Privacy Policy

Last updated: 14 August 2026

Hal Aldaawa Law Firm & Legal Consultants (the “Firm”) is committed to protecting personal data and respecting the privacy of visitors to its website and users of its contact and consultation request forms. This Privacy Policy explains how personal data is collected, processed, stored, disclosed and destroyed, and sets out the rights of Data Subjects under the Personal Data Protection Law (PDPL), its Implementing Regulations and other applicable laws and regulations in the Kingdom of Saudi Arabia.

The Firm is the Controller of personal data collected through the website www.halaldaawa.sa. This Policy applies to the use of the website and the forms made available through it. The Terms of Use apply to the use of the website, while this Policy governs the processing of personal data. This Policy does not replace any agreements or terms governing the professional relationship formed when the Firm accepts an engagement to provide legal services to a client.

Controller and Contact Details

Controller: Hal Aldaawa Law Firm & Legal Consultants.

Head office: Riyadh, Kingdom of Saudi Arabia.

Website: www.halaldaawa.sa

Email: info@halaldaawa.sa

Personal Data We Collect

Through our contact and consultation request forms, we collect the personal data that users provide directly, including their name, email address, mobile number, the content of their message or details of their legal request, and any other information they choose to include in their message.

The website may automatically collect certain technical and usage data, such as the Internet Protocol address, browser type, device type, operating system, date and time of the visit, pages visited, referral source, crash and security logs, and website interaction data. Some of this data may be collected through cookies or analytics tools after the required consent has been obtained.

The website does not currently require users to create an account or enter payment details, and it does not collect such data through its forms.

How We Collect Personal Data and Whether Providing It Is Mandatory

Contact details and request information are collected directly when a user completes and submits one of the website forms. Fields marked as mandatory are required to submit the request and enable the Firm to review it and contact the person submitting it. If those fields are not completed, the form cannot be submitted or the Firm cannot respond to the request. Any additional information that a user chooses to include in a message is optional.

Technical and usage data is collected indirectly through the operation of the website, its technical logs and cookies. The use of analytics cookies is optional and subject to the user’s choice through the cookie banner, while certain necessary cookies may be required for the operation and essential functions of the website.

Please do not include national identification numbers, Sensitive Data such as health or credit data or data relating to criminal cases, or data relating to other persons, in the initial contact form except to the extent necessary and where there is a lawful basis for providing it. If a request requires the processing of Sensitive Data, the Firm will take appropriate steps to obtain Explicit Consent or verify that another lawful basis applies before continuing to process it.

Purposes for Collecting and Processing Personal Data

We process personal data for the following purposes: receiving, verifying and classifying contact messages and consultation requests; contacting the person submitting the request and responding to their enquiry; conducting an initial assessment of the request, identifying the appropriate service and determining whether it may be accepted, including conducting an internal conflict-of-interest check where necessary; arranging an appointment or requesting additional information; protecting the website and related systems and detecting misuse or faults; preparing general statistics about website use and improving its performance and the visitor experience where analytics cookies have been accepted; complying with legal and professional obligations or judicial requirements; and protecting legitimate rights and claims.

We do not use contact data submitted through the forms to send direct marketing materials unless separate consent has been obtained for that purpose, and we do not sell or rent personal data to third parties.

Lawful Bases for Processing

Depending on the nature of the processing, we rely on one or more of the following lawful bases to collect and process personal data: the Data Subject’s Consent when a form is submitted or analytics cookies are accepted; performance of an agreement to which the Data Subject is a party where the provision of legal services has been accepted; compliance with a legal or professional obligation or a judicial requirement; and the Firm’s legitimate interests, such as protecting the website and its systems, managing claims and improving services, provided that this does not prejudice the Data Subject’s rights or conflict with their interests and that the personal data being processed is not Sensitive Data.

A Data Subject may withdraw their Consent at any time using the contact details set out in this Policy or through the cookie settings. Withdrawal will not affect the lawfulness of processing carried out before Consent was withdrawn or any processing based on another lawful basis.

How We Use Personal Data

Form data may be accessed by authorized personnel within the Firm only to the extent necessary to review the request, respond to it and take the appropriate action. Correspondence and related actions may be recorded for follow-up, documentation and the protection of rights. The website does not use form data to make decisions based solely on automated processing or to carry out automated profiling of individuals submitting requests.

Disclosure of Personal Data and Service Providers

We disclose personal data only within the scope of the purpose for which it was collected or where a lawful basis exists. Depending on the circumstances, personal data may be made available to authorized personnel within the Firm; providers of hosting, website operation and form services, including Hostinger; providers of analytics services enabled on the website where the user has consented to analytics cookies; technical or professional service providers engaged by the Firm and bound by confidentiality and data protection obligations; judicial, regulatory or government authorities where there is a request or legal obligation; or any party whose involvement is necessary to assess the request or provide the service after an appropriate lawful basis has been established.

