Last updated: 2026-08-16 — Pending legal review
Privacy Policy
This draft remains under formal legal review. It describes the current public-website data flows and will not be treated as the legally approved final version until CodeDev receives written approval from qualified Saudi legal counsel.
1. Controller and scope
Code Development Company (CodeDev), headquartered at Abu Bakr Al-Siddiq Road, Al Yasmin, Riyadh 13325, Saudi Arabia, is the controller of personal data processed through the public website codedev.sa.
This policy applies only to visits to the public website, website analytics when enabled with your consent, contact-form submissions, and direct website-related communications. It does not govern personal data processed inside CodeDev products such as CodeX, Iltizam, MoM, Rassed, or CodeShare. Product processing is governed by the applicable product notice, customer agreement, and data-processing terms.
2. Personal data we collect and how we collect it
- Contact data collected directly from you: name, email address, phone number, organization name, and the content of your message.
- Communications collected directly from you: information you provide when you email or otherwise communicate with CodeDev about the website or our services.
- Security and request data collected automatically: IP address, request date and time, and limited technical request information used to protect the website, prevent abuse, and diagnose failed submissions.
- Analytics data collected only after consent and only when analytics is enabled: online identifiers, browser and device information, pages viewed, session events, and cookie or similar-technology data processed through Google Tag Manager and Google Analytics.
We do not ask you to submit sensitive personal data through the public website. Because the contact form includes a free-text field, please do not include health, biometric, genetic, credit, religious, political, criminal, security, or other sensitive information in your message.
3. Required and optional information
Name, email address, phone number, and message are required to submit the contact form. Without them, we cannot receive the form or respond reliably to your inquiry. Organization name is optional. Analytics is optional and remains disabled unless you give consent through the cookie-preferences tool.
4. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact submissions and communications | Respond to your inquiry and take the steps you request | CodeDev's legitimate interest in responding to business and service inquiries, subject to a documented balancing assessment |
| Security and request data | Prevent abuse, rate-limit submissions, maintain security, and diagnose errors | CodeDev's legitimate interest in network and information security |
| Website analytics | Understand website use and improve content and performance | Your consent, which you may refuse or withdraw at any time |
| Required disclosures and records | Comply with binding Saudi legal, regulatory, or judicial requirements | Applicable legal obligation |
5. Disclosure and service providers
We do not sell or rent personal data. We disclose only the minimum data necessary to:
- hosting, infrastructure, security, and email-delivery providers acting on our instructions;
- Google Tag Manager and Google Analytics, only when analytics is enabled and you have consented; and
- Saudi authorities, courts, or regulators when a valid legal requirement applies.
We assess service providers, limit their access to the relevant purpose, and require appropriate confidentiality, security, and data-protection commitments. The final approved policy will reflect the verified provider list and processing locations.
6. Processing outside Saudi Arabia
Some technology providers, including Google when analytics is enabled, may process personal data outside Saudi Arabia. Any such transfer or disclosure must comply with Article 29 of the Saudi Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom, including data minimization, transfer-risk assessment, and an applicable approved safeguard where required. Consent to analytics does not replace those transfer requirements.
7. Retention and destruction
- Contact submissions: retained for up to three years unless a shorter period is sufficient or a longer period is required for a documented legal claim or obligation.
- Application rate-limit records: the IP-based in-memory record is normally removed after ten minutes.
- Security and infrastructure logs: retained according to the documented security-logging schedule and only for as long as necessary for security, investigation, or a legal requirement.
- Analytics data: retained according to the verified analytics configuration and deleted or irreversibly anonymized when it is no longer required.
- Cookie preference: stored on your device for up to 180 days, unless you change it or the policy version changes sooner.
At the end of the applicable period, we securely destroy personal data or irreversibly anonymize it so that an individual cannot be re-identified, subject to any binding retention requirement.
8. Your rights
Subject to the conditions and exceptions in Saudi law, you may:
- be informed of the legal basis and purpose of collection and how your personal data is processed;
- access the personal data held about you;
- request a readable and clear copy of that personal data;
- request correction, completion, or updating of inaccurate or incomplete data;
- request destruction of data that is no longer needed, subject to lawful retention requirements;
- withdraw consent at any time for consent-based processing, without affecting earlier lawful processing;
- submit a complaint concerning the application of the PDPL; and
- seek compensation before the competent court if you suffer material or moral damage because of a violation.
Send requests to info@codedev.sa. We may verify your identity before acting. We will act without delay and within 30 days of receiving a complete request. Where legally permitted because of disproportionate effort or multiple requests, we may extend the period by up to 30 additional days and will notify you in advance with the reason.
9. Complaints
Please first send a privacy complaint to info@codedev.sa with enough information for us to investigate. If you are dissatisfied with our response or do not receive a response within the stated period, you may complain to the Saudi Data & AI Authority (SDAIA) through the National Data Governance Platform. Under the Implementing Regulations, a complaint to the competent authority should generally be submitted within 90 days of the incident or becoming aware of it, subject to accepted reasonable causes for delay.
10. Cookies and analytics choices
The website uses strictly necessary browser storage to remember your privacy choice. When analytics is configured, Google Tag Manager and Google Analytics remain blocked unless you choose to allow analytics. Rejecting analytics does not affect access to the website or the contact form. You may reopen “Cookie preferences” in the footer at any time to withdraw or change your choice. Withdrawal clears known first-party analytics cookies and prevents the analytics container from loading on subsequent page loads.
11. Information security
We apply appropriate organizational, administrative, and technical measures intended to protect personal data against unauthorized access, loss, alteration, or disclosure. We apply National Cybersecurity Authority controls where they are binding on CodeDev and otherwise use recognized cybersecurity practices appropriate to the nature and volume of the data.
12. Children and sensitive data
The public website is intended for business and general audiences and is not directed to children. We do not knowingly request personal data from anyone who lacks full legal capacity without the involvement of their legal guardian. If you believe such data was submitted, contact us so that we can assess and take appropriate action.
13. Changes and language
We may update this policy to reflect legal, operational, or technical changes. We will publish the revision date and provide an appropriate notice before a material new use of personal data. The Arabic and English versions are intended to be substantively equivalent. The Arabic version prevails if an inconsistency remains after review.
14. Contact us
- Privacy contact: info@codedev.sa
- Phone: +966 55 101 0098
- Address: Abu Bakr Al-Siddiq Road, Al Yasmin, Riyadh 13325, Saudi Arabia
If CodeDev appoints a Data Protection Officer following the required assessment, the officer's contact details will be published here.