This policy explains what personal data OCS collects through this website, why we collect it, and the rights you hold over it under the Saudi Personal Data Protection Law. It covers this website only — personal data processed inside the OCS platform on behalf of a customer is governed by that customer's agreement with us, where OCS acts on their instructions.
01Who we are
OCS (Obligations and Compliance Systems) is the controller of the personal data described in this policy. OCS is the trading name of شركة أنظمة ضوابط الامتثال التقنية, Commercial Registration number 7053209438.
- Address: Abdullah Al Taei, Al Rakah Ash Shamaliyah, Al Khobar 34225, Kingdom of Saudi Arabia
- Contact, including for any privacy request or data subject right: info@ocs.sa
02Personal data we collect
We only collect personal data that you enter yourself. There is no account registration on this website, and we do not buy contact data from third parties.
When you submit the contact form, we collect:
- Full name
- Work email address
- Company name
- Your role (optional)
- The regulatory framework you are primarily interested in (optional)
- The content of your message
When you join the waitlist, we collect:
- First name and last name
- Work email address
- Company name
- Phone number (optional)
When you request a demo, we collect:
- Full name
- Work email address
- Company name
- Company type (optional)
- The regulators you answer to (optional)
We also process your IP address transiently when you submit a form, solely to apply rate limits and prevent abuse. It is not stored against your submission and is not used to build a profile of you.
03Why we use it, and our lawful basis
- To reply to an enquiry you sent us — processing is necessary to take steps at your request before entering a contract.
- To arrange the demo you requested — processing is necessary to take steps at your request before entering a contract.
- To manage the waitlist and contact you about trial access — processing is necessary to respond to the request you made when you joined.
- To protect the website from abuse and automated submissions — our legitimate interest in keeping the service available and secure.
- To comply with a legal or regulatory obligation where one applies to us.
We also send occasional marketing updates about OCS — but only to people who ticked the opt-in box on the contact or waitlist form. That consent is our lawful basis for those messages, we record the date you gave it, and submitting either form does not by itself add you to the marketing list. You can withdraw at any time by emailing info@ocs.sa, and withdrawing does not affect messages already sent.
04Cookies and browser storage
This website does not use advertising cookies, analytics cookies, or cross-site tracking of any kind. The only items we store in your browser are:
- ocs-locale — a cookie remembering whether you chose English or Arabic.
- ocs_waitlist_dismissed — a local storage entry recording that you closed the waitlist banner, so it is not shown again.
- ocs-motion — a local storage entry remembering the animation level you chose at the bottom of the page (Auto, Full, Light or Off). On Auto, ocs-motion-auto records whether this device ran the full animations smoothly, so a slower device is not slowed down again; it is checked again after a week.
- ocs_token — a sign-in cookie set only for OCS staff using the administration area. It is HTTP-only and expires after 24 hours. It is never set for ordinary visitors.
Because we set no advertising or analytics cookies, this website does not display a cookie consent banner. If that changes, we will introduce consent controls before any such cookie is set.
05Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
- Hostinger International Ltd., which hosts this website and its database on servers in France, acting on our instructions and bound by confidentiality.
- Professional advisers, such as legal or accounting advisers, where necessary.
- Competent authorities, where disclosure is required by law or regulation.
This website never emails you. What you submit is stored in our database and read by authorised OCS staff in our administration area. When a submission arrives, the website can send our staff a short notice through our Google Workspace account; the notice says only that something arrived and links to it, so no email provider receives your details.
06Where your data is stored
This website and the OCS platform are hosted separately. The OCS platform, the application our customers use, is hosted in the Kingdom of Saudi Arabia. This website is hosted by Hostinger International Ltd. on servers in France, and what you submit through its contact, waitlist and demo forms is stored there.
Storing your submission there is a transfer of personal data outside the Kingdom under the Personal Data Protection Law. We limit it to what you enter in these forms, make it only on a basis permitted by the Law and its Regulation on Personal Data Transfer outside the Kingdom, and keep appropriate safeguards in place: Hostinger processes the data only on our instructions and is bound to keep it confidential and secure.
If we change where this website or its data is hosted, we will update this policy before the change takes effect.
07How long we keep it
We keep personal data only for as long as it is needed for the purpose it was collected for, and then delete it.
For enquiries sent through the contact form, and for waitlist entries, we retain your personal data for 24 months from the date you submitted it. Deletion is automatic: a scheduled routine removes expired records every day, so nothing lingers because somebody forgot. If you become a customer, your data moves under the retention terms of your customer agreement instead.
Demo requests are kept for the same 24 months and deleted the same way.
You can ask us to delete your data sooner at any time, using the contact details in section 9.
08How we protect it
- Data is transmitted over encrypted connections.
- Access to submissions is restricted to authorised OCS personnel through an authenticated administration area.
- Form submissions are rate limited to reduce automated abuse.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that meets the notification threshold, we will notify the competent authority and affected individuals as the Law requires.
09Your rights
Under the Personal Data Protection Law you have the right to:
- Be informed of the legal basis and purpose for collecting your personal data.
- Access your personal data held by us.
- Obtain a copy of your personal data in a readable, clear format.
- Request correction of personal data that is inaccurate, incomplete, or out of date.
- Request destruction of your personal data where it is no longer needed.
- Withdraw your consent, where our processing relies on consent.
To exercise any of these rights, email info@ocs.sa. We will respond within the period required by the Law. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the application of the Law.
10Children
This website is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
11Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle personal data you have already given us, we will take reasonable steps to tell you directly.