Website Privacy Policy

Scope of this policy

VASTSOFT Establishment is a software company registered in the Kingdom of Saudi Arabia (Commercial Registration No. 1010838619; Unified National Number 7031622371). The Website is an informational showcase for our company, services, and products. This policy describes the personal data we process about visitors to the Website, where we act as the data controller.

VASTSOFT is registered in the National Register for Personal Data Protection, maintained by the Saudi Data and AI Authority (SDAIA) on the National Data Governance Platform, under Registration No. 3260006717 (issued 5 June 2026; status: active). The official contact registered for data protection is [email protected], +966 55 502 8400.

This policy does not cover the products we offer. When you sign up for or use a product such as VOrder or VMail, the personal data processed inside that product is governed by that product’s own privacy policy and, where the product is operated on behalf of a business customer, by the agreement between us and that customer. Please read the relevant product policy separately.

You can reach us about the Website and your personal data at [email protected].

Data we collect on the Website

When you visit or interact with the Website, we may collect:

• Contact and enquiry data: your name, email address, and phone number when you request a call on the Contact us page; and the contact details, product selection, and project brief you submit through interest and service-request forms. These requests are sent to our team by email so we can respond.
• Technical and device data: information needed to deliver and secure the Website, which may include your public IP address and request details in hosting or security logs. This is separate from the optional tracking described below.
• Advertising and product analytics data: only after you select Agree, VData, our self-hosted Rybbit service at vdata.vast.sa, collects and stores your public IP address together with pages viewed, page URLs and their parameters, referrers, outbound link interactions, browser and device information, and browser errors. It also records browsing sessions, including page content and interactions, with input values masked by the tracker by default.

Session recordings and other optional tracking start only after you agree. We do not log the full content of your HTTP traffic. We do not knowingly collect sensitive personal data through the Website, and if such data is submitted to us inadvertently, we delete it.

How we use data

We use the personal data collected on the Website to respond to your enquiries and call requests, to operate, secure, and maintain the Website, to detect and prevent fraud, abuse, and security incidents, and to comply with our legal obligations. With your consent, we also use public IP addresses and Website usage data for advertising and product analytics, including understanding visits and improving our products.

We do not sell your personal data. Optional use of your public IP address and usage data for advertising and product analytics is subject to your consent.

Legal basis

Under the PDPL we process personal data on one or more of the following bases: your consent; your request and our legitimate interest in responding to and following up on your enquiry; our legitimate interest in operating and securing the Website, provided this does not override your rights; and compliance with legal obligations.

Optional advertising and product analytics run only after you select Agree in our privacy notice. Declining does not prevent you from using the Website. You can reopen the notice through Privacy choices in the footer and withdraw your consent at any time.

Cookies, analytics, and consent

When you first visit the Website, a small privacy notice asks whether you agree to the collection and storage of your public IP address and usage data, including session recordings, for advertising and product analytics. VData is not loaded before you agree. Selecting Decline keeps this optional tracking disabled. We store your choice on your device so it can be remembered on later visits.

You can reopen the notice through Privacy choices in the footer to change your choice. Withdrawing consent stops future optional tracking on this device; it does not automatically delete data already collected. To request deletion of existing personal data, contact [email protected]. Clearing browser storage or using another browser or device may cause the notice to appear again.

Sharing and disclosure

We share personal data only as needed to run the Website:

• Service providers and processors (such as hosting, analytics, and email-delivery providers) who process data on our instructions under confidentiality and data protection terms.
• Authorities or third parties where required by the laws of the Kingdom of Saudi Arabia, a court order, or to establish, exercise, or defend legal rights, or to protect our users or the public.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy.

Data location and cross-border transfers

We host and process personal data both inside the Kingdom of Saudi Arabia and outside it, including through service providers located abroad. Any transfer of personal data outside the Kingdom is carried out in line with the PDPL and the Regulations on Personal Data Transfer outside the Kingdom.

Where the destination country is not covered by an adequacy decision published by SDAIA, we rely on appropriate safeguards — such as SDAIA’s Standard Contractual Clauses — and we carry out a transfer risk assessment, limiting the data transferred to the minimum necessary and applying additional protections where needed.

Data retention

We keep contact and enquiry data submitted through the "Contact us" form only for as long as needed to respond to you, and in any case we delete it within 30 days of your enquiry, unless a longer period is required to comply with a legal obligation or to establish or defend a legal claim. Analytics and technical data are kept for a limited period appropriate to security and analytics, after which they are deleted or anonymized.

Security

We apply organizational, administrative, and technical measures — including encryption in transit and at rest, access controls, and regular review — to protect personal data against loss, unauthorized access, alteration, or disclosure. No system is perfectly secure, but if a personal data breach occurs we will notify SDAIA within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the breach may cause damage to their data or conflict with their rights and interests, as required by the PDPL.

Your rights

Subject to the PDPL, you have the right to:

• Be informed about how your personal data is processed.
• Access the personal data we hold about you and obtain a copy of it in a readable, commonly used format.
• Request correction of inaccurate, incomplete, or outdated data.
• Request destruction of your data where there is no lawful reason to keep it.
• Request that we restrict processing in defined circumstances.
• Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days, extendable in the cases allowed by the PDPL. You also have the right to lodge a complaint with SDAIA, the competent authority in the Kingdom, within 90 days.

Children

The Website is intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the "last updated" date. We will communicate significant changes through the Website or by email where appropriate.

Contact us

For any question about this policy or your personal data on the Website, contact us at [email protected] or through our contact page.