Privacy Policy
This Policy explains how Smart Management Solutions (SMSIT) collects, uses, stores, discloses, and protects personal data when you use https://smsit.sa and its Arabic pages (including www redirects to the apex site).
1. Who we are
The data controller is Smart Management Solutions (SMSIT), 7th Floor, Office 702, Dabab Complex, Dabab Street, Al Murabba, Riyadh, Saudi Arabia, P.O. Box 2793, Riyadh 12626.
Contact: contact@smsit.sa · +966 11 512 2656.
2. Scope and law
We process personal data in accordance with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL) and its Implementing Regulations, and applicable guidance from the Saudi Data & AI Authority (SDAIA).
This Policy covers website visitors, people who send inquiries through our contact form, and job applicants who use our careers form. It does not replace contracts that govern systems we operate for clients.
3. What we collect
Depending on how you use the site, we may process:
- Contact form: name, email, phone (optional), organisation, subject, service interests, and message.
- Careers form: name, email, phone, city, role, experience, notice period, portfolio URL, message, and CV file (PDF or Word, up to 3 MB).
- Cookies and similar technologies: language preference, cookie-consent choice, and security or hosting cookies required to run the site.
- Analytics: after you accept analytics cookies, usage measurements such as pages viewed and approximate device or location signals provided by our analytics provider. If you refuse, analytics storage remains disabled under Consent Mode.
- Server and security logs: IP address, timestamps, and request metadata used for rate limiting, abuse prevention, and reliability.
- Maps: if you choose to load the contact-page map embed, the map provider may process data under its own terms.
4. Purposes and legal bases
We use personal data to respond to inquiries; assess applications and contact candidates; operate, secure, and improve the website (including logs and rate limiting); measure traffic and improve content only with consent where required for non-essential analytics cookies; and comply with applicable legal obligations.
Where PDPL requires consent for non-essential cookies or analytics, we ask via the on-site banner when first offered, before enabling analytics storage. You may change your analytics preference later by clearing the site cookie for smsit.sa or by emailing contact@smsit.sa; we will honour email requests to update that preference. Withdrawal does not affect processing already completed lawfully.
5. Children
The website is aimed at organisations and professionals. We do not knowingly collect personal data from children under 18 through these forms. If you believe we have, contact us so we can delete it.
6. Processors and disclosures
We use service providers that process data on our instructions, including website hosting and delivery, transactional email for form submissions, infrastructure used for rate limiting, analytics (when consented), and map embeds when loaded.
We do not sell personal data. We may disclose data when required by Saudi law or competent authorities, or to protect rights, safety, and security.
7. Cross-border transfers
Some processors may process or store data outside Saudi Arabia. Where PDPL requires, we use appropriate transfer mechanisms and contractual safeguards. You may contact us for more detail about a specific transfer.
9. Retention
Contact inquiries are kept as needed to handle the request and for a reasonable follow-up period, then deleted or archived under internal policy (typically up to 24 months unless a longer period is required for an ongoing matter or by law).
Applications and CVs are kept for the recruitment process and a limited period afterward for related roles or legal defence (typically up to 12 months unless you agree otherwise or law requires longer).
Security and rate-limit logs are short-lived unless needed for an investigation. Consent records are retained to demonstrate compliance.
10. Security
We apply technical and organisational measures appropriate to the risk, including HTTPS, security headers, server-side form validation, anti-spam controls, origin checks, and rate limiting. No method of transmission or storage is completely secure.
11. Your rights
Subject to PDPL conditions and exceptions, you may request access to your personal data; request correction; request destruction; withdraw consent; obtain a copy in a clear format where applicable; and lodge a complaint with SDAIA.
To exercise rights, email contact@smsit.sa with enough detail for us to verify and locate your request. We will respond within applicable PDPL timelines.
12. Automated decision-making
We do not use the website forms for solely automated decisions that produce legal or similarly significant effects about you.
13. Third-party sites and embeds
External sites and embeds have their own privacy practices. This Policy does not cover them.
14. Changes
We may update this Policy from time to time. Material changes that affect cookies or analytics will be reflected in our consent interface where appropriate.
15. Contact
Privacy questions and PDPL requests: contact@smsit.sa, telephone +966 11 512 2656, postal address above.
Supervisory authority: Saudi Data & AI Authority (SDAIA), https://sdaia.gov.sa (or any successor URL published by SDAIA).