Legal
Privacy Policy
How Aman X handles personal data collected through this website.
Introduction and scope
This Privacy Policy explains how Aman X handles personal data collected through this website. It describes what the website actually does — the data it collects, why, where it is kept, how long it is kept, and the rights available to you.
It applies to the public Aman X website at aman-x.sa and to enquiries submitted through it. It does not cover services delivered to clients under a separate written agreement, which are governed by that agreement, nor does it cover any website or platform operated by another organisation.
This policy is written to reflect the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulation.
Who controls your data
The data controller is Aman X, operated by شركة أمانكس سايبرسيكيوريتي, a limited liability company registered in the Kingdom of Saudi Arabia under Unified National Number 7054004473.
- Brand: Aman X
- Registered entity: شركة أمانكس سايبرسيكيوريتي
- Unified National Number: 7054004473
- Entity type: Limited liability company
- Registered address: Aman X, operated by شركة أمانكس سايبرسيكيوريتي, Building 2891, Prince Sultan Ibn Abdulaziz Street, North Mathar District, Riyadh 12312, Kingdom of Saudi Arabia.
- Privacy contact: privacy@aman-x.sa
The registered address above is the entity's Saudi National Address. "Aman X, operated by شركة أمانكس سايبرسيكيوريتي" identifies the operator in English; it is not a registered English company name, and no such name exists.
The Unified National Number is the registration identifier issued in the Kingdom. It is not a tax or VAT registration number.
A dedicated privacy contact channel is available at privacy@aman-x.sa. Enquiries sent to it are handled by the team responsible for privacy matters at Aman X. We do not describe this as a Data Protection Officer mailbox, because no such formal appointment has been made.
What personal data we collect
This website collects personal data in three ways only: when you submit the contact form, through technical records created automatically when your browser requests a page, and through a small amount of browser storage described in the next section.
Contact form
When you submit an enquiry, we collect:
- Your name — required
- Your email address — required
- Your message — required
- Your company name — optional
- Your phone number — optional
- The language version of the site you used
- The IP address the enquiry was sent from, recorded with the submission
The form contains one hidden field that is never shown to you and must remain empty. It exists to detect automated submissions, and its contents are not stored.
Technical and security records
When your browser requests a page, the web server and the network provider in front of it create ordinary technical records. These typically include the IP address, the date and time, the address of the page requested, the response status, and the browser identification string your browser sends. These records exist to operate the service, investigate errors, and detect abuse.
What we do not collect here
This website does not ask for, and its contact form does not store, a job title, a subject line, a service-interest selection, a marketing preference, or any payment or identity document data. It does not create user accounts for visitors. We do not knowingly collect sensitive personal data through this website, and you should not include such data in an enquiry message.
Cookies and browser storage
This website uses no advertising cookies, no analytics cookies, and no third-party tracking technologies. There is nothing here to opt into, which is why you are not shown a consent banner.
Cookie
- Name: axpub. First-party. Strictly necessary.
- Purpose: it holds the session used to issue and verify the security token that protects the contact form against cross-site request forgery.
- Set when: a page containing the contact form is served.
- Duration: it expires when you close your browser. It is marked HttpOnly and SameSite=Lax, and is sent only over HTTPS in production.
Local storage
- Name: amanx_theme. First-party. Preference only.
- Purpose: remembers whether you chose the light or dark appearance.
- It stays in your browser, is never transmitted to us, and contains no identifier. Clearing your browser storage removes it.
Your language choice is not stored: it is part of the page address (/en/ or /ar/).
The network provider in front of the website may set its own cookies in order to protect the service — for example when distinguishing automated traffic from real visitors. No such cookie was observed on the pages tested. Where one is set, it is a security function of that provider.
Why we process your data, and on what basis
We process personal data for the following purposes only:
- To read your enquiry, respond to it, and manage the correspondence that follows from it.
- To keep a record of enquiries received, so that follow-up is accurate and accountable.
- To operate, secure and maintain the website — including detecting abuse, limiting repeated automated submissions, and investigating errors.
- To meet obligations imposed on us by applicable law or by a competent authority.
The basis for processing enquiry data is your own submission of the enquiry for the stated purpose of receiving a response, together with our legitimate interest in responding to business enquiries and keeping an accurate record of them. The basis for processing technical and security records is our legitimate interest in keeping the service available and protected. Where we rely on your consent, you may withdraw it at any time, as described under your rights below.
We do not use enquiry data for advertising, we do not build profiles from it, we do not use it for automated decision-making that produces legal effects, and we do not sell it.
Required and optional information
Name, email address and message are required: without them we cannot identify who is asking, reply, or understand the request. Company name and phone number are optional and may be left blank; providing them only helps us route and answer the enquiry. Declining to provide the optional fields has no other consequence.
Who receives your data
Access to enquiry data inside Aman X is limited to the people who need it to answer you or to administer the website.
Outside Aman X, personal data is handled by the service providers we rely on to run the website:
- The hosting provider that operates the servers on which the website and its database run.
- The content delivery and security network placed in front of the website, which receives every request in order to route it, serve cached content, and filter abusive traffic. Requests, including the IP address they come from, pass through this network.
