Privacy Notice

Last updated: June 17, 2026

At 8toZ, the privacy of your data is a non-negotiable responsibility. This Privacy Notice has been drafted in accordance with the Personal Data Protection Law (PDPL) in force in the Kingdom of Saudi Arabia and its Implementing Regulations. It explains exactly what data we collect, why we collect it, how we protect it, and the rights the Law grants you.

This notice applies to all our technical services — from server and switch infrastructure to monitoring systems and tailored applications — and is binding on all 8toZ employees, contractors, and partners, both inside and outside the Kingdom.

1. Why We Collect Your Data

We collect and process your personal data on one or more of the following legal bases:

• Contract performance: to deliver the technical and consulting services agreed with you.
• Legitimate interest: to strengthen the security of our networks, prevent fraud, and improve our products.
• Explicit consent: for direct marketing and notifications about new offers and services.
• Legal obligation: to comply with Saudi laws and the requirements of supervisory authorities.

Processing purposes include, but are not limited to:

• Designing, deploying, and supporting digital infrastructure and network solutions.
• Operating our internal systems, issuing invoices, and processing payments.
• Understanding your technical needs and recommending the most suitable solutions.
• Notifying you of security updates and newly available services.
• Responding to inquiries and resolving complaints efficiently.

2. Types of Data We Collect

The data we may collect falls into the following categories:

a. Identification and Contact Data

• Full name, job title, and company name.
• Email, phone number, and mailing address.
• Commercial registration and VAT number for legal entities.

b. Technical Data

• IP address, browser type, operating system, and session