Privacy Policy

This policy explains how Hawjan (“HAWJAN”, “we”, “us”) collects personal data through the website hawjan.com, how we use and protect it, and what rights you have over it.

The controller responsible for processing your data is Hawjan, commercial registration no. 7055390236, located at Riyadh, Kingdom of Saudi Arabia. You can reach us about any privacy matter at info@hawjan.com.

We comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, in force since 14 September 2023, together with its Implementing Regulations, under the supervision of the Saudi Data and Artificial Intelligence Authority (SDAIA). If you browse from the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) gives you additional rights that we describe in a separate chapter.

Reading this policy does not create a contract between us; it is a transparent statement of what the website actually does with your data.

This policy covers the data collected by hawjan.com through its public pages in Arabic and English, including the contact form, the newsletter signup, the blog, and the technical records needed to run and protect the site.

It does not cover data we exchange with clients under creative-services engagements; those are governed by the contract and confidentiality terms signed with each client. It also does not cover external websites we may link to, each of which has its own privacy policy.

The site's administration dashboard is reserved for the HAWJAN team. Data related to it (staff accounts, sessions and audit history) is mentioned here for transparency in the cookie and security chapters, and does not concern visitors.

The site serves a general audience inside and outside Saudi Arabia. We read this policy first in the light of Saudi law, and apply other laws where they apply to a particular visitor.

We collect data in four situations only. For each one, here is exactly what the site records:

• Contact form: your name, your email address, your company name (optional), the topic you pick from the list, your message (10 to 2,000 characters), the language of the page you sent it from, the time of sending, and a keyed hash of your IP address (see below).
• Newsletter: your email address, your name if you add it, your language, the signup source (footer, newsletter page or end of an article), and your consent record: its time, the wording you agreed to (stored as a digital fingerprint of the text) and a keyed hash of your IP address; later the time you confirmed, and if you unsubscribe, when and the reason if you chose to give one.
• Technical records: to protect the forms from automated abuse, the site keeps short-lived counters tied to a fingerprint of your IP address, not the address itself. The fingerprint is computed with HMAC-SHA256 and a secret key unique to the site, and cannot be reversed to recover your address.
• Cookies: functional cookies only (language, light or dark appearance, and not replaying the intro animation), and no outside provider sets its own unless you press play on an embedded YouTube or Vimeo video. Full details are in the Cookie Policy.

The site uses no analytics or advertising trackers, does not collect your location, and does not build behavioural profiles. We never ask for payment card details or national identity numbers through the website.

If you only browse without using a form, the application records no personal data about you beyond the functional cookies kept by your browser. Standard server access logs are managed by our hosting provider under its own configuration and policy.

We process your data for the following purposes, each with a specific legal basis under the PDPL and, where it applies, under Article 6 of the GDPR:

• Answering your contact-form message and discussing a possible engagement: your implied consent in sending the message and our legitimate interest in replying to people who write to us (GDPR Art. 6(1)(b) and (f)).
• Sending the newsletter: your explicit consent, given by ticking the consent box and then confirming from your inbox (Art. 6(1)(a)); you can withdraw it at any time.
• Protecting the site from abuse and automated submissions, and limiting repeated attempts: our legitimate interest in the security and continuity of the service (Art. 6(1)(f)).
• Keeping consent and compliance records: our legal obligation to be able to prove consent and respond to competent authorities (Art. 6(1)(c)).
• Remembering your language and appearance preference: functional cookies that need no separate consent because they are necessary to deliver the site the way you asked for it.

We do not process your data for any purpose incompatible with the one it was collected for, and we make no automated decisions that produce legal effects on you. If we ever need a new kind of processing, we will ask for your consent first or update this policy before starting.

Contact-form messages are stored in the site's database and appear to the HAWJAN team in the inbox of the dashboard, where the team reads them and replies from its own mailbox. When the notification channel is enabled, a copy of the message is emailed to the team through our email provider, and it may also be posted to a webhook address that HAWJAN configures to connect the inbox with its internal tools.

If email sending is enabled, you receive a short automatic acknowledgement confirming that your message arrived. It never repeats your message and is sent at most once per address every 24 hours.

Our team may translate your message inside the dashboard into Arabic or English to understand it properly. The translation is stored with the message and deleted together with it.

For the newsletter, we use your email address and name to send the confirmation email and then the newsletters you agreed to receive. Every email carries a one-click unsubscribe link. We use our email provider's notifications about permanent bounces and spam complaints to stop sending to your address automatically.

We use the counters tied to the IP fingerprint to block more than 5 contact messages in 10 minutes or 20 in an hour from the same source, with similar limits on newsletter signups. These counters expire automatically at the end of their time window.