- The mail service used to deliver an enquiry notification to our own mailbox.
We may also disclose personal data where a competent authority requires it, where applicable law obliges us to, or where it is necessary to establish, exercise or defend a legal claim.
We do not state that your data is never shared. It is shared with the providers above, because the website cannot operate otherwise. What we do not do is share it with advertisers, data brokers, or any party seeking it for their own marketing.
Where your data is processed
The primary Aman X website and its primary website database are hosted in the Kingdom of Saudi Arabia.
That statement is deliberately limited to the website and its primary database. It does not mean that every part of the service operates only inside the Kingdom:
- The content delivery and security network in front of the website operates from many locations worldwide, and a request is normally handled at an edge location near the visitor. A visitor outside the Kingdom will therefore usually have their request processed outside the Kingdom.
- Copies of enquiry notifications held in email, and any backups, follow the arrangements of the relevant provider, which we assess separately rather than assume.
Where a transfer of personal data outside the Kingdom takes place, it is subject to the requirements of the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom.
We do not claim that no international processing occurs. Stating that would be inaccurate for any website served through a global delivery network.
How long we keep your data
Aman X normally retains personal data collected through the website for no longer than one year from the date of collection, or from the date of the most recent relevant interaction where the data is still being used for the same enquiry or purpose. After that period the data is securely deleted, securely destroyed, or irreversibly anonymised.
A longer period applies only where it is required by applicable law, required by a competent authority, necessary for an active contract, or necessary for an active legal claim, dispute, investigation, or the defence of legal rights. Any such exception is documented, has a specific purpose, is limited to the minimum data necessary, and is reviewed when the reason for it ends.
The one-year rule applies to the personal data under our control, including:
- contact-form submissions and the correspondence arising from them
- names, business email addresses, phone numbers and company details supplied with an enquiry
- the message content itself
- the IP address and timestamp stored with an enquiry
- application logs containing identifiable visitor data
- copies of enquiry emails retained by us
- administrative records containing personal data, where no separate legal obligation requires a longer period
- backups containing the website’s personal data
Independent providers apply their own retention rules to the records they create — for example the network provider’s own traffic logs. We do not claim that they automatically follow our one-year period. Where their documented behaviour differs, we record the difference and address it through configuration or contract rather than by asserting a control we do not have.
How we protect your data
The website applies the following safeguards:
- All traffic is served over an encrypted HTTPS connection.
- The contact form is protected by a security token that prevents submissions forged from another site.
- Submissions are validated on the server, not only in the browser, and repeated submissions from the same address are rate-limited.
- Enquiries are written to the database using prepared statements, so submitted text cannot alter a database query.
- Administrative access is authenticated and restricted.
- Access to enquiry data is limited to those who need it.
No website can be guaranteed to be completely secure, and we do not claim otherwise. These measures reduce risk; they do not eliminate it.
Your rights
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia you have the following rights in relation to your personal data:
- To be informed — to know the legal basis on which your personal data is collected and the purpose of collecting it.
- To access your personal data held by us.
- To obtain a copy of your personal data in a readable and clear format.
- To request correction of your personal data where it is inaccurate, incomplete, or out of date.
- To request destruction of your personal data where the conditions of the Law are met.
- To withdraw your consent at any time, where consent is the basis on which we process the data.
How to exercise them
Write to privacy@aman-x.sa and describe what you are asking for. To protect your data we may need to confirm your identity or ask for enough detail to locate the relevant record — for example the email address used in your enquiry.
We will respond within the period required by the applicable regulations. If we cannot act on a request — for example where the Law requires us to keep the data, or where it relates to an active legal claim — we will tell you why.
Exercising these rights is free of charge.
Questions and complaints
If you have a question about this policy, or you believe your personal data has been handled improperly, contact us first at privacy@aman-x.sa. We would rather resolve the matter directly and quickly.
If you are not satisfied with our response, you may raise the matter with the competent supervisory authority for personal data protection in the Kingdom of Saudi Arabia.
Children
This website presents business services and is intended for professional and organisational audiences. It is not directed at children, and we do not knowingly collect personal data from children through it.
If you believe a child has submitted personal data through this website, write to privacy@aman-x.sa and we will delete it.
Links to other services
This website links to a small number of external destinations, including a WhatsApp contact link and links used to verify certifications. Following any of these takes you to a service operated by another organisation.
When you use the WhatsApp link, you leave this website. The message is then handled by WhatsApp and the account that receives it, under WhatsApp’s own terms and privacy practices, not this policy. This website does not receive or store your WhatsApp messages, and clicking the link alone does not send us any data.
We are not responsible for the content or the privacy practices of external services. Review their policies before providing them with personal data.
Changes to this policy
We may update this policy when the website changes, when our processing changes, or when the applicable regulations change. The version number and effective date shown at the top of this page always identify the current text.
Where a change materially affects how we handle personal data already collected, we will take reasonable steps to make that change clear rather than relying on a silent edit.
Languages
This policy is published in Arabic and English. Both versions describe the same practices. In the event of any discrepancy between them, the Arabic version prevails.