Privacy Policy

Sultan Ahmed Al-Shubaily Certified Public Accountants and Auditors Company, Riyadh, Kingdom of Saudi Arabia. We act as the controller of personal data collected through this website in accordance with the Personal Data Protection Law and its Implementing Regulation.

For any enquiry about your data, the dedicated email address is listed in the rights section below.

We collect the following data depending on the service you use:

Contact form: name, email address, mobile number (optional), company name (optional), requested service, and message text.

Careers form: name, email address, mobile number, city, application type, field of interest, years of experience, LinkedIn URL if provided, cover note, and CV file.

Limited technical data generated by operating the site, such as an approximate IP address and error logs held by the hosting provider.

We do not request sensitive personal data in our forms, and we ask you not to include it in a message or CV unless it is necessary for the purpose of the request.

We process your data for the following purposes, each with its basis:

Responding to and following up on contact enquiries, based on your consent when submitting the form, and on pre-contractual steps when a service is requested.

Reviewing career applications and contacting applicants, based on the applicant’s consent and pre-contractual steps for employment.

Protecting forms from abusive automated submissions, securing the site, and handling incidents, based on the firm’s legitimate interest in protecting its systems.

Complying with legal and professional requirements related to accounting and audit practice, where applicable.

We do not use your data for marketing purposes and we do not send promotional messages.

We do not sell or trade your data.

Data may be processed by operational providers we need to run the site: hosting, database and storage, and email notification services when enabled. Those providers handle data only as needed to deliver their service, under contractual confidentiality and protection obligations.

Internal access is limited by work permissions: career applications are accessible only to people responsible for HR, and contact requests only to those responsible for responding.

We may disclose data to competent authorities if required by a legal order or obligation, and we document such requests internally.

The site uses cookies or local storage only as needed to operate and secure it, such as validating form submissions and basic display preferences.

We do not use advertising cookies and we do not track your behaviour across other websites.

reCAPTCHA may set its own files under Google’s policies, as described in the next section. You can manage cookies in your browser settings; disabling necessary files may prevent some parts of the site from working.

We use Google reCAPTCHA v3 to protect the contact and careers forms from abusive automated submissions. The service runs in the background, and Google may collect technical and behavioural data about interaction with the page under its own policies.

Hiding the reCAPTCHA badge does not disable the service; we therefore show a notice near the forms and provide the following links:

• Google Privacy Policy
• Google Terms of Service

We keep contact requests for as long as needed to respond and follow up, then delete them or restrict access when no longer needed.

We keep career applications and CVs throughout the selection period, and may retain them for a further period to consider later vacancies unless the applicant requests deletion.

We may keep some data longer where required by a legal obligation or needed to establish or defend a right.

We apply appropriate technical and organisational controls to protect data in transit and at rest, including encrypted connections (HTTPS) and access limited by permission.

No internet protection is absolute. If an incident affects your personal data, we handle it under our internal procedures and notify the competent authority and affected individuals to the extent required by law.

Under the Personal Data Protection Law, you have the right to:

Know what data we collect about you, the basis for processing it, and its purpose.

Access your data and obtain a copy of it.

Request correction of inaccurate or incomplete data.

Request destruction of your data when it is no longer needed or no longer has a processing basis.

Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

Obtain your data in a machine-readable format and transfer it where applicable.

We may ask for proof of identity before fulfilling a request. We respond within the statutory period. These rights are exercised within the limits of legal and professional requirements; some data must be retained and cannot be deleted on request.

You may also lodge a complaint with the competent personal data protection authority in the Kingdom if you believe our processing of your data violates the law.

To contact us about any of the above:

info@alshubailycpa.com

We may amend this page when our practices or legal requirements change. The latest version remains published here with the effective date at the top of the page, and we will note material changes in an appropriate way.