Privacy Policy

1. Who we are

OCS (Obligations and Compliance Systems) is the controller of the personal data described in this policy. OCS is the trading name of شركة أنظمة ضوابط الامتثال التقنية, Commercial Registration number 7053209438.

• Address: Abdullah Al Taei, Al Rakah Ash Shamaliyah, Al Khobar 34225, Kingdom of Saudi Arabia
• Contact, including for any privacy request or data subject right: info@ocs.sa

2. Personal data we collect

We only collect personal data that you enter yourself. There is no account registration on this website, and we do not buy contact data from third parties.

When you submit the contact form, we collect:

• Full name
• Work email address
• Company name
• Your role (optional)
• The regulatory framework you are primarily interested in (optional)
• The content of your message

When you join the waitlist, we collect:

• First name and last name
• Work email address
• Company name
• Phone number (optional)

We also process your IP address transiently when you submit a form, solely to apply rate limits and prevent abuse. It is not stored against your submission and is not used to build a profile of you.

3. Why we use it, and our lawful basis

• To reply to an enquiry you sent us — processing is necessary to take steps at your request before entering a contract.
• To manage the waitlist and contact you about trial access — processing is necessary to respond to the request you made when you joined.
• To protect the website from abuse and automated submissions — our legitimate interest in keeping the service available and secure.
• To comply with a legal or regulatory obligation where one applies to us.

We also send occasional marketing updates about OCS — but only to people who ticked the opt-in box on the contact or waitlist form. That consent is our lawful basis for those messages, we record the date you gave it, and submitting either form does not by itself add you to the marketing list. You can withdraw at any time by emailing info@ocs.sa, and withdrawing does not affect messages already sent.

4. Cookies and browser storage

This website does not use advertising cookies, analytics cookies, or cross-site tracking of any kind. The only items we store in your browser are:

• ocs-locale — a cookie remembering whether you chose English or Arabic.
• ocs_waitlist_dismissed — a local storage entry recording that you closed the waitlist banner, so it is not shown again.
• ocs_token — a sign-in cookie set only for OCS staff using the administration area. It is HTTP-only and expires after 24 hours. It is never set for ordinary visitors.

Because we set no advertising or analytics cookies, this website does not display a cookie consent banner. If that changes, we will introduce consent controls before any such cookie is set.

5. Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

• WafaiCloud, which hosts this website and its database within the Kingdom, acting on our instructions and bound by confidentiality.
• Professional advisers, such as legal or accounting advisers, where necessary.
• Competent authorities, where disclosure is required by law or regulation.

This website does not send email. What you submit is stored in our database and read by authorised OCS staff in our administration area, so no email provider processes your submission.

6. Where your data is stored

Personal data collected through this website is stored in the Kingdom of Saudi Arabia, on infrastructure provided by WafaiCloud. We do not transfer it outside the Kingdom.

If that ever changes, we will update this policy first, and any transfer will be made only on a basis permitted by the Personal Data Protection Law and only where an appropriate level of protection is maintained.

7. How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected for, and then delete it.

For enquiries sent through the contact form, and for waitlist entries, we retain your personal data for 24 months from the date you submitted it. Deletion is automatic: a scheduled routine removes expired records every day, so nothing lingers because somebody forgot. If you become a customer, your data moves under the retention terms of your customer agreement instead.

You can ask us to delete your data sooner at any time, using the contact details in section 9.

8. How we protect it

• Data is transmitted over encrypted connections.
• Access to submissions is restricted to authorised OCS personnel through an authenticated administration area.
• Form submissions are rate limited to reduce automated abuse.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that meets the notification threshold, we will notify the competent authority and affected individuals as the Law requires.

9. Your rights

Under the Personal Data Protection Law you have the right to:

• Be informed of the legal basis and purpose for collecting your personal data.
• Access your personal data held by us.
• Obtain a copy of your personal data in a readable, clear format.
• Request correction of personal data that is inaccurate, incomplete, or out of date.
• Request destruction of your personal data where it is no longer needed.
• Withdraw your consent, where our processing relies on consent.

To exercise any of these rights, email info@ocs.sa. We will respond within the period required by the Law. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the application of the Law.

10. Children

This website is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle personal data you have already given us, we will take reasonable steps to tell you directly.