We do not sell, rent or share your data with anyone for their own marketing. We share it only with service providers who process it on our behalf and on our instructions:

• Our hosting provider, which runs the site's server and database and keeps standard access logs under its own configuration.
• Resend (transactional email provider): sends team notifications, the automatic acknowledgement and newsletter emails, and therefore receives your address, the team's address and the content needed to send each message. It reports bounces and complaints back to us through digitally signed notifications.
• Google Translate: when a team member chooses to translate your message inside the dashboard, the text of the message is sent to Google's translation service. Your name and email address are not sent with it.
• AI model providers: in the dashboard, HAWJAN uses AI tools (such as Anthropic, OpenAI, Google Gemini, DeepSeek, or compatible services HAWJAN configures) to help the team draft blog content and images. Visitor data is sent to these tools in one case only: when Google Translate is unavailable and the fallback is enabled, the text of your message alone may be sent to the active AI provider for translation.
• The webhook destination HAWJAN may configure to receive a copy of contact messages in an internal tool; that copy contains the name, company, email, topic and message text.

The embedded YouTube or Vimeo video player that some pages may show is different: it loads only after you press play yourself, and is served from the privacy-enhanced domains (youtube-nocookie.com, and player.vimeo.com with the do-not-track option dnt=1). Your browser then connects directly to the provider, which receives your IP address and browser details and may set cookies of its own under its own policy. We send it no data from the site's forms. Videos uploaded to the site are served from the site itself.

We may also disclose your data where a law, court order or request from a competent authority requires it, limited to what is strictly necessary, or to protect our rights and the safety of our users.

The site stores your data in its database on our hosting provider's server. Some of the providers listed above, such as the email provider and the translation and AI services, operate outside the Kingdom of Saudi Arabia, which means part of your data may be transferred to and processed in other countries.

We make sure only the minimum needed for the service is transferred: your address and message content for email, and the message text alone for translation. We never send IP fingerprints or consent records to any external provider.

Transfers follow the provisions of the PDPL and its Implementing Regulations on transferring data outside the Kingdom, and we work with providers that commit contractually to data protection and security. For visitors in the EU and the UK, data is transferred on the basis of the appropriate safeguards set out in the GDPR, such as the standard contractual clauses adopted by these providers.

If you would like to know more about a specific provider or the transfer safeguards in place, write to info@hawjan.com.

We keep data only as long as there is a legitimate reason to. This is what the site actually does:

• Contact-form messages: kept in the inbox until the HAWJAN team deletes them manually or you ask us to delete them. We normally keep them while the conversation or business relationship is active.
• Machine translations of messages: deleted automatically when the original message is deleted.
• Email sending log (recipient, template, subject and outcome, never the body): deleted automatically after 90 days.
• Newsletter data: for as long as you are subscribed. When you unsubscribe, your address is kept with the status “unsubscribed” and the time, so that we never email you again by mistake; you can ask for permanent deletion. The consent record is kept with the subscription as proof.
• Confirmation links: valid for seven days, then void.
• Abuse-protection counters tied to the IP fingerprint: expire at the end of their window (10 minutes to 24 hours) and are purged periodically.
• Email-provider notification records (event identifiers only): 30 days.
• Cookies: for the durations listed in the Cookie Policy.

Once the purpose has ended we delete or anonymise the data, unless the law requires us to keep it longer.

We apply appropriate technical and organisational measures to protect your data from unauthorised access, loss or alteration, including:

• HTTPS-only transport and a strict Content Security Policy that limits where the site may load code from.
• No raw visitor IP addresses are stored; only a keyed, irreversible fingerprint.
• API keys for external services (email, AI) are stored encrypted in the database and never leave the server.
• Staff passwords are stored as strong hashes and never in clear text. Dashboard sessions rely on a secure cookie (HttpOnly and Secure) holding a random token of which the server keeps only a hash; sessions end after 7 days of inactivity and after 30 days at most.
• Role-based permissions inside the dashboard and an audit log of every edit or deletion.
• Rate limits per source, honeypot fields for bots and a minimum fill-time check on forms.
• Every outbound request to an external address passes through a guard that blocks access to internal networks.

No system is completely secure, which is why we also follow the incident procedure described in the “Breach notification” chapter.

The Personal Data Protection Law gives you the following rights, and we are committed to making them available to you:

• The right to be informed: to know the legal basis and purpose of collecting your data, and that it will not later be processed in a way incompatible with that purpose. This policy is our main way of doing that.
• The right of access: to see the personal data we hold about you.
• The right to obtain a copy: to receive your data in a clear, readable format.
• The right to correction, completion and updating: to ask us to correct inaccurate data, complete incomplete data or update it.
• The right to destruction: to ask us to destroy your data when the purpose of collecting it has ended, subject to anything the law obliges us to keep.

