Privacy and Client Data Protection Policy

1. Controller and scope

Ayed Daham Al-Shammari Law Firm & Legal Consultancy is the controller of personal data it collects directly through this website and its communication channels. This Policy applies, as relevant, to visitors, enquirers, prospective and current clients, representatives of organisations and related parties.

2. Personal data we may collect

Fields marked as required are necessary to prepare a contact request, and the message cannot be prepared until they are completed. Other details are optional. The website form does not upload data to the firm’s server; it prepares a message in the user’s email application, and the firm receives the data only if the user chooses to send it.

• Identity and contact details, including name, phone number, email and professional capacity.
• Legal or business enquiry information voluntarily provided by the enquirer.
• Identity, authority and conflict-check information where required.
• Correspondence, communication records, appointments, instructions and service-related documents.
• Essential technical security and operation data, such as IP address and security logs, when generated during operation.

3. Purposes and legal bases

We process data for lawful purposes connected with receiving enquiries, initial conflict screening, assessing whether an engagement may be accepted, delivering legal and notarial services, managing the professional relationship, billing, compliance, protecting rights and maintaining technical security. Depending on the circumstances, the legal basis may be consent, performance of a contract or pre-contract steps requested by the data subject, compliance with a legal obligation, legitimate interests that do not override the individual’s rights, or another basis permitted by law.

• Sensitive data is processed only where necessary and subject to the appropriate legal basis and safeguards.
• We do not change the processing purpose to an incompatible purpose without a lawful basis and notice or consent where required.

4. Accuracy and data minimisation

Submitters must ensure that information is accurate and current and relates to them, or that they are legally authorised to provide it. We collect data that is adequate and necessary for the stated purpose and request correction or updating where needed.

5. Professional confidentiality

We protect client secrets, information and documents obtained in professional work in accordance with the Saudi Code of Law Practice, its Implementing Regulations and the professional conduct rules. Nothing in this Policy reduces any professional duty that provides a higher level of protection.

• Disclosure may be permitted or required with the relevant person’s consent, to comply with law, a judicial requirement or a competent authority, or to protect a lawful right, and only to the necessary extent.
• An initial enquiry alone does not create a lawyer-client relationship. Do not send confidential documents, originals or highly sensitive information until the firm confirms in writing that it can receive them.

6. Sharing and processors

We do not sell personal data. We may share the necessary minimum with confidentiality-bound personnel, professionals and service providers such as hosting, email, communications and IT providers, or with experts, regulators, public authorities and courts where lawful and necessary. Where applicable, processors are selected and assessed for legally required safeguards.

7. Transfers outside Saudi Arabia

Where a technical or professional service requires personal data to be transferred outside the Kingdom, the transfer will be handled in accordance with the PDPL, its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom, including required safeguards and assessments.

8. Security, retention and destruction

We use proportionate organisational, technical and physical measures to protect data against unauthorised access, use, alteration, disclosure or loss. Data is retained for the period necessary for its purpose, legal or professional duties, or the establishment and defence of rights and claims, and is then securely destroyed or anonymised unless a lawful basis requires further retention.

9. Data-subject rights

Subject to the PDPL, its controls and exceptions, individuals may have rights to be informed, access data, obtain a readable and clear copy, request correction, completion or updating, request destruction, and withdraw consent where consent is the sole legal basis. Rights may be restricted to protect others, professional confidentiality or to comply with law or judicial requirements.

• To exercise a right or ask a question: info@ayedlfo.com.
• We will verify identity and authority before action and respond within legally applicable procedures and periods.
• A data subject may complain to the competent authority through the applicable official channels if the matter is not resolved.

10. Cookies and analytics

The current website version does not use marketing cookies or behavioural analytics. Essential technologies may be used for operation and security. If non-essential analytics or marketing tools are added, this Policy will be updated and suitable consent choices will be provided before activation where required.

11. Minors and third-party data

This website is intended for adults and authorised organisational representatives. Do not provide a minor’s or another person’s data without appropriate legal capacity or authority and compliance with requirements for consent and sensitive data.

12. Updates and contact

We may update this Policy to reflect legal, operational or technical changes. The date above identifies the current version. Updates do not remove accrued rights, and fresh consent will be requested where required. Privacy enquiries may be sent to info@ayedlfo.com or +966 55 175 7813.