Privacy Policy

We only collect data you choose to give us and a limited amount of technical data needed to operate the site:

• Information you submit through our contact form: your name, email address, and the project brief or message you write.
• Communication data: the content of emails or messages you send to us.
• Technical data: IP address, browser type, device information, and pages visited, collected through standard server logs and any analytics we use.
• Preferences: your selected language, stored locally in your browser.

We do not collect special-category data, and we do not ask for payment details through this website.

We use personal data for clearly defined purposes:

• To respond to your enquiries and discuss potential projects.
• To provide, maintain, and improve our services and this website.
• To send you information you have requested or that relates to a project we are working on together.
• To protect the security of our systems and prevent misuse.
• To comply with legal and regulatory obligations.

We rely on your consent, the performance of a contract or pre-contract steps you ask for, our legitimate business interests, and compliance with the law as the legal bases for processing.

This website uses a minimal set of cookies and local storage that are necessary for it to function, such as remembering your language preference. If we use analytics tools to understand aggregate, non-identifying usage, we configure them to respect your privacy. You can control or delete cookies through your browser settings.

We do not sell your personal data. We may share it only in limited circumstances:

• With trusted service providers (for example hosting, email, or analytics) who process data on our behalf under appropriate agreements.
• Where required by law, regulation, or a valid request from a competent authority in the Kingdom of Saudi Arabia.
• To establish, exercise, or defend legal claims, or to protect the rights and safety of Core Flow and others.

Some of our service providers may process data outside the Kingdom of Saudi Arabia. Where this happens, we take reasonable steps to ensure your data receives a level of protection consistent with the PDPL.

We keep personal data only for as long as needed for the purposes described in this policy, including any period required to manage an ongoing relationship or to meet legal obligations. When data is no longer needed, we delete or anonymise it.

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. No method of transmission or storage is completely secure, but we work to keep our safeguards aligned with industry good practice.

Subject to applicable law, you have the right to:

• Be informed about how your personal data is processed.
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where there is no overriding reason to keep it.
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding.

This website and our services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us so we can remove it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when the latest version took effect. Significant changes will be highlighted on this page.

If you have any questions about this policy or how we handle your data, contact Core Flow Establishment, Riyadh, Saudi Arabia, at info@coreflow.sa.