Privacy notice

Who processes your data

Expat Saudi Arabia is a trade name of BlueOceanSolutions B.V., Chamber of Commerce 92101550. Our registered address and other contact details are on the contact page. BlueOceanSolutions B.V. is the controller for the data collected through this website: we decide what it is used for and how.

Questions about your data or about this notice: privacy@expatsaudiarabia.com. You will get an answer within one month.

What we collect, and why

We do not collect more than a specific function needs. Part by part:

Reading articles — you need no account and we ask for nothing. Our server records the technical data any web server records, including your IP address, to keep the site working and secure.

Contact form — your name, email address and your message, so we can reply.

Sending an enquiry (the form inside an article) — your name, email address, phone number and your answers to the questions asked, so that the party we name before you consent can get in touch with you. See the separate chapter below; this is the only processing where we pass data to another company.

Account — if you create one: your name and email address, plus whatever you save yourself, such as bookmarked articles, calculations and the progress of your moving steps.

Calculators — your input is used to produce the result. We only keep a calculation if you deliberately save it to your account.

Chatbot — your question is sent to our search-and-answer service so it can answer. Please do not put anything in it you would rather not share; a chat box invites people to say more than is needed.

Country you are visiting from — we infer from your IP address whether you are in Saudi Arabia, the Netherlands or elsewhere, so we can show the right information. We store no IP address for this.

On what legal basis

Consent (Article 6(1)(a) GDPR) — for analytics cookies, and for the phone contact you tick on an enquiry. You may withdraw consent at any time, and doing so is as easy as giving it.

Performance of a contract and pre-contractual steps (6(1)(b)) — for your account and the features that go with it, and for handling an enquiry you send us. If you ask us to put you in touch with a party who can help, passing your details on is the performance of what you asked for.

Legitimate interests (6(1)(f)) — for security, abuse prevention and keeping the site technically working. Our interest is a functioning, unabused service; the impact on you is limited because we keep as little as possible for this and store IP addresses hashed or truncated.

Legal obligation (6(1)(c)) — where the law requires us to keep something.

The enquiry form: exactly what happens

This is the processing where your data can leave our company, so we describe it in full.

At present no receiving party is connected. Your enquiry reaches us, we contact you ourselves, and your details do not go to another company. The rest of this chapter describes what happens once one is.

You fill in two short steps. The second step contains a separate checkbox. That box is never pre-ticked, and without it nothing is sent and nothing is stored.

We try to put you in touch with a party who can help. That is an effort, not a promise: no suitable party need be available and we guarantee nothing. If it does happen, we choose on subject, region and availability, and we tell you who it became. Your details then go to the party or parties we select for it — never indiscriminately to everyone in the same category.

We and that party are then each independent controllers. They do not act on our instructions: once your details are with them, they decide how they handle them and they are responsible for that. Their own privacy notice governs what they do; we cannot answer for them.

For every tick we record: the exact sentence you read, its version and language, the moment, the page you gave it on, your browser details and a truncated part of your IP address. That is not extra data collection but the evidence of what you were shown and what you agreed to.

An introduction is free to you and commits you to nothing.

Withdrawing your consent

If you want us to stop, you can say so at any time. The confirmation email for every enquiry contains a link that does it in one click. It works with no account and no sign-in, and it keeps working.

While your enquiry is still with us, that is the end of it: we stop contacting you and pass nothing on. If your enquiry has already reached another party, we tell them within 72 hours that you have objected and that they must stop, and we record that we did. What that party does then is their own responsibility.

Prefer email? Write to privacy@expatsaudiarabia.com.

Who we share data with

With the party you see named in the consent sentence — and with nobody else under that sentence.

Beyond that, with suppliers who work on our instructions and may not use your data for themselves: Microsoft Azure for hosting, storage and sending email; Google for Tag Manager, Analytics and reCAPTCHA; and the supplier behind our chatbot. There is a data processing agreement with each of them.

We do not sell your data and we do not use it for advertising.

Transfers outside the EEA

Our servers are in the European Union.

Some recipients and suppliers are outside the European Economic Area, for example in Saudi Arabia or the United States. Saudi Arabia has no adequacy decision from the European Commission. For those transfers we put Standard Contractual Clauses in place and assess whether they give sufficient protection in practice. Where that is not arranged, we do not transfer — that is enforced in our systems rather than left to a procedure.

We do not rely on your individual consent as a standing basis for transfers (Article 49(1)(a) GDPR). That exception is meant for occasional cases, and it would be unfair to use a checkbox as a substitute for real safeguards.

How long we keep it

An enquiry we did not pass on: 90 days, after which we delete the personal data.

An enquiry we did pass on: 24 months, after which we render it non-identifying. What remains cannot be traced back to you.

A refused enquiry (an automatically detected bot, for instance): 90 days.

Consent records are kept even after the data they relate to has been deleted. That sounds contradictory, but without them we could no longer show that a disclosure was lawful — it protects you as much as us.

Statistics about use of the form (how many people start and finish, with no name, email address or anything leading back to you): 13 months.

Account data: for as long as your account exists. Delete it and we delete them.

Automated assessment

Before we pass an enquiry on we run some automatic checks: whether the email domain exists, whether it is a disposable address, whether the form was filled in unrealistically fast, and whether the same enquiry has already arrived.

This is not automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR: nothing is decided about you, no profile is built, and the outcome is only whether an enquiry is passed on. If you disagree with an outcome you can always tell us.

Cookies and measurement

Functional cookies needed to make the site and your sign-in work are set without asking; without them the site does not work.

Analytics cookies via Google Tag Manager and Analytics are only set after you have consented to them. You can change your choice at any time through “Cookie preferences” at the bottom of every page; withdrawing is exactly as easy as giving.

To count how many people see and complete the enquiry form we also use our own counting. It stores nothing in your browser and contains no name, email address, session identifier or anything else leading back to you — only totals.

Security

The name, email address and phone number in an enquiry are stored encrypted (AES-256-GCM). We never store your IP address as such: for security purposes we keep an irreversible keyed hash of it, and in the consent record only a truncated part.

Traffic to this site runs over an encrypted connection. Access to the data is limited to those who need it.

Your rights

You have the right to: see your data; have it corrected; have it deleted; have processing restricted; object to processing based on legitimate interests; receive your data in a common file format; and withdraw consent you have given, without affecting what was lawfully done before.

Write to privacy@expatsaudiarabia.com. We respond within one month. If we ask for extra details to identify you, that is to avoid handing your data to someone else.

If you are unhappy with how we handle your data you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate hearing from you first, but that is not a condition.

Children

This site is not aimed at children under 16 and we do not knowingly collect their data. If you believe that has happened, tell us at privacy@expatsaudiarabia.com and we will delete it.

Changes

If something material changes we will update this notice and change the date at the top.

The consent sentence you read when sending an enquiry never changes retroactively. If we revise that text it becomes a new version for new enquiries; your consent stays recorded exactly as it was shown to you.