Privacy Policy

Sultan Ahmed Al-Shubaily Certified Public Accountants and Auditors Company, Riyadh, Kingdom of Saudi Arabia. We act as the controller of personal data collected through this website in accordance with the Personal Data Protection Law and its Implementing Regulation.

For any enquiry about your data, the dedicated email address is listed in the rights section below.

We collect the following data depending on the service you use:

Contact form: name, email address, mobile number (optional), company name (optional), requested service, and message text.

Careers form: name, email address, mobile number, city, application type, field of interest, years of experience, LinkedIn URL if provided, cover note, and CV file.

Seminar registration form: name, work email, mobile number (optional), company name, job title, country, selected session, and any other data the user provides as part of registration.

Limited technical data generated by operating the site, such as an approximate IP address and error logs held by the hosting provider.

We do not request sensitive personal data in our forms, and we ask you not to include it in a message or CV unless it is necessary for the purpose of the request.

We process your data for the following purposes, each with its basis:

Responding to and following up on contact enquiries, based on your consent when submitting the form, and on pre-contractual steps when a service is requested.

Reviewing career applications and contacting applicants, based on the applicant’s consent and pre-contractual steps for employment.

Managing registration for seminars and professional events: to confirm registration, send session details, join links and related reminders, manage participation, and respond to related enquiries, based on your request to register and your consent when submitting the form.

Protecting forms from abusive automated submissions, securing the site, and handling incidents, based on the firm’s legitimate interest in protecting its systems.

Measuring advertising campaign performance and related conversions (for example, whether a visit led to seminar registration), based on the firm’s legitimate interest in evaluating ad effectiveness, as described in the cookies and measurement technologies section.

Complying with legal and professional requirements related to accounting and audit practice, where applicable.

We do not use registration or contact data to send marketing or promotional messages without an appropriate legal basis or consent where required.

We do not sell or trade your data.

Data may be processed by operational providers we need to deliver site services, such as hosting providers, databases and storage, email notification services, and platforms for online seminars and meetings. Registration data necessary for the seminar may be shared with the seminar platform provider to create the registration, send the join link, and manage the session. Those providers handle data only as needed to deliver their service, under contractual confidentiality and protection obligations.

When advertising measurement tools are used, technical data and data about interaction with the site may be sent to the advertising platform provider to measure campaign and conversion performance, as described in the cookies and measurement technologies section.

Internal access is limited by work permissions: career applications are accessible only to people responsible for HR, contact requests only to those responsible for responding, and seminar registrations only to those responsible for managing them.

We may disclose data to competent authorities if required by a legal order or obligation, and we document such requests internally.

Processing outside the Kingdom: some service providers may use technical infrastructure or servers located outside the Kingdom of Saudi Arabia. Where personal data is transferred or processed outside the Kingdom, we comply with the applicable requirements for transferring personal data outside the Kingdom, and we limit the data to what is necessary for the purpose of processing.

The site uses cookies or local storage as needed to operate and secure it, such as validating form submissions and basic display preferences.

We use the LinkedIn Insight Tag to measure advertising campaign performance and whether visits lead to actions such as seminar registration. This technology may use cookies and similar identifiers, and may collect technical information about the visit and interaction with the site, such as page URL, referrer, IP address, device and browser type, and time of visit. LinkedIn’s processing of this data is subject to its own policies and privacy and advertising settings.

reCAPTCHA may set its own files under Google’s policies, as described in the next section. You can manage cookies in your browser settings; disabling necessary files may prevent some parts of the site from working. You can also manage LinkedIn advertising preferences in your LinkedIn account settings.

We use Google reCAPTCHA v3 to protect the contact, careers, and seminar registration forms from abusive automated submissions. The service runs in the background, and Google may collect technical and behavioural data about interaction with the page under its own policies.

Hiding the reCAPTCHA badge does not disable the service; we therefore show a notice near the forms and provide the following links:

• Google Privacy Policy
• Google Terms of Service

We keep contact requests for as long as needed to respond and follow up, then delete them or restrict access when no longer needed.

We keep career applications and CVs throughout the selection period, and may retain them for a further period to consider later vacancies unless the applicant requests deletion.

We keep seminar registration data for as long as needed to manage registration, the session, and related follow-up, then delete it or restrict access when the purpose no longer applies, unless a legal basis requires longer retention.

We may keep some data longer where required by a legal obligation or needed to establish or defend a right.

We apply appropriate technical and organisational controls to protect data in transit and at rest, including encrypted connections (HTTPS) and access limited by permission.

No internet protection is absolute. If an incident affects your personal data, we handle it under our internal procedures and notify the competent authority and affected individuals to the extent required by law.

Under the Personal Data Protection Law, you have the right to:

Know what data we collect about you, the basis for processing it, and its purpose.

Access your data and obtain a copy of it.

Request correction of inaccurate or incomplete data.

Request destruction of your data when it is no longer needed or no longer has a processing basis.

Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

Obtain your data in a machine-readable format and transfer it where applicable.

We may ask for proof of identity before fulfilling a request. We respond within the statutory period. These rights are exercised within the limits of legal and professional requirements; some data must be retained and cannot be deleted on request.

You may also lodge a complaint with the competent personal data protection authority in the Kingdom if you believe our processing of your data violates the law.

To contact us about any of the above:

info@alshubailycpa.com

We may amend this page when our practices or legal requirements change. The latest version remains published here with the effective date at the top of the page, and we will note material changes in an appropriate way.