and then reply within 30 days. If you're not satisfied with the response, you may file a complaint with the Saudi Data & AI Authority (SDAIA).
How we protect your data
We apply technical and administrative controls detailed in the Data Protection Policy, including encryption in transit, a strict content security policy, least-privilege access and periodic review. If a breach affects your data, we notify the competent authority within the legal period, and notify you without delay where the breach may harm you.
Policy updates and contact
We may update this policy and will publish the new version here with its date, notifying you of material changes before they take effect. Contact: DIT Information Technology, Building 7774, Prince Abdulaziz bin Musaed bin Jalawi St., Al Sulaimaniyah, Riyadh 12221, Kingdom of Saudi Arabia · info@dit.sa · 920029249.