Privacy policy

1. Who we are

Hamzh Studios ("the studio", "we", "us") is a software studio in the Kingdom of Saudi Arabia that builds websites, web applications, bots, automation and booking platforms. For the personal data described here, we are the controller: we decide why and how it is processed.

• Contact: contact@hamzhstudios.com
• Location: Riyadh, Kingdom of Saudi Arabia

2. The short version

• The site sets no cookies and runs no advertising or tracking scripts. We count visits with a cookie-free tool that does not identify you.
• We collect only what you send us or what we need to deliver and invoice your project.
• We never sell personal data and never use it for advertising without your consent.
• You can ask to see, copy, correct or delete your data at any time, free of charge.

3. What this policy covers

It covers personal data we handle as a business: visitors to our site, people who contact us, clients and their staff, and people we deal with while delivering a project.

When we build or maintain a system for a client and handle personal data inside it, such as that client’s customers, we do so on the client’s behalf and under their instructions. In that case the client is the controller, and their privacy policy and our agreement with them govern that data. Section 8 explains how we treat it.

4. Data we collect

• Enquiries: your name, email address, company, and whatever you include in your message, such as project details, files or links.
• Client and billing details: the name and contact details of the person or business we work for, billing name, tax or registration details where required, quotes, invoices and payment records.
• Project communications: emails, meeting notes, feedback and approvals exchanged during a project.
• Project materials: content, brand assets and files you provide, and access details to accounts or systems you give us so we can do the work.
• Payment confirmations: PayPal or your bank tells us that a payment was made, its amount and the payer’s name. We never receive or store card numbers or online banking passwords.
• Technical data: when you visit the site, our hosting provider, Cloudflare, processes your IP address, browser type and the pages requested, to deliver the site and protect it from attacks and abuse.
• Visitor statistics: we use Cloudflare Web Analytics to count page views. It uses no cookies, does not identify you and does not follow you across other sites. It records things like the page visited, the site that linked to it, the country and the type of device.
• Student rate: if you ask for the student discount, the proof of enrolment you send us.

5. What stays on your device

The site remembers your currency and accessibility choices by saving them in your browser’s local storage. This data never leaves your device, is not a cookie, and is not linked to you. You can remove it at any time by clearing this site’s data in your browser settings.

6. Why we use it, and on what basis

• To reply to you and prepare a quote, because you asked us to (steps before a contract).
• To deliver, support and invoice your project, because it is necessary to perform our agreement with you.
• To keep accounting, tax and legal records, because the law requires it.
• To keep our site and systems secure and prevent fraud, based on our legitimate interest, balanced against your rights. We never rely on this basis for sensitive data.
• To send news about our services, only with your prior consent, and you can withdraw it at any time.

We do not make decisions about you based solely on automated processing.

7. Sensitive data

We do not ask for sensitive data such as health, religious or financial account data. Please do not send it to us unless a project truly needs it. If it does, we will agree in writing how it is handled and ask for your explicit consent where the law requires it.

8. Data inside client projects

When a client gives us access to a system that contains personal data, we:

• use it only to do the work the client asked for, and follow the client’s written instructions;
• limit access to the team members working on that project, who are bound by confidentiality;
• do not copy data out of the client’s systems unless the work requires it, and delete any working copies when the project ends;
• tell the client without undue delay if we become aware of a breach affecting their data;
• at the end of the project, return or delete the data as the client instructs, and ask the client to change any passwords or keys they shared with us.

9. Who we share it with

We share personal data only when needed, and only with:

• Service providers that help us run the studio, such as email and file hosting, Cloudflare for the website, and PayPal or your bank for payments. They process data only for that service and under their own security and confidentiality obligations.
• Professional advisers such as accountants and lawyers, under a duty of confidentiality.
• Authorities when the law, a court or a competent authority requires it.
• A successor if the studio is merged or transferred, who would be bound by this policy.

We never sell or rent personal data.

10. Transfers outside the Kingdom

Some of our service providers, including Cloudflare, PayPal and our email provider, may process data on servers outside the Kingdom of Saudi Arabia. We make such transfers only as the Personal Data Protection Law and its regulations allow, relying on appropriate safeguards such as standard contractual terms, and we keep them to the minimum needed for the service.

11. How long we keep it

• Enquiries that do not become a project: deleted within 12 months of our last message.
• Client, contract and invoice records: kept for as long as accounting, tax and commercial record keeping rules require, then deleted.
• Project materials and access details: returned or deleted when the project and any agreed support period end, unless you ask us to keep them.
• Proof of enrolment for the student rate: deleted once the discount has been checked.
• Hosting logs are kept by Cloudflare under its own retention periods.

12. How we protect it

We take reasonable technical and organisational measures to protect personal data, including encrypted connections to this site, access limited to the people who need it, strong authentication on our accounts, and confidentiality duties for everyone on the team. No system is completely secure, but we work to keep risk low.

13. If something goes wrong

If we become aware of a personal data breach that could harm you, we will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of it, and tell you without undue delay in clear language, including what happened and what you can do to protect yourself.

14. Your rights

Under the Personal Data Protection Law you have the right to:

• be informed about how and why your data is processed, which is what this policy does;
• access your data and receive a copy in a readable format;
• ask us to correct or complete data that is inaccurate or incomplete;
• ask us to delete data we no longer need, unless the law requires us to keep it;
• withdraw your consent at any time, where we rely on consent, without affecting processing already done.

To use any of these rights, email contact@hamzhstudios.com. We may ask you to confirm your identity first. We will reply within 30 days, and if a request is complex we may extend this by up to another 30 days and tell you why. There is no charge.

15. Marketing

We only send news or offers to people who have agreed to receive them, and every message tells you how to stop receiving them. Replying to a project email does not sign you up for anything.

16. Children

Our services are meant for adults and businesses. If someone under 18 wants to work with us, for example on a student project, we need the consent of their parent or guardian before we collect their data or start the work.

17. Links to other sites

Our site links to other sites, such as GitHub and client websites. Their privacy practices are their own, and we encourage you to read their policies.

18. Complaints

If you have a concern, please contact us first at contact@hamzhstudios.com so we can try to fix it. You also have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

19. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new effective date, and if a change is significant we will tell our current clients by email.

20. Language

This policy is available in Arabic and English. If there is any difference between them, the Arabic version prevails.