You may also withdraw your newsletter consent at any time without affecting the lawfulness of earlier processing, and you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority if you believe we have not handled your request properly.

We answer requests free of charge unless they are unreasonably repetitive, and we may ask you to prove your identity before acting, to protect your data from unauthorised access.

If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR and the UK GDPR also apply to you and give you the following rights in addition to those above:

• The right of access (Article 15), rectification (Article 16) and erasure (Article 17).
• The right to restriction of processing (Article 18) while you contest the accuracy or lawfulness of processing.
• The right to data portability (Article 20): to receive the data you gave us in a structured, commonly used, machine-readable format.
• The right to object (Article 21) to processing based on legitimate interest, and an absolute right to object to any processing for direct marketing.
• The right to withdraw consent at any time (Article 7).
• The right not to be subject to a purely automated decision producing legal effects (Article 22); we make no such decisions.
• The right to lodge a complaint with the supervisory authority of your country of residence.

As we have no establishment in the EU, we may not be required to appoint a representative there; we nonetheless receive your requests directly at info@hawjan.com and handle them with the same care.

Send your request to info@hawjan.com, stating which right you want to exercise and the email address you used on the site, so that we can find your data.

We normally reply within 30 days of receiving the request. If the request is complex or you make several, we may extend this by up to 30 more days and will tell you, with the reason. If we cannot fulfil a request in whole or in part, we will explain the legal reason.

You do not need to send a request to unsubscribe from the newsletter: use the unsubscribe link at the bottom of any email, or the unsubscribe page on the site, and it takes effect immediately.

We do not ask you to email identity documents unless strictly necessary; we usually only check that the request comes from the same email address we have on record.

The site is aimed at businesses and professionals. We do not target children under 18 with any content or service, and we do not knowingly collect data from them.

If we learn that a child has sent us personal data through the site without a parent's or guardian's consent, we will delete it as soon as possible. If you are a parent or guardian and believe this has happened, write to info@hawjan.com.

We send marketing emails only to people who subscribed to the newsletter voluntarily and confirmed their subscription. Signing up takes two steps: you tick the consent box and submit your address, then open the confirmation email and press the confirm button. No newsletter is sent before confirmation, and the confirmation link expires after seven days.

We keep a record of your consent: its time, the wording you agreed to (as a digital fingerprint that proves which version of the text it was) and a fingerprint of your IP address at that moment. This record is our evidence that sending is lawful.

You can unsubscribe at any time from the link at the bottom of every email, and our emails support one-click unsubscribe from within your mail app. When you unsubscribe we stop immediately, and we only reactivate your subscription if you sign up and confirm again.

If your address bounces permanently or you report our email as unwanted to your mail provider, we stop sending to you automatically. We never send to disposable email addresses and we never buy mailing lists.

If an incident leads to your personal data being leaked, destroyed or accessed without authorisation, we will:

• Contain the incident and assess its impact and the data affected as soon as it is discovered.
• Notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of the incident, as required by the PDPL and its Implementing Regulations.
• Notify you without undue delay if the incident may harm your data or affect your rights, explaining what happened, what we did and what we recommend you do.
• For EU and UK visitors, follow Articles 33 and 34 of the GDPR regarding notification of the supervisory authority and of the people affected.

We keep an internal record of incidents and the action taken, and we review our security measures after each one.

We may update this policy when the site's services, our providers or the applicable laws change. The date of the last update appears at the top of the page, and the updated version applies from the date it is published.

If a change is material and affects how we use data we collected earlier, we will email newsletter subscribers before it takes effect and ask for fresh consent where the law requires it.

We encourage you to review this page from time to time. Continuing to use the site after an update is published means you have seen the new version.

This policy and everything related to the processing of your data through the site are governed by the laws of the Kingdom of Saudi Arabia, above all the Personal Data Protection Law and its Implementing Regulations, and the Anti-Cyber Crime Law as regards attacks on systems and data.

The courts of Riyadh have jurisdiction over any dispute arising from or related to this policy, without prejudice to your right to complain to the data-protection authority of your country of residence where the law gives you that right.

For any question or request about privacy or your personal data, contact Hawjan by email at info@hawjan.com or by post at Riyadh, Kingdom of Saudi Arabia.

Please put “Personal data request” in the subject line so that we can route it to the right person quickly. We also welcome any feedback that helps us make this policy clearer.