Because we use technology service providers with international infrastructure, certain technical data, form data or analytics data may be stored or processed outside the Kingdom. In such cases, the Firm will comply with the requirements and controls governing the transfer of personal data outside the Kingdom and will implement appropriate safeguards in accordance with the applicable laws and regulations.

Storage, Retention and Destruction of Personal Data

Personal data is stored electronically in the systems used by the Firm and in systems provided by its hosting, operation and analytics service providers, depending on the type of data and the purpose of processing.

Request and correspondence data is retained for the period necessary to review and respond to the request and carry out reasonable follow-up. If no professional relationship is established and the data is no longer required for a legitimate or legal purpose, it will be destroyed or anonymized. If the provision of services is accepted, the data may become part of the client file, and its retention will be governed by the duration required by the contractual relationship, legal and professional requirements, and the protection of rights and claims.

Technical and security logs and analytics data are retained for the period necessary to operate and protect the website and analyze its performance, in accordance with the service provider’s settings and the user’s choices. Certain data may continue to be retained where there is a legal obligation, a judicial requirement, an existing or anticipated dispute, or a need to establish or protect rights, provided that retention is limited to the data and period necessary for that purpose.

When the purpose of retention ends, personal data is destroyed using secure methods appropriate to its nature, such as secure deletion from systems or anonymization so that the Data Subject can no longer be identified. Personal data is removed from backups in accordance with established destruction cycles where technically feasible.

Protection and Confidentiality of Personal Data

We implement appropriate administrative, organizational and technical measures to protect personal data against unauthorized access, use, disclosure, alteration, loss or damage. These measures include restricting access rights, limiting access to those with a genuine need to know, selecting service providers that offer appropriate safeguards, and reviewing security and incident-response procedures. Anyone who processes personal data is also required to preserve its confidentiality in accordance with applicable legal and professional requirements.

Although appropriate measures are taken, no method of electronic transmission or storage can be guaranteed to be completely secure. Users are therefore advised not to send sensitive information or documents through the initial contact form before the Firm requests them through an appropriate channel.

Cookies and Analytics Tools

The website uses necessary cookies to operate its essential functions and may use analytics cookies to measure visits, understand how the website is used and improve its performance after the user has given Consent. Marketing cookies will not be activated unless the Firm adopts marketing tools in the future and obtains the consents required under applicable laws and regulations.

Users may accept or reject non-essential cookies and manage their preferences through the cookie banner. They may also change their browser settings or delete stored cookies. Disabling certain necessary cookies may affect the operation of parts of the website.

Rights of the Data Subject

Subject to the Personal Data Protection Law, its Implementing Regulations and the limits prescribed by applicable laws and regulations, a Data Subject has the right to be informed of the lawful basis and purpose for collecting their personal data and how it will be processed; to access their personal data held by the Firm; to request a copy in a readable and clear format where possible; to request its correction, completion or updating; to request the destruction of personal data that is no longer required; to withdraw Consent where Consent is the lawful basis for processing; and to lodge a complaint with the Competent Authority.

To exercise any of these rights, a request may be sent to info@halaldaawa.sa with “Personal Data Request” in the subject line. The request should identify the right the person wishes to exercise and provide the information necessary to verify the requester’s identity. We will not request more information to verify identity than is necessary for that purpose.

The Firm does not charge a fee for requests to exercise rights, except where permitted by applicable laws and regulations.

The Firm will respond to a completed request within no more than thirty days of receiving it. This period may be extended by no more than an additional thirty days where fulfilling the request requires unexpected additional effort or where the Data Subject has submitted multiple requests, provided that the requester is notified in advance of the extension and the reasons for it.

Complaints and Objections

If you have an enquiry, complaint or objection concerning the processing of your personal data or the exercise of your rights, please contact us at info@halaldaawa.sa. We will handle the request in accordance with the applicable procedures and time limits.

If you are not satisfied with how the complaint has been handled, you may submit a complaint to the Saudi Data & AI Authority (SDAIA) through its website at sdaia.gov.sa or through the National Data Governance Platform at dgp.sdaia.gov.sa.

Submitting a complaint does not affect the Data Subject’s right to seek compensation before the competent judicial authority for any material or moral damage caused by a violation of the Personal Data Protection Law or its Implementing Regulations, as provided by applicable laws and regulations.

Initial Contact Data

Personal data submitted through the contact or consultation request form is used to assess the request initially and contact the person submitting it, and is processed in accordance with this Policy. Whether a matter is accepted and a professional relationship is established is governed by the Terms of Use and by the agreements entered into by the Firm when it accepts an engagement to provide legal services.

External Links

The website may contain links to external websites or services that are not operated by the Firm. The processing of personal data by those websites is governed by their own privacy policies, and this Policy does not apply to practices carried out outside the Firm’s website.

Updates to This Privacy Policy

The Firm may update this Policy when legal requirements, processing practices or the technology services used change. The updated version will be published on this page together with the date of the latest update. Appropriate notice will be provided if a change is material and affects the purposes of processing or the rights of Data Subjects.