PDPL Notice

1. Controller

OCS (Obligations and Compliance Systems) determines the purposes and means of processing the personal data described here, and is therefore the controller of that data. OCS is the trading name of شركة أنظمة ضوابط الامتثال التقنية, Commercial Registration number 7053209438. Address: Abdullah Al Taei, Al Rakah Ash Shamaliyah, Al Khobar 34225, Kingdom of Saudi Arabia. Contact: info@ocs.sa.

Where OCS processes personal data inside the OCS platform on behalf of a customer, the customer is the controller and OCS acts as a processor on their documented instructions. That relationship is governed by the agreement between us, not by this notice.

2. Personal data and purposes

Through this website we collect only the data you submit in the contact form (name, work email, company, role, framework of interest, message) or the waitlist form (first and last name, work email, company, phone). We use it to reply to you, to manage waitlist and trial access, to keep the site secure, and to meet legal obligations. We do not use it for automated decision-making that produces legal effects, and we do not profile you.

3. Legal basis

We process this data because it is necessary to take steps at your request before entering into a contract, because we have a legitimate interest in securing our website, or because a legal obligation applies. Marketing messages rest on a separate and explicit basis: your consent, given by ticking the opt-in box on the form. You may withdraw that consent at any time, by emailing info@ocs.sa, without affecting processing carried out before withdrawal.

4. Your rights under the Law

The Law gives you the following rights over your personal data:

• The right to be informed — to know why your data is collected and on what legal basis.
• The right of access — to obtain confirmation and access to your personal data.
• The right to obtain a copy — in a readable and clear format.
• The right to request correction — of data that is inaccurate, incomplete, or outdated.
• The right to request destruction — where the data is no longer needed for the purpose collected.
• The right to withdraw consent — where processing relies on consent.

Send any request to info@ocs.sa. We may ask you to verify your identity before we act, so that we do not disclose personal data to the wrong person. We do not charge a fee for exercising these rights.

5. Transfers outside the Kingdom

All personal data collected through this website remains within the Kingdom of Saudi Arabia. It is stored on infrastructure provided by WafaiCloud, a Saudi cloud provider, and is not transferred, stored, or accessed outside the Kingdom.

Should that position change, we will update this notice before any transfer takes place and will rely only on a transfer basis permitted by the Law and its Implementing Regulations.

6. Retention and destruction

We retain personal data only for as long as the purpose requires, and destroy it when that purpose ends, unless the Law requires us to keep it longer. For website enquiries and waitlist entries this period is 24 months from the date of submission, enforced by a scheduled deletion routine that runs daily rather than by manual review.

7. Security and breach notification

We apply organisational and technical measures appropriate to the risk, including encrypted transmission, authenticated and restricted access to submissions, and rate limiting on public forms. In the event of a personal data breach that poses a risk to personal data or to the individuals concerned, we will notify the competent authority and, where required, affected individuals within the timeframes set by the Law.

8. Complaints

If you believe we have handled your personal data in a way that does not comply with the Law, please contact us first at info@ocs.sa so we can try to resolve it. You also have the right to lodge a complaint directly with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent supervisory authority.