Privacy Policy

1. Who we are

OnSocial KSA ("OnSocial", "we", "our", "us") is an AI-powered social media management agency operated by Jamel Ben Amor, based in the Kingdom of Saudi Arabia. We provide content production, strategy, and growth services to brands across the GCC region.

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit onsocial-ksa.com, contact us, or engage our services. We are committed to compliance with the Saudi Arabia Personal Data Protection Law (PDPL) issued under Royal Decree No. M/19 and its Implementing Regulations.

For the purposes of the PDPL, OnSocial KSA acts as the data controller for the personal data described in this policy.

2. What data we collect

2.1 Data you give us directly

Contact data: name, email address, phone number, company name, role — submitted via booking forms, contact forms, or email.
Communication data: the content of emails, calls, messages, and call recordings (with your consent).
Service data: for clients, brand assets, social media account access credentials (where you grant them), content briefs, and any materials you provide.

2.2 Data we collect automatically

Technical data: IP address, browser type and version, device type, operating system, referring URL.
Usage data: pages viewed, time on site, navigation paths, interactions with the site.
Cookies: small files stored on your device. See our Cookie Policy for full details.

2.3 Data from third parties

Calendly: when you book a call, we receive your name, email, time zone, and any responses you provide.
Social platforms: public profile information when you interact with our social accounts.

3. Why we collect it

We use personal data for the following purposes:

To respond to enquiries and provide information you request
To schedule and conduct strategy calls or meetings
To deliver our services to clients under signed agreements
To send service-related communications, invoices, and reports
To operate, maintain, and improve our website
To send marketing communications (only with your explicit opt-in consent, which you can withdraw at any time)
To comply with legal obligations, including tax, accounting, and regulatory requirements in Saudi Arabia
To detect, prevent, and address fraud or security incidents

4. Legal basis for processing (PDPL Article 6)

We process personal data on one or more of the following legal bases:

Consent — for marketing communications, non-essential cookies, and any optional data we collect with your explicit permission.
Performance of a contract — to deliver services you have agreed to receive.
Legitimate interests — to operate our business, respond to enquiries, secure our website, and prevent fraud, provided your rights do not override these interests.
Legal obligation — to comply with applicable Saudi laws and regulations.

We do not sell personal data. We share data only with the following categories of recipients, and only as necessary:

Service providers: infrastructure and tools we use to operate, including hosting (Vercel Inc.), email (Google Workspace), scheduling (Calendly LLC), payments (when applicable), analytics, and AI processing tools.
Professional advisors: lawyers, accountants, and auditors bound by professional confidentiality.
Government authorities: when required by Saudi law, court order, or in response to a lawful request from a competent authority.
Business successors: if OnSocial KSA is sold, merged, or restructured, your data may transfer as part of the transaction, subject to the protections described in this policy.

All third-party processors are required to implement appropriate security measures and process data only on our documented instructions.

6. International transfers

Some of our service providers are located outside Saudi Arabia (for example, Vercel and Calendly are based in the United States). Where personal data is transferred outside Saudi Arabia, we ensure that appropriate safeguards are in place in line with PDPL requirements, including contractual commitments from the recipient to protect your data to standards equivalent to those required under Saudi law.

You may request information about the specific safeguards we use by contacting us at the address below.

7. How long we keep data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Typical retention periods:

Enquiry and prospect data: up to 24 months after last contact, then deleted or anonymised.
Client data: for the duration of the engagement plus 7 years thereafter, in line with Saudi tax and commercial record-keeping obligations.
Marketing data: until you unsubscribe or withdraw consent.
Website analytics: up to 14 months in aggregated form.

8. Your rights

Under the PDPL, you have the following rights regarding your personal data:

Right to be informed about how your data is processed
Right of access to the personal data we hold about you
Right to correction of inaccurate or incomplete data
Right to destruction of your data when it is no longer needed or processing is no longer lawful
Right to withdraw consent at any time, where processing is based on consent
Right to request restriction of processing in certain circumstances

To exercise any of these rights, contact us at info@onsocial-ksa.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

9. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS), access controls, password protection, regular software updates, and the use of reputable third-party processors.

No method of transmission over the internet or electronic storage is 100% secure. In the unlikely event of a personal data breach affecting your rights, we will notify the relevant authorities and affected individuals as required under the PDPL.

10. Cookies

We use cookies and similar technologies to operate our website and improve your experience. For full details, including how to manage cookie preferences, see our Cookie Policy.

11. Children

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified by email (where we have your address) or by a prominent notice on this site.

13. Contact

For any privacy-related question or to exercise your rights, please contact:

OnSocial KSA
Attention: Data Protection
Email: info@onsocial-ksa.com
Website: onsocial-ksa.com
Jurisdiction: Kingdom of Saudi Arabia

Contents