Privacy Policy

1. Who we are

Al Samhan Law is a law firm licensed in the Kingdom of Saudi Arabia, with offices in Riyadh and Jeddah. We recover unpaid commercial debts owed by Saudi companies to companies outside Saudi Arabia.

For the purposes of data protection law, Al Samhan Law is the controller of the personal data described in this policy. That means we decide why your information is collected and how it is used, and we are responsible for it.

2. What this policy covers

This policy covers the information you give us through the application form on this website, anything you send us afterwards while we assess your case, and the information we hold if we go on to act for you.

It does not cover other websites we link to. If you follow a link away from this site, that website will have its own policy and we are not responsible for it.

3. The information we collect

When you send an application, we collect the following.

• About you: your name, your job title or role, your email address, and any phone number you choose to give us.
• About your company: its name, the country where it is registered, and its website.
• About the debtor: the name of the Saudi company, its Commercial Registration number if you know it, and the city it operates in.
• About the debt: the amount owed, the currency, the number of unpaid invoices, the date of the oldest unpaid invoice, and the date of any payment you have received.
• About the history: whether the debtor has admitted the debt in writing, whether it has entered bankruptcy or restructuring, and anything you tell us about what you have already tried.
• Your documents: contracts, purchase orders, invoices, delivery notes, correspondence, cheques, promissory notes, judgments, arbitration awards, and anything else you attach.
• Technical information: our hosting provider records standard server information such as IP address, browser type and the time of the request, for security and to keep the site running.

4. How we collect it

Almost all of it comes directly from you, through the application form or in correspondence afterwards. We do not buy personal data, and we do not collect it from social media.

We may also collect information about the debtor from public sources, such as the Saudi commercial register and court records. That is part of assessing whether a claim can be recovered.

5. Why we use it, and our lawful basis

We use your information for one purpose: to decide whether we can take your case, and to run the claim if we do. Concretely, that means assessing the debtor, preparing and sending a legal demand, filing and arguing the case in the Saudi courts, enforcing any judgment, and transferring the money we recover to you.

Where the UK or EU General Data Protection Regulation applies to you, our lawful bases are: the steps we take at your request before entering into a contract; our legitimate interests in assessing, running and enforcing legal claims and in running our practice; compliance with our legal and professional obligations; and, where relevant, the establishment, exercise or defence of legal claims.

Where you give us consent through the checkbox on the application form, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it, and it does not affect information we must keep for legal or professional reasons.

6. Sensitive information

We do not ask for sensitive information, and you should not send it unless it genuinely forms part of your claim. Sensitive information means things like health data, religious or political views, or details of criminal allegations.

Sometimes a commercial dispute does involve such material, for example where fraud is alleged. Where that happens we handle it under the additional protections the law requires, and we use it only for the establishment, exercise or defence of legal claims.

7. Where your information is stored and transferred

Your information is transferred to and stored in the Kingdom of Saudi Arabia, because that is where the case would be brought and where our lawyers work. Saudi Arabia is outside the United Kingdom and the European Economic Area, and it may not be the subject of an adequacy decision by the UK or the European Commission.

By sending an application you are asking us to assess a claim that can only be brought in Saudi Arabia, so this transfer is necessary for the steps you have asked us to take and for the exercise of legal claims. Where we rely on additional safeguards, such as standard contractual clauses with our service providers, we put them in place.

Some of our service providers store data in the United States and the European Union. Those are listed below.

8. Who we share it with

We do not sell your information, and we do not share it for marketing. We share it only where it is needed to do the work, or where the law requires it.

• The lawyers and staff of this firm who are working on your case.
• The Saudi courts, including the Commercial Courts, the Execution Court and the Administrative Courts, where a filing requires it.
• Certified translators, who translate your documents into Arabic for the court.
• Experts, such as accountants or quantity surveyors, where a claim needs them.
• Government and regulatory bodies where the law or our professional rules require disclosure.
• Our service providers, listed in the next section, who process data on our instructions.

9. Service providers we use

We use a small number of providers to run this website and to receive your application. They act on our instructions and are not permitted to use your information for their own purposes.

• Vercel Inc. hosts this website and processes standard server logs.
• Resend delivers the email that carries your application to us, including any documents you attach.
• Our email and document storage provider holds correspondence and case files.

10. How long we keep it

If we decline your application, we delete the documents you sent within twelve months, and sooner if you ask us to.

If we take your case, we keep the file for the period required by Saudi law and by our professional obligations after the matter closes. We keep it because we may need it to answer a later question about the case, to defend a claim, or to satisfy a regulator.

Server logs are kept for a short period for security purposes and then discarded.

11. How we protect it

This website is served over an encrypted connection. Your application is transmitted over an encrypted connection to our inbox. Access to case files is limited to the people who need it, and our staff are bound by professional duties of confidentiality.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant authority where the law requires it.

12. Your rights

Depending on where you are, you may have some or all of the following rights.

• Access: to ask for a copy of the personal data we hold about you.
• Rectification: to have inaccurate data corrected.
• Erasure: to ask us to delete data, where we have no continuing legal reason to keep it.
• Restriction: to ask us to stop using data while a question about it is resolved.
• Objection: to object to processing we carry out on the basis of legitimate interests.
• Portability: to receive certain data in a portable, machine readable form.
• Withdrawal of consent: where we rely on your consent, to withdraw it at any time.
• Complaint: to complain to your data protection authority.

13. If you are in the United Kingdom or the EEA

The rights above apply to you under the UK GDPR or the EU GDPR. You may complain to the Information Commissioner's Office in the United Kingdom, or to the supervisory authority in your own country, if you think we have handled your data wrongly. We would ask you to raise it with us first so that we can try to put it right.

14. If you are in Saudi Arabia

The Saudi Personal Data Protection Law applies to our handling of personal data. You have rights to be informed, to access your data, to request correction, and to request destruction where the law allows. Complaints may be made to the competent supervisory authority.

15. Cookies and analytics

This website does not use advertising cookies and does not track you across other sites. Our host sets only the cookies needed to serve and secure the site.

If we add analytics in future, we will update this policy first and, where consent is required, we will ask for it before anything is set.

16. Children

This website is for businesses and the people who run them. It is not directed at children and we do not knowingly collect data about them.

17. Automated decision making

We do not make decisions about your case by automated means. Every application is read and assessed by a lawyer.

18. Changes to this policy

We update this policy when our practices change. The date at the top shows when it was last changed. If a change materially affects how we use information you have already sent us, we will tell you.

19. How to contact us and make a request

To exercise any right in this policy, submit a request through the application form on this website and mark it clearly as a data protection request. Tell us what you want and give us enough detail to find your file.

We respond within the period the applicable law requires. We may need to confirm your identity before we act, so that we do not disclose information to the wrong person.