Privacy Policy

Last updated: 18 September 2025

Kaizen Consulting (“Kaizen”, “we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our websites (including kaizen.sa) and any related pages, forms, or services (the “Site”), attend our events, participate in our research, or interact with us.

If you do not agree with this Policy, please do not use the Site.

Articles

1. Who we are & how to contact us

Controller: Kaizen Consulting
Email: info@kaizen.sa
Address: P.O. Box 90987, Al Taawun District, Al Taawun Commercial Center, Riyadh 11623, KSA.
Quick Contact: 0506261096 (Mr. Suliman)

2. When we collect personal data

We collect personal data when you:

    • Register or create an account on our Site or community spaces.
    • Subscribe to newsletters, insights, or updates.
    • Register for or attend a Kaizen webinar, workshop, or event (virtual or in-person).
    • Request information about our services, download materials, or book a demo/meeting.
    • Participate in Kaizen research (e.g., interviews, surveys, testimonials/case studies).
    • Apply for a job with Kaizen.
    • Interact with our emails or our pages on social media.
    • Browse the Site (via cookies or similar technologies).
3. What personal data we collect

Depending on your interaction with us, we may collect:

    • Identity & contact data: name, email, phone, job title, company/organization, country, preferred language.
    • Account & community data: profile info you add (e.g., role, interests), posts or comments you share in community spaces.
    • Event data: registration status, attendance (virtual or in-person), session preferences, and—only if you choose to provide them—dietary or accessibility needs.
    • Research data: your responses, availability, and recordings if you consent (for validation and quality).
    • Career data: resume/CV, work history, education, references (if provided).
    • Technical & usage data: IP address, device/browser info, log data, pages viewed, referral URLs, email opens/clicks, and interactions with downloads or links.
    • Public & social data: information you make public (e.g., LinkedIn) or provide via social sign-in.

We do not knowingly collect personal data from children; you must be at least 18 to use the Site.

4. Why we use personal data (purposes) & legal bases
We use your data to:

    • Provide and operate our services: Manage accounts, respond to inquiries, and process event registrations.
      Legal bases: legitimate interests; consent (where required).
    • Communicate with you: Send service messages (policy updates, security notices), confirmations, and event information.
      Legal bases: legal obligation; legitimate interests.
    • Research & thought leadership: Conduct interviews/surveys; develop case studies or testimonials (with your consent for use/attribution).
      Legal bases: consent; legitimate interests.
    • Events (virtual & in-person): Manage attendance, networking features, session access, and feedback.
      Legal bases: contract performance; consent; legitimate interests.
    • Security, compliance & improvement: Maintain Site security (e.g., IP logging, fraud prevention), comply with legal obligations, and analyze usage to improve Site performance and content.
      Legal bases: legal obligation; legitimate interests.
5. Cookies & similar technologies
We use:

    • Necessary cookies to run core Site features and keep you signed in.
    • Analytics cookies to understand usage, improve content, and fix issues.
      Preference cookies to remember your settings (e.g., language).

Control cookies via your browser settings. Blocking some cookies may affect Site functionality.

6. When we share personal data
We may share personal data with:

    • Service providers (e.g., hosting, analytics, email delivery, event platforms, customer support) under contracts requiring confidentiality and security.
    • Event partners/sponsors only when you opt in during registration or by explicit action (e.g., badge scan/virtual sponsor engagement).
    • Professional advisers (legal, compliance, accounting) under confidentiality obligations.
    • Authorities where required by law or to protect rights, safety, or security.
    • Corporate transactions (e.g., merger, acquisition), subject to appropriate safeguards.

We do not sell personal data.

7. International transfers

Where required, we use appropriate safeguards (e.g., SDAIA-approved mechanisms, contractual clauses, risk assessments) to protect your data.

8. Data retention

We keep personal data only as long as necessary for the purposes described above, to comply with legal obligations, or to resolve disputes. Retention periods vary by data type and context.

9. Your rights

Subject to applicable law (including the Saudi PDPL and, where relevant, GDPR), you may have the right to:

    • Access your personal data and obtain a copy.
    • Rectify inaccurate or incomplete data.
    • Erase personal data where applicable.
    • Restrict or object to certain processing (including direct marketing).
    • Withdraw consent at any time (does not affect prior processing).
    • Data portability (where applicable).
    • Complain to the competent supervisory authority.

To exercise your rights, contact info@kaizen.sa. We may need to verify your identity.

10. Security

We use administrative, technical, and physical safeguards (including encryption in transit, access controls, and monitoring) to protect personal data.

11. Research recordings & calls

With your explicit consent, we may record interviews, webinars, or customer reference calls for quality and research validation. You can decline or ask us to stop recording at any time.

12. Community areas & user content

Public or shared areas (e.g., comments, community threads) may be visible to other users. Avoid posting sensitive personal data. We may moderate per our terms of use.

13. Third-party links & embedded content

Our Site may include links or embedded content from third-party sites or platforms. Their privacy practices are governed by their own policies. Please review them before interacting.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date. Significant changes may also be communicated by email or a Site notice.

Saudi PDPL Guidance

A. Roles & oversight
    • Competent Authority: The Saudi Data & AI Authority (SDAIA) supervises PDPL implementation. We cooperate with SDAIA and maintain documentation to demonstrate compliance.
    • Data Protection Officer (DPO): Kaizen appoints a DPO (employee or external) to monitor compliance, oversee procedures, and receive data-subject requests.
B. Lawful bases (PDPL)

We rely on the lawful bases recognized under PDPL—including consent, contract performance, legal obligation, vital interests, public interest, and legitimate interests (subject to balancing tests and exclusions for sensitive data). Marketing relies on consent where required.

C. Special categories & minors
    • We apply heightened safeguards for sensitive personal data (e.g., health, genetic, biometric) and process only where a PDPL basis and conditions are met.
    • For children’s data, consent must be given or authorized by a guardian.
D. Cross-border transfers
Transfers outside the Kingdom are allowed only under PDPL/Regulations conditions—for example: adequacy findings, approved safeguards (e.g., standard clauses, binding rules), explicit consent (where permitted), and documented risk/impact assessments for ongoing or large-scale/sensitive transfers. Kaizen implements these safeguards and keeps records of transfer assessments.
E. Transparency & privacy notices

We provide clear notices at collection that state the purposes, lawful bases, retention periods, sharing categories, transfer safeguards (if any), and how to exercise rights—consistent with PDPL.

F. Data subject rights handling
We maintain procedures to authenticate, log, assess, and respond to requests for access, rectification, erasure, restriction, objection, portability (where applicable), and withdrawal of consent within PDPL timelines.
G. Security & breach notification

We deploy technical/organizational measures proportionate to risks. If a personal data breach could harm data or data subjects or conflict with their rights/interests, we will notify SDAIA within 72 hours of awareness, and notify affected individuals without undue delay where required. We use SDAIA’s breach portal and follow the procedural guide.

H. Records, DPIAs & vendor management

We maintain internal records of processing, conduct Data Protection Impact Assessments (DPIAs) when required, and ensure processors act under written instructions, apply PDPL-level security, and do not sub-process without safeguards—per the Implementing Regulations.