Privacy Policy
Last updated: 18 September 2025
Kaizen Consulting (“Kaizen”, “we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our websites (including kaizen.sa) and any related pages, forms, or services (the “Site”), attend our events, participate in our research, or interact with us.
If you do not agree with this Policy, please do not use the Site.
Articles
1. Who we are & how to contact us
Controller: Kaizen Consulting
Email: info@kaizen.sa
Address: P.O. Box 90987, Al Taawun District, Al Taawun Commercial Center, Riyadh 11623, KSA.
Quick Contact: 0506261096 (Mr. Suliman)
2. When we collect personal data
We collect personal data when you:
-
- Register or create an account on our Site or community spaces.
- Subscribe to newsletters, insights, or updates.
- Register for or attend a Kaizen webinar, workshop, or event (virtual or in-person).
- Request information about our services, download materials, or book a demo/meeting.
- Participate in Kaizen research (e.g., interviews, surveys, testimonials/case studies).
- Apply for a job with Kaizen.
- Interact with our emails or our pages on social media.
- Browse the Site (via cookies or similar technologies).
3. What personal data we collect
Depending on your interaction with us, we may collect:
-
- Identity & contact data: name, email, phone, job title, company/organization, country, preferred language.
- Account & community data: profile info you add (e.g., role, interests), posts or comments you share in community spaces.
- Event data: registration status, attendance (virtual or in-person), session preferences, and—only if you choose to provide them—dietary or accessibility needs.
- Research data: your responses, availability, and recordings if you consent (for validation and quality).
- Career data: resume/CV, work history, education, references (if provided).
- Technical & usage data: IP address, device/browser info, log data, pages viewed, referral URLs, email opens/clicks, and interactions with downloads or links.
- Public & social data: information you make public (e.g., LinkedIn) or provide via social sign-in.
We do not knowingly collect personal data from children; you must be at least 18 to use the Site.
4. Why we use personal data (purposes) & legal bases
-
- Provide and operate our services: Manage accounts, respond to inquiries, and process event registrations.
Legal bases: legitimate interests; consent (where required). - Communicate with you: Send service messages (policy updates, security notices), confirmations, and event information.
Legal bases: legal obligation; legitimate interests. - Research & thought leadership: Conduct interviews/surveys; develop case studies or testimonials (with your consent for use/attribution).
Legal bases: consent; legitimate interests. - Events (virtual & in-person): Manage attendance, networking features, session access, and feedback.
Legal bases: contract performance; consent; legitimate interests. - Security, compliance & improvement: Maintain Site security (e.g., IP logging, fraud prevention), comply with legal obligations, and analyze usage to improve Site performance and content.
Legal bases: legal obligation; legitimate interests.
- Provide and operate our services: Manage accounts, respond to inquiries, and process event registrations.
5. Cookies & similar technologies
-
- Necessary cookies to run core Site features and keep you signed in.
- Analytics cookies to understand usage, improve content, and fix issues.
Preference cookies to remember your settings (e.g., language).
Control cookies via your browser settings. Blocking some cookies may affect Site functionality.
6. When we share personal data
-
- Service providers (e.g., hosting, analytics, email delivery, event platforms, customer support) under contracts requiring confidentiality and security.
- Event partners/sponsors only when you opt in during registration or by explicit action (e.g., badge scan/virtual sponsor engagement).
- Professional advisers (legal, compliance, accounting) under confidentiality obligations.
- Authorities where required by law or to protect rights, safety, or security.
- Corporate transactions (e.g., merger, acquisition), subject to appropriate safeguards.
We do not sell personal data.
7. International transfers
Where required, we use appropriate safeguards (e.g., SDAIA-approved mechanisms, contractual clauses, risk assessments) to protect your data.
8. Data retention
We keep personal data only as long as necessary for the purposes described above, to comply with legal obligations, or to resolve disputes. Retention periods vary by data type and context.
9. Your rights
Subject to applicable law (including the Saudi PDPL and, where relevant, GDPR), you may have the right to:
-
- Access your personal data and obtain a copy.
- Rectify inaccurate or incomplete data.
- Erase personal data where applicable.
- Restrict or object to certain processing (including direct marketing).
- Withdraw consent at any time (does not affect prior processing).
- Data portability (where applicable).
- Complain to the competent supervisory authority.
To exercise your rights, contact info@kaizen.sa. We may need to verify your identity.
10. Security
We use administrative, technical, and physical safeguards (including encryption in transit, access controls, and monitoring) to protect personal data.
11. Research recordings & calls
With your explicit consent, we may record interviews, webinars, or customer reference calls for quality and research validation. You can decline or ask us to stop recording at any time.
12. Community areas & user content
Public or shared areas (e.g., comments, community threads) may be visible to other users. Avoid posting sensitive personal data. We may moderate per our terms of use.
13. Third-party links & embedded content
Our Site may include links or embedded content from third-party sites or platforms. Their privacy practices are governed by their own policies. Please review them before interacting.
14. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new “Last updated” date. Significant changes may also be communicated by email or a Site notice.
Saudi PDPL Guidance
A. Roles & oversight
-
- Competent Authority: The Saudi Data & AI Authority (SDAIA) supervises PDPL implementation. We cooperate with SDAIA and maintain documentation to demonstrate compliance.
- Data Protection Officer (DPO): Kaizen appoints a DPO (employee or external) to monitor compliance, oversee procedures, and receive data-subject requests.
B. Lawful bases (PDPL)
We rely on the lawful bases recognized under PDPL—including consent, contract performance, legal obligation, vital interests, public interest, and legitimate interests (subject to balancing tests and exclusions for sensitive data). Marketing relies on consent where required.
C. Special categories & minors
-
- We apply heightened safeguards for sensitive personal data (e.g., health, genetic, biometric) and process only where a PDPL basis and conditions are met.
- For children’s data, consent must be given or authorized by a guardian.
D. Cross-border transfers
E. Transparency & privacy notices
We provide clear notices at collection that state the purposes, lawful bases, retention periods, sharing categories, transfer safeguards (if any), and how to exercise rights—consistent with PDPL.
F. Data subject rights handling
G. Security & breach notification
We deploy technical/organizational measures proportionate to risks. If a personal data breach could harm data or data subjects or conflict with their rights/interests, we will notify SDAIA within 72 hours of awareness, and notify affected individuals without undue delay where required. We use SDAIA’s breach portal and follow the procedural guide.
H. Records, DPIAs & vendor management
We maintain internal records of processing, conduct Data Protection Impact Assessments (DPIAs) when required, and ensure processors act under written instructions, apply PDPL-level security, and do not sub-process without safeguards—per the Implementing Regulations.