Privacy Statement

1. Who we are

The controller of your personal data is Advanced Quantum Holding, a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 1009075772, with its headquarters at Building 6556, Al Kawakib, Additional No. 2989, Riyadh 13313, Saudi Arabia ("Advanced Quantum", "we", "us" or "our").

This statement applies to the website at www.advq.sa and its Arabic and English versions (the "Site"). It does not govern personal data processed under a signed engagement agreement with a client; that processing is governed by the terms of the engagement.

2. Personal data we collect

We collect only the data needed to operate the Site and respond to you. Depending on how you interact with the Site, this may include:

• Inquiry form: your full name, company or organisation, corporate email address, telephone number, and the language in which you submitted the form.
• Discovery-call booking: if you schedule a call through the embedded Google Calendar scheduler, Google collects the name, email address and any notes you enter, together with the chosen time slot, and shares the booking details with us.
• Consent cookie: a first-party cookie that records whether you have accepted or declined optional analytics (see section 8).
• Analytics: only if you grant consent, aggregated page-view and performance data via Vercel Analytics. This data is not used to build individual profiles.
• Server and security logs: our hosting provider generates standard server logs (IP address, request timestamps, requested URL, user-agent) for security, abuse prevention and troubleshooting.

3. Purposes and legal bases

We process personal data for the following purposes and on the following bases recognised by the PDPL:

• Responding to your inquiry and corresponding with you about your request. Basis: the processing is necessary to take steps at your request before entering into an agreement, and our legitimate interest in responding to business inquiries.
• Scheduling and holding a discovery call that you request. Basis: the processing is necessary at your request before any engagement, and our legitimate interest in managing appointments.
• Keeping the Site secure, preventing abuse (including rate limiting and spam detection), and diagnosing technical faults. Basis: our legitimate interest in the security and integrity of the Site, in a manner that does not prejudice your rights.
• Measuring how the Site is used so we can improve it. Basis: your consent, given through the cookie banner. You may withdraw consent at any time.
• Complying with legal obligations that apply to us in the Kingdom of Saudi Arabia, including record-keeping, tax and regulatory requirements, and responding to lawful requests from competent authorities. Basis: compliance with a legal obligation.

4. How we use your data, and what we do not do

We use inquiry and booking data solely to understand your request, respond to it and, where appropriate, prepare a proposal. We do not sell, rent or trade personal data. We do not use it for automated decision-making that produces legal or similarly significant effects, and we do not send marketing communications unless you have separately asked us to.

Submitting an inquiry or booking a call does not create a client relationship. Any advisory engagement is established only under a signed agreement, as described in our Terms of Use.

5. Service providers and disclosure

We rely on a small number of service providers who process personal data on our behalf and under our instructions, each bound by contractual obligations of confidentiality and security:

• Vercel Inc. — hosting, content delivery, server logs and (with your consent) privacy-focused analytics.
• Google LLC — Google Calendar appointment scheduling, used to book discovery calls.
• Resend, Inc. — transactional email delivery for inquiry notifications and confirmations.

6. Transfers outside the Kingdom

The providers listed above operate infrastructure outside the Kingdom of Saudi Arabia, so personal data you submit through the Site may be stored or processed abroad. We transfer data only where the PDPL and the Regulations on Personal Data Transfer outside the Kingdom permit it, limit each transfer to the minimum data necessary for the stated purpose, and require our providers to apply safeguards at least equivalent to those required under the PDPL. You may ask us for further information about the safeguards applied to a specific transfer using the contact details below.

We may also disclose personal data where required by law, by order of a competent court or authority, or where disclosure is necessary to protect our rights or the safety of any person.

7. Retention

We keep personal data only for as long as it is needed for the purposes described above, after which it is deleted or irreversibly anonymised:

• Inquiry form submissions: 24 months from the date of submission, unless the inquiry leads to an engagement, in which case the record is kept with the engagement file.
• Discovery-call booking records: 24 months from the scheduled date of the call. Google retains its own copy under its privacy policy.
• Consent cookie: 6 months from the date you make your choice, after which the banner is shown again.
• Server and security logs: retained by our hosting provider for a limited period in accordance with its standard log retention.
• Where a statutory retention period, a legal claim or a regulatory request requires longer retention, we keep the data for that period only.

8. Cookies and similar technologies

The Site uses a deliberately minimal set of cookies. We do not use advertising or cross-site tracking cookies.

• aq_consent (first-party, strictly functional): stores your choice in the consent banner ("granted" or "denied"). Lifetime: 6 months.
• Vercel Analytics (optional, consent-based): loaded only if you grant consent. It collects aggregated page views and web-performance measurements and does not use cross-site identifiers.
• Google Calendar (third-party): the scheduler is loaded only when you open the booking window. Google may set its own cookies, which are governed by Google Calendar's privacy policy.

9. Your rights under the PDPL

Subject to the conditions and exceptions set out in the PDPL and its Implementing Regulations, you have the right to:

• Be informed about how your personal data is collected and processed, which this statement is intended to provide.
• Access the personal data we hold about you and obtain a copy of it in a readable format.
• Request correction, completion or updating of inaccurate or incomplete data.
• Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other lawful basis applies.
• Withdraw consent to analytics at any time by changing your choice through the consent banner or clearing the consent cookie; withdrawal does not affect the lawfulness of processing carried out before it.
• Object to processing based on our legitimate interests, in which case we will cease the processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Lodge a complaint with the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA), if you believe your rights have been infringed, without prejudice to your right to seek a remedy before the competent courts.

10. Exercising your rights

To exercise any of these rights, contact us at contact@advq.sa or by post at the address in section 1. We may ask for information needed to verify your identity before acting on a request. We will respond without undue delay and in any case within the period required by the PDPL. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline the request, as the law permits.

11. Children

The Site is intended for businesses and professionals. It is not directed at individuals under the age of eighteen, and we do not knowingly collect personal data from them. If you believe a minor has provided personal data to us, please contact us and we will delete it.

12. Security

We apply technical and organisational measures that are proportionate to the nature of the data we hold, including encryption in transit (TLS), restricted and role-based access to inquiry records, server-side validation and rate limiting of form submissions, and the use of reputable providers that operate audited security programmes. No transmission over the internet is completely secure, and we cannot guarantee absolute security, but we will notify affected individuals and the competent authority of any personal data breach as required by the PDPL.

13. Changes to this statement

We may update this statement from time to time to reflect changes in our practices, the Site or applicable law. The date of the latest revision appears at the top of this page. Where a change materially affects how we process your data, we will take reasonable steps to bring it to your attention. Continued use of the Site after a revision is published constitutes acknowledgement of the revised statement.

14. Contact

Questions, requests or concerns about this statement or our handling of personal data may be addressed to Advanced Quantum Holding at contact@advq.sa, or in writing to Building 6556, Al Kawakib, Additional No. 2989, Riyadh 13313, Saudi Arabia.