PEM Strategy (“PEM Strategy“, “we“, “us“, or “our“) is committed to protecting the privacy and personal data of visitors to our website, prospective and current clients, candidates, and other individuals with whom we interact. This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard personal data through our website located at [www.pem.sa] (the “Site“), including data collected automatically through Google Analytics and data submitted to us through the Site’s contact form, email links, and enquiry mechanisms.

This Privacy Policy is issued by PEM Strategy, a company organised under the laws of the Kingdom of Saudi Arabia with its registered office at Office A12, 1st Floor, 3754, Al Thoumamah Rd, Al Sahafa District, Riyadh 13315 – 7488, Kingdom of Saudi Arabia, in its capacity as the data controller. It is provided in accordance with the Kingdom of Saudi Arabia’s Personal Data Protection Law, issued by Royal Decree No. M/19 (as amended) (the “PDPL“), and its Implementing Regulations, and applies to the processing of personal data described herein.

Personal data processed in the course of a client engagement is governed exclusively by the confidentiality and data protection terms of the applicable engagement agreement or non-disclosure agreement, which may provide for more extensive protections than those described in this Privacy Policy. This Privacy Policy addresses our processing of personal data through the Site and in connection with general business enquiries and recruitment.

1. Categories of Personal Data We Collect

1.1 Information You Provide Voluntarily

When you contact us through the Site — including via the contact form (name, email address, company, subject, and message), by email, or by telephone — we collect the personal data you choose to provide, which may include your name, business contact details, employer or organisation, professional role, and the content of your communications. If you apply for a role or submit an unsolicited application, we may collect curriculum vitae details, educational and professional history, and related candidate information.

1.2 Information Collected Automatically

When you access the Site, we and our service providers automatically collect technical and usage data through cookies and similar technologies, including your IP address (or truncated form thereof), approximate geographic location, device and browser type, operating system, referring and exit pages, pages visited, time spent on the Site, session duration, and interaction events. This data is collected principally through Google Analytics, as described in Section 4.

1.3 Data We Do Not Collect

We do not knowingly collect sensitive personal data within the meaning of the PDPL (including data revealing health, religious belief, or equivalent categories) through the Site, and you should not submit such data through the Site. We do not knowingly collect personal data from individuals under the age of sixteen (16). If you believe a child has provided personal data through the Site, please contact us so that we may delete it promptly.

2. How We Use Your Personal Data

We process personal data collected through the Site for the following purposes, on the following legal bases:

  • Responding to enquiries and communications (including assessing potential engagements and routing enquiries to the relevant practice or partner) — processed on the basis of your consent, given when you submit information to us, and our legitimate interest in responding to business enquiries.

  • Evaluating candidate applications — processed on the basis of your consent and our legitimate interest in considering candidates for current and future roles.

  • Operating, maintaining, and securing the Site (including monitoring usage, preventing fraud and unauthorised access, and diagnosing technical issues) — processed on the basis of our legitimate interest in the secure operation of our digital presence, without prejudice to your rights.

  • Analysing Site usage and improving content and user experience (including aggregated analytics) — processed on the basis of our legitimate interest in understanding how the Site is used and improving it.

  • Complying with legal and regulatory obligations — processed where necessary for compliance with applicable laws, regulations, and the directives of competent authorities.

We apply the principles of purpose limitation and data minimisation: we collect only personal data adequate, relevant, and limited to what is necessary for the purposes described in this Privacy Policy, and we do not process personal data for purposes incompatible with those purposes. We do not sell personal data, and we do not use personal data collected through the Site for automated decision-making that produces legal or similarly significant effects on you.

3. Legal Bases and Consent

Under the PDPL, personal data may not be processed without your consent, save in the limited circumstances permitted by Article 6 of the Law — including where processing is necessary for a legitimate interest of the controller, without prejudice to your rights and interests and provided no sensitive data is processed, or where processing is pursuant to another law or an agreement to which you are a party. Where we rely on your consent, that consent is freely given, specific to the purposes described at the point of collection, and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Where consent is withdrawn, we will cease the relevant processing unless another lawful basis applies.

4. Cookies and Google Analytics

4.1 Google Analytics

The Site uses Google Analytics, a web analytics service provided by Google LLC (and, in certain jurisdictions, Google Ireland Limited) (“Google“). Google Analytics uses cookies and similar identifiers to collect and analyse information about how visitors use the Site — including the number of visitors, pages visited, traffic sources, session duration, and device and browser characteristics. The cookies used by Google Analytics include, among others, the _ga and _ga_* cookies, which typically persist for up to two (2) years.

The data generated by these cookies about your use of the Site (including your IP address, in truncated or full form depending on configuration) may be transmitted to and stored by Google on servers located outside the Kingdom of Saudi Arabia. Google will use this information for the purpose of evaluating your use of the Site, compiling reports on Site activity, and providing other services relating to Site activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.

We have configured Google Analytics in accordance with our internal data protection standards, including IP anonymisation and restrictions on the use of collected data for other Google services, and our use of Google Analytics is governed by the applicable Google Analytics terms of service and data processing terms. Because Google’s processing may involve a transfer of personal data outside the Kingdom of Saudi Arabia, such transfers are undertaken in accordance with the safeguards for cross-border transfers described in Section 6.

You may learn more about Google’s data processing practices by reviewing Google’s Privacy Policy at https://policies.google.com/privacy. You may prevent Google Analytics from collecting data about your use of the Site by downloading and installing the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout, or by disabling cookies in your browser settings as described below.

4.2 Managing Cookies

You may refuse or delete cookies at any time through your browser settings; most browsers allow you to block cookies generally or on a site-specific basis, and to delete cookies already stored. Blocking cookies may affect the functionality of the Site. Where applicable law requires prior consent for non-essential cookies, such consent is obtained through the Site’s cookie controls before such cookies are set.

5. Recipients and Disclosure

We do not sell or rent personal data. We may disclose or make personal data available to:

  • Our personnel and affiliates — partners, consultants, and professional staff of PEM Strategy who require access for the purposes described above, on a need-to-know basis and subject to confidentiality obligations.

  • Service providers — vendors and processors that host, maintain, or support the Site and our systems, including Google in connection with Google Analytics, each bound by contractual data protection commitments.

  • Professional advisers — legal, audit, and other advisers, to the extent necessary for the provision of their services.

  • Public authorities — where disclosure is required by law, regulation, or a valid order of a competent authority in the Kingdom of Saudi Arabia or another applicable jurisdiction.

  • Successors in a transaction — where we transfer our business or assets in whole or in part in connection with a reorganisation, merger, acquisition, or disposal, in which case personal data will be transferred subject to appropriate safeguards.

Other than as described above, we will not disclose personal data collected through the Site to third parties without your consent, save as permitted by the PDPL.

6. International Data Transfers

PEM Strategy is based in the Kingdom of Saudi Arabia. Our service providers — including Google in connection with Google Analytics — may process personal data in countries outside the Kingdom, whose data protection laws may differ from those of the Kingdom. Transfers of personal data outside the Kingdom of Saudi Arabia are undertaken only where an appropriate safeguard exists under the PDPL and its Implementing Regulations — namely, that the recipient jurisdiction is determined by the Saudi Data and Artificial Intelligence Authority (SDAIA) to provide an adequate level of protection for personal data, or that the transfer is otherwise governed by adequate contractual or other binding safeguards for the protection of personal data and the rights of data subjects. We maintain records of such transfers as required by law.

7. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including responding to your enquiry, and thereafter as required to comply with our legal, regulatory, contractual, and record-keeping obligations under the laws of the Kingdom of Saudi Arabia. Enquiry and contact-form data is retained for 365 days following the conclusion of the relevant communication or engagement; candidate data is retained for 365 days unless a longer period is required. Analytics data is retained in accordance with the retention settings configured in Google Analytics. Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or anonymised in accordance with our data retention schedules and prevailing market practice.

8. Security

We maintain administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction, in proportion to the risks associated with the data and its processing, in accordance with the PDPL and our internal information security policies. Access to personal data is restricted to authorised personnel on a need-to-know basis, and we require equivalent protection from our service providers. In the event of a breach of personal data that is reasonably likely to adversely affect your rights or interests, we will notify the competent authority (the National Data Management Office, “NDMO“) within the period prescribed by the PDPL and, where required, will inform affected data subjects of the breach and any measures they may take. No method of transmission or storage is completely secure; while we take reasonable measures to protect your personal data, we cannot guarantee absolute security.

9. Your Rights

Under the PDPL, you have the following rights in respect of your personal data:

  1. The right to be informed of the legal basis and purpose of the collection and processing of your personal data;

  2. The right of access — to be informed whether your personal data is being processed and to obtain your personal data held by us;

  3. The right to obtain a copy of your personal data in a readable and clear format;

  4. The right to correct, complete, or update your personal data held by us; and

  5. The right to request destruction of your personal data when it is no longer needed for the purposes for which it was collected, subject to any legal retention obligations.

You also have the right to withdraw your consent to processing at any time where processing is based on consent, and the right to refuse the use of your personal data for direct marketing and advertising without your consent, in which case we will cease such use promptly.

9.1 Exercising Your Rights

To exercise any of these rights, please contact us at [privacy@pem.sa] or [Insert Data Protection Officer / Point of Contact], using the contact details in Section 12. We will acknowledge your request and respond within the timeframes prescribed by the PDPL and its Implementing Regulations. We may take reasonable steps to verify your identity before acting on a request, and we may decline a request in whole or in part only to the extent permitted by law, in which case we will explain the basis for our decision. If you are not satisfied with our response, you have the right to submit a complaint to the NDMO in accordance with the procedures prescribed by SDAIA.

10. Third-Party Websites and Platforms

The Site contains links to third-party websites and platforms — including professional networking sites (such as LinkedIn) and mapping services (such as Google Maps) — which may collect personal data when you interact with them. This Privacy Policy does not apply to the practices of such third parties, which are governed by their own terms of use and privacy policies. The inclusion of a link does not constitute an endorsement of, or affiliation with, the third party, and we are not responsible for their data practices.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, our business, or applicable law, including amendments to the PDPL or its Implementing Regulations. The current version, with its effective date, will always be published on this page. Material changes will be brought to your attention through the Site. Your continued use of the Site following publication of an updated Privacy Policy constitutes acknowledgment of the updated policy.

12. Contact Us

Questions, requests, or complaints concerning this Privacy Policy or our processing of your personal data may be directed to:

PEM Strategy — Attn: [Data Protection Officer / Privacy Contact]
Office A12, 1st Floor, 3754, Al Thoumamah Rd, Al Sahafa District
Riyadh 13315 – 7488, Kingdom of Saudi Arabia
Telephone: +966 11 265 6700
Email: [privacy@pem.sa]