Privacy Policy
Privacy Policy
Last updated: 2026-10-18
1. Who we are. The controller of your personal data is Mindy Solutions Company, with unified business number 7053489634, address Riyadh - Saudi Arabia, Riyadh, Kingdom of Saudi Arabia, trading as "Mindy Solutions" through mindysol.com. This Policy applies the Personal Data Protection Law and its regulations.
2. Data we collect.
- Contact and identity: name, mobile number, email address, company name.
- Service and research requests: requested services, company size, sector, research type, timeline, expected budget, objectives and notes.
- Subscription and payment: package, payment method, bank transfer receipt, and address when Tamara is selected. We do not receive or store card details; they are entered directly with the payment provider.
- Messages and chats: what you send through the contact form or the chat assistant.
- Complaints and refund or cancellation requests: what you enter in the complaints form: name, email address, order or subscription number (optional), request type and details. The form is sent to our mailbox, hello@mindysol.com.
- Recruitment: CV, cover letter and professional profile link.
- Account and orders: registration details, two-step verification settings if you enable them, your orders, licences, Purchase Codes and their activation records, and the record of your acceptance of our terms.
- Technical and measurement data: session identifier, display preferences and your choice in the privacy banner. Only after your consent: browsing and interaction data and visit-source data through the measurement tools listed in clause 5. Each time a page is opened, our website also records in its internal statistics the event type, the page and the visit source, without waiting for your choice in the privacy banner; this log is not shared with external measurement tools.
- Our clients' customers' data: processed on behalf of the client when delivering its services, and governed by clause 9.
3. Purposes and legal basis.
| Purpose | Data | Basis |
|---|---|---|
| Responding to enquiries and service or research requests | Contact, messages, requests | Your consent when you submit the request |
| Performing the subscription or order, running your account, support | Contact, subscription and payment, account | Performance of an agreement to which you are a party |
| Verifying payment, billing and reviewing refund requests | Subscription and payment, Purchase Code activation records | Performance of the agreement and applicable laws |
| Reviewing and responding to complaints and refund or cancellation requests submitted through the complaints form | Complaints form data | Performance of our agreement with you if you are a customer, and our legitimate interest in reviewing and responding to your complaint where there is no agreement |
| Proving your acceptance of our terms and policies | Consent record | Legitimate interest in evidencing the agreement |
| Internal visit log: operating the website and understanding which pages are visited most | Event type, page and visit source | Legitimate interest |
| Sending offers and the newsletter | Email and mobile | Your separate consent, which you may withdraw at any time |
| Measuring website and campaign performance | Measurement data | Your consent through the privacy banner |
| Operating and securing the website and preventing fraud | Necessary technical data | Legitimate interest |
| Reviewing job applications | Recruitment data | Your consent when you apply |
4. Consent and withdrawal. Where we rely on consent, it is requested separately and expressly and is not a condition of a service that does not need it. You may withdraw it at any time using the unsubscribe link in our messages, the "Privacy settings" button on the website, or by writing to hello@mindysol.com. Withdrawal does not affect processing carried out before it.
5. Who we share data with. We do not sell your data. We share it only as necessary with:
| Recipient | Purpose | When |
|---|---|---|
| Tamara | Instalments, payment and refunds | When you choose Tamara |
| Card payment provider: تمارا, StreamPay | Card and Apple Pay payments and refunds | When you pay by card |
| Google (Google Tag Manager, Google Analytics 4) | Measuring visits and conversions | Only after your consent |
| TikTok (TikTok Pixel) | Measuring campaign conversions | Only after your consent |
| X (the X Pixel advertising tag) | Measuring advertising campaign conversions | Only after your consent |
| Competent government authorities | Legal obligations or official requests | Where required |
6. Transfers outside the Kingdom. Some data may be processed by providers outside the Kingdom, such as measurement tools that you choose to enable through consent. Such transfers are made only in accordance with the Personal Data Protection Law and its regulations, with the safeguards they require.
7. Retention.
These are maximum internal-policy periods where a legitimate purpose and genuine need continue, not general statutory periods. We periodically review that need and destroy or irreversibly anonymise data without delay when its purpose ends, unless a legal ground requires continued retention. Archiving does not displace this rule and is limited to the minimum data with restricted access.
| Data | Period |
|---|---|
| Enquiries, service and research requests and chats without a contract | One year from the last contact, then kept in an archive for three (3) years |
| Client, subscription, invoice and refund-request data | For the contract term, then as required by law |
| Record of acceptance of terms | For the relationship, then one year, then kept in an archive for three (3) years |
| Complaints and refund or cancellation requests via the complaints form | One year from the last contact about the request, then kept in an archive for three (3) years |
| Newsletter and offers | Until consent is withdrawn |
| Job applications | One year from the application date, then kept in an archive for three (3) years, unless you agree to a longer period |
| Your privacy banner choice | 180 days, after which we ask again |
Visit-source data (mindy_attr_client_v1) | 90 days, only after consent |
| Internal visit log | One year |
At the end of the period, data is destroyed or made non-identifiable.
8. Your rights. Under the law you have the right to be informed about how your data is processed, to access it and obtain a copy, to request its correction or update, to request its destruction when it is no longer needed unless there is a legal ground to retain it, and to withdraw your consent. Send your request to hello@mindysol.com; we may ask for proof of identity and will respond within the statutory period. You may also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).
9. Data we process for our clients. When we run campaigns, the chat assistant or integrations for our clients, the client is the controller and we are the processor, acting on its written instructions. The client is responsible for the lawfulness of collecting its customers' data and for obtaining any required consents.
10. Marketing. We send offers or marketing messages only to people who have expressly ticked the optional "I agree to receive offers from Mindy Solutions, and I can stop them at any time." box or subscribed to the newsletter. Every message includes an easy way to opt out.
11. Security. We apply appropriate organisational and technical measures, including encryption in transit and access restrictions. If a data breach occurs, we take the necessary steps and notify the competent authority and affected individuals as required by law.
12. Children. Our services are intended for businesses and adults, and we do not knowingly collect data from persons under the legal age.
13. Cookies. We use cookies necessary to run the website, and measurement tools, including the X Pixel advertising tag, which run only after your consent through the privacy banner. You can change your choice at any time. Details are in our Cookie Policy.
14. Contact us. Requests relating to your personal data: hello@mindysol.com. For any other enquiry: the contact form at mindysol.com/contact, a support ticket, or hello@mindysol.com.
15. Changes. We may update this Policy, show the date of the last update at the top, and notify you of material changes before they take effect.