This notice sets out how OCS applies the Saudi Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations to personal data collected through this website. It sits alongside our Privacy Policy, which describes the same processing in fuller detail.
01Controller
OCS (Obligations and Compliance Systems) determines the purposes and means of processing the personal data described here, and is therefore the controller of that data. OCS is the trading name of شركة أنظمة ضوابط الامتثال التقنية, Commercial Registration number 7053209438. Address: Abdullah Al Taei, Al Rakah Ash Shamaliyah, Al Khobar 34225, Kingdom of Saudi Arabia. Contact: info@ocs.sa.
Where OCS processes personal data inside the OCS platform on behalf of a customer, the customer is the controller and OCS acts as a processor on their documented instructions. That relationship is governed by the agreement between us, not by this notice.
02Personal data and purposes
Through this website we collect only the data you submit in the contact form (name, work email, company, role, framework of interest, message), the demo request form (name, work email, company, company type, regulators) or the waitlist form (first and last name, work email, company, phone). We use it to reply to you, to arrange demos, to manage waitlist and trial access, to keep the site secure, and to meet legal obligations. We do not use it for automated decision-making that produces legal effects, and we do not profile you.
03Legal basis
We process this data because it is necessary to take steps at your request before entering into a contract, because we have a legitimate interest in securing our website, or because a legal obligation applies. Marketing messages rest on a separate and explicit basis: your consent, given by ticking the opt-in box on the form. You may withdraw that consent at any time, by emailing info@ocs.sa, without affecting processing carried out before withdrawal.
04Your rights under the Law
The Law gives you the following rights over your personal data:
- The right to be informed — to know why your data is collected and on what legal basis.
- The right of access — to obtain confirmation and access to your personal data.
- The right to obtain a copy — in a readable and clear format.
- The right to request correction — of data that is inaccurate, incomplete, or outdated.
- The right to request destruction — where the data is no longer needed for the purpose collected.
- The right to withdraw consent — where processing relies on consent.
Send any request to info@ocs.sa. We may ask you to verify your identity before we act, so that we do not disclose personal data to the wrong person. We do not charge a fee for exercising these rights.
05Transfers outside the Kingdom
Personal data submitted through this website's contact, waitlist and demo forms is stored on servers operated by Hostinger International Ltd. in France, and is therefore transferred outside the Kingdom. The transfer is limited to what you enter in those forms, and we make it only on a basis permitted by the Law and its Regulation on Personal Data Transfer outside the Kingdom, with appropriate safeguards in place.
The OCS platform, the application our customers use, is a separate system hosted in the Kingdom of Saudi Arabia. This transfer does not involve it.
If we change where this data is stored, we will update this notice before the change takes effect.
06Retention and destruction
We retain personal data only for as long as the purpose requires, and destroy it when that purpose ends, unless the Law requires us to keep it longer. For website enquiries and waitlist entries this period is 24 months from the date of submission, enforced by a scheduled deletion routine that runs daily rather than by manual review.
07Security and breach notification
We apply organisational and technical measures appropriate to the risk, including encrypted transmission, authenticated and restricted access to submissions, and rate limiting on public forms. In the event of a personal data breach that poses a risk to personal data or to the individuals concerned, we will notify the competent authority and, where required, affected individuals within the timeframes set by the Law.
08Complaints
If you believe we have handled your personal data in a way that does not comply with the Law, please contact us first at info@ocs.sa so we can try to resolve it. You also have the right to lodge a complaint directly with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent supervisory authority.