The data controller is [legal entity name, address, CR number] (“we”). Where RiskTide processes personal data on behalf of a client organisation using this platform, that client is the controller and RiskTide acts as a processor under a data-processing agreement.
| Category | Examples |
|---|---|
| Account data | Username, first/last name, email, phone, job title, department, profile photo |
| Authentication & security data | Password (hashed), last-login time and IP, failed-login counters, account status |
| Assessment team data | Name, organisation, title, email, phone of individuals recorded on an assessment team |
| Usage & audit data | Login/logout events, assessment actions, and related metadata in the audit log |
The platform also holds facility security information (locations, imagery, vulnerability and threat assessments) — commercial and security data rather than personal data, but treated as confidential.
We process account and team data to provide the security-risk-assessment service, authenticate users, secure the platform, and maintain the audit trail required for accountability. The legal basis is the performance of a contract with the client organisation and our legitimate business interest in operating a secure service, and where applicable [consent / legal obligation].
Administrators of your organisation can view and manage the user accounts within their organisation, including your account data and status. Platform operators access data only as needed to run and support the service. Data is isolated per organisation; one organisation cannot see another’s data.
We keep personal data only as long as necessary. Indicative periods: active account data for the life of the account; audit records for [retention period]; transient notifications and expired sessions are purged on a schedule. See the operator’s data-retention schedule for detail.
Personal data is hosted [in the Kingdom of Saudi Arabia / in region]. Any transfer outside the Kingdom is made only in accordance with the PDPL cross-border rules (adequate jurisdiction, or appropriate safeguards such as standard contractual clauses, plus a transfer risk assessment).
Under the PDPL you have the right to:
Signed-in users can download a copy of their own account data from Profile → Data & Privacy. To exercise any other right, contact us below. We respond within 30 days.
If a personal-data breach occurs that may harm your data or rights, we notify the competent authority (SDAIA) within 72 hours of becoming aware of it and inform affected individuals without undue delay.
Data-protection enquiries and rights requests: [Data Protection Officer — to be appointed and filed with SDAIA]. General support: support@taqyeem.sa.