Privacy notice
This notice explains how we collect, use, store, share and delete personal data through billbrick.com, and how you can use your rights under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Please read it before you send us your details.
1. Who we are
The controller of your personal data is the company that operates BillBrick and this website, in the Kingdom of Saudi Arabia (“BillBrick”, “we”). For any question or request about your personal data, contact us at contact@billbrick.com.
2. What this notice covers
The website billbrick.com and its enquiry form. It does not cover the BillBrick software used by our customers; that is governed by each customer’s own agreement.
3. The personal data we collect
What you give us in the enquiry form: your name, company, work email, phone number, company size (number of active projects) and your message. We also record the date and time you gave your consent.
What we add: our sales team may keep short notes about our conversations with you, together with your enquiry in our business mailbox.
What is collected automatically:
- Your IP address and basic technical details of your browser, used by our spam check (Cloudflare Turnstile, see section 6) and to limit repeated submissions.
- We keep no logs of your IP address or of what you type into the form.
We do not ask for and do not want sensitive data (such as health, religious, biometric or financial account data). Please do not include it in your message.
Cookies: the public pages of this website set no cookies and use no tracking or advertising tools. If you switch between light and dark mode, your browser remembers that choice on your device; it is not sent to us.
4. Why we use it, and our legal basis
- To answer your enquiry — call you, arrange a demonstration and follow up on that enquiry. Legal basis: your consent, given with the checkbox on the form.
- To keep the website secure — stop spam, automated abuse and repeated attempts. Legal basis: our legitimate interest in protecting the website and the data it holds; this processing uses technical data only.
- To meet legal obligations — when a law or a competent authority requires it.
We do not use your data for any other purpose, do not sell it, and do not make automated decisions about you. We will not send you marketing messages or newsletters unless you ask us to.
5. What happens if you do not give us your details
Giving us your details is voluntary. Without them we cannot answer your enquiry through the form.
6. Who we share it with
Only with service providers that process it for us, under our instructions and a contract that requires them to protect it:
- Cloudflare, Inc., which hosts and delivers this website, runs the Turnstile spam check, limits repeated submissions, and delivers your enquiry to our business mailbox by email. It does not keep your enquiry after delivering it.
- Google LLC (Gmail), our business email provider, which stores the enquiry email in our mailbox.
We may also disclose personal data to a competent authority when the law requires it.
7. Where your data is stored, and transfers outside the Kingdom
This website does not store your enquiry. It is sent by email to our business mailbox at Google (Gmail), whose servers may be located outside the Kingdom.
Cloudflare operates a global network. The data it handles for the website, the spam check and the delivery of your enquiry by email (section 6) may also be processed outside the Kingdom. Any such transfer is made only as permitted by the PDPL and the Regulations on Personal Data Transfer outside the Kingdom.
8. How long we keep it
- Enquiry emails, including our notes: 12 months from the date you send them, then they are deleted from our mailbox. If you ask us to delete them earlier, we do so (section 10).
- The count used to limit repeated submissions: held by Cloudflare for a one-minute window.
We may keep data longer only when a law or a competent authority requires it, and only for as long as required.
9. How we protect it
The website uses encrypted connections (HTTPS). Enquiries are not stored on the website; they are delivered to our business mailbox, which only authorised members of our team can open, each with a personal login. We review these measures as the website changes. If a breach affects your personal data, we will notify the competent authority and, where required, you, as the law requires.
10. Your rights
Under the PDPL you have the right to:
- Be informed about how your personal data is collected and used — this notice.
- Access your personal data and receive a copy in a clear, readable format.
- Correct personal data that is inaccurate, incomplete or out of date.
- Request destruction of your personal data when it is no longer needed.
- Withdraw your consent at any time. This does not affect what we did before you withdrew it; after it, we stop contacting you about your enquiry and destroy it.
- Complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority for personal data protection.
How to use your rights: write to contact@billbrick.com, or send a request through the enquiry form, starting your message with “Privacy request”. We may ask you to confirm your identity before we act. We reply within 30 days. If a request needs more time, we may extend this as the Regulations allow, and we will tell you why. There is no charge.
11. Children
This website is meant for businesses. It is not directed at children, and we do not knowingly collect their personal data.
12. Changes to this notice
We will update this notice when our processing changes. The date at the top shows the latest version.