Privacy Notice & Personal Data Protection
At FiberHub, we protect your personal data with the highest cybersecurity and privacy standards in the Kingdom of Saudi Arabia in accordance with the Personal Data Protection Law (PDPL).
1. Legal & Regulatory Framework
This Privacy Notice is enacted pursuant to the Saudi Personal Data Protection Law (PDPL) promulgated under Royal Decree No. (M/19), its Implementing Regulations, and applicable data protection standards in the Kingdom of Saudi Arabia.
2. Categories of Data We Collect
We collect only the minimum necessary data to perform building coverage checks and facilitate broadband activation:
- Basic Contact Data: Full name and mobile phone number to coordinate order requests and communications.
- Coverage & Location Facts: City, district, and building metallic plate code (ODB identifier) to determine carrier coverage and installation feasibility.
- Technical & Security Telemetry: Secure navigation logs, IP address, and browser metadata to protect platform integrity, prevent fraudulent abuse, and optimize performance.
3. Purpose of Processing & Legal Basis
Your personal data is processed strictly for legitimate purposes: verifying fiber terminal box availability at your building, presenting comparative plans from operators, transmitting your selected order to the chosen carrier, and scheduling technician visits. The lawful basis for processing is your prior explicit consent and the necessity to fulfill the service requested by you.
4. Data Sharing & Authorized Entities
We never sell, rent, or trade your personal data to third parties. Order data is shared solely with your selected telecom carrier (stc, Mobily, Salam, or Zain) and field installation teams to complete on-site connection at your premises.
5. Your Rights as a Data Subject
Under the Saudi Personal Data Protection Law, you hold specific statutory rights regarding your personal data:
6. Data Security & Sovereign Storage in Saudi Arabia
All operational and personal data is retained within secure data centers located within the Kingdom of Saudi Arabia, encrypted with modern ciphers (TLS 1.3 in transit and AES-256 at rest), and governed by strict role-based access control (RBAC) to prevent unauthorized access.
7. Data Retention Schedules & Secure Erasure
We retain personal records only for the duration necessary to satisfy the purposes for which they were collected or as required by applicable Saudi regulations:
Incomplete Leads & Inquiries: Retained for 90 days, then systematically purged and erased.
Fulfilled Orders & Delivery Logs: Retained for 2 years pursuant to applicable commercial and tax record-keeping standards.
WhatsApp & Communication Logs: Retained for 90 days for operational quality assurance and delivery verification.
Metallic Plate (ODB) Photos: Irrevocably deleted 30 days after physical technician verification is concluded.
• Cybersecurity & Audit Logs: Retained for 12 months for platform security monitoring.
• Encrypted Backups: Managed under a 30-day rotation cycle within domestic facilities.
• Anonymized Analytics Aggregates: Stored devoid of any personal identifiers for 180 days to monitor platform reliability.
9. Granular Consent Scopes & Withdrawal Mechanisms
Pursuant to the Saudi PDPL, we decouple consent scopes and never condition core services on marketing opt-ins:
10. Contacting the DPO & Regulatory Complaint Rights
To exercise any statutory right or submit a privacy inquiry, please contact our Data Protection Officer at: [email protected] or call: [email protected]. You also maintain the statutory right to file a complaint with the Saudi Data & AI Authority (SDAIA) if your request is not resolved within statutory timeframes.