Privacy policy
Last updated14 August 2026
This policy explains how Masarat Alibtikar Almutaqaddim Company handles personal data, in two separate places: this corporate website, and the company's software products. It is written in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations, whose regulator is the Saudi Data and Artificial Intelligence Authority (SDAIA).
The data controller and its contact details
For this website and for the دعوات application, the data controller is:
- Legal name
- Masarat Alibtikar Almutaqaddim Company
- Legal entity
- Limited liability company — single person
- Unified National Number
- 7054926113
- VAT number
- 314942767800003
- National address
- Al Fakhiriyah District, Abi Al Joud Street, Building 3640, Riyadh, postal code 12736
- Short address
- RBNB3640
- info@masarat.company
- Telephone
- +966 11 473 8357
The فزعة application has a different data controller; this is set out in its own section below.
All requests concerning personal data should be sent to info@masarat.company, and are answered within the periods set out in the data subject rights section.
Part 1 — this website
masarat.company is an informational corporate website. It is static pages, nothing more.
This website collects no personal data about you. It sets no cookies, runs no analytics tool, carries no advertising or cross-site tracker, and contains no contact form or input field of any kind. The only interactions available are email links (mailto) and telephone links (tel), which open the mail or phone application on your own device and send nothing back to this site.
The site loads no font, image or script from an external domain. Everything the page needs is hosted on the same domain, so your visit generates no connection to any third party.
Hosting data
The site is hosted on Cloudflare Pages. Like any server on the internet, the hosting provider records technical connection data when a page is requested — including the Internet Protocol (IP) address, the time of the request, and the browser and operating system type — and uses it to deliver the page and protect the service from abuse.
These logs arise at the hosting provider and do not reach the company: we do not view them, do not store them ourselves, do not analyse them, and do not link them to any person. Their retention and its periods are governed by the hosting provider.
If you contact us
If you send us an email or call us, we process what you choose to send: your name, your email address or telephone number, and the content of your message. The legal basis for this is carrying out and responding to your request.
Correspondence is kept for as long as is necessary to answer the request and complete any dealing arising from it, and thereafter for the period that Saudi accounting and commercial legislation requires for correspondence with commercial effect.
Part 2 — the company's products
Neither product below has been released to the public yet. What follows is what the company commits to at launch, and this policy is updated before launch if any of it changes.
Each product has its own section, because the data controller differs between them. When each product has its own website, these sections move there and a link to them remains here.
For both products: personal data is not sold, rented or traded; it is not used for advertising tracking; no third-party advertising tools are included in either product; and users are not tracked across applications or websites owned by other companies.
دعوات — electronic invitations and event management
Data controller: Masarat Alibtikar Almutaqaddim Company. The platform is wholly owned and operated by the company.
Categories of data processed
- Account data: name, and the mobile number and/or email address used to create the account.
- Event data entered by the organiser: the event's title, date and place.
- Guest data uploaded by the organiser: guest names and the contact details needed to deliver the invitation.
- Confirmation responses and attendance follow-up.
- Technical data for operation and security: usage logs, device identifier and connection data.
Legal basis for processing
- Performance of a contract: providing the service to the account holder and enabling them to create an event and send invitations.
- Legitimate interest: securing the platform and preventing abuse and fraud.
- Legal obligation: retention or disclosure required by the legislation in force in the Kingdom.
Guest data — the organiser's responsibility
When an event organiser uploads a guest list, it is the organiser who supplies the platform with other people's data. The organiser is responsible for having a lawful basis for collecting their guests' data and sharing it with us for the purpose of delivering the invitation. We process that data only to deliver the invitation and manage the response to it, and use it for no other purpose.
Any guest may ask us to delete their data from the platform via info@masarat.company.
Retention periods
Account data is kept for as long as the account exists, and is deleted or destroyed when the account is closed at its holder's request, subject to any mandatory retention periods imposed by law.
Detailed retention periods for event data and guest lists have not been finally settled, and will be fixed in this policy before the platform launches.
Disclosure and data processors
The company discloses personal data to no one except in the following cases: technical infrastructure providers necessary to operate the service (hosting and databases), message delivery providers necessary to send the invitations themselves, and the competent authorities in the Kingdom where there is a lawful request.
The names of those providers, where data is stored, and whether any of it sits outside the Kingdom, have not been finally settled and will be listed in this policy before launch. Any transfer of data outside the Kingdom will be carried out in accordance with the controls of the Personal Data Protection Law and its regulations.
فزعة — roadside assistance and volunteer response coordination
Data controller: the Security and Safety Association in the Riyadh Region. The association owns the platform and is the party that determines the purposes and means of processing.
The role of Masarat: data processor on behalf of the association. The company undertakes the platform's development, maintenance and periodic follow-up free of charge, has no commercial interest in the data, does not use it for its own purposes, and processes it only on the association's instructions.
Categories of data processed
- Reporter data: the contact details needed to reach them.
- The location of the report and a description of the situation.
- Responding volunteer data and their availability status.
- The status and timestamps of a report through to its closure.
- Technical data for operation and security.
Legal basis, retention and disclosure
The legal basis for processing is determined by the association as controller. As regards the reporter, processing rests on carrying out the service they requested, and on protecting the vital interests of the person in an emergency.
Retention periods and the disclosure policy are determined by the association and have not been finally settled. They will be fixed in this policy, or in the association's own policy for the platform, before launch.
Requests concerning this platform's data should be directed to the association as controller. They may also be sent to us at info@masarat.company and we will refer them on to the association.
Data subject rights
The Personal Data Protection Law of the Kingdom of Saudi Arabia grants you the following rights over your personal data:
To exercise any of these rights, send your request to info@masarat.company stating which right you wish to exercise. We may ask you for proof of identity before acting on the request, to protect your data from being disclosed to someone else.
Exercising these rights is free of charge. If we cannot act on your request for a legal reason, we will explain why.
- The right to be informed: to know the legal basis for collecting your data and the purpose of it.
- The right of access: to see the personal data we hold about you.
- The right to obtain a copy: to receive your data in a clear, readable format.
- The right to correction: to request that your data be corrected, completed or updated.
- The right to destruction: to request deletion of your data once it is no longer necessary for the purpose it was collected for.
- The right to withdraw consent: where processing rests on your consent, you may withdraw it at any time.
Complaints
If you believe we have not handled your personal data lawfully, please write to us first at info@masarat.company so that we can address it.
You have, in every case, the right to lodge a complaint with the regulator: the Saudi Data and Artificial Intelligence Authority (SDAIA), the body responsible for supervising the application of the Personal Data Protection Law in the Kingdom.
Data security
The company applies technical and organisational measures to protect personal data from unauthorised access, disclosure or destruction, including encryption of connections and restricting access to data to those who need it for their work.
To report a security vulnerability or a suspected breach, write to us at info@masarat.company.
Changes to this policy
This policy may be updated when the company's services or the legal requirements change. The last updated date appears at the top of this page, and any material change is announced before it takes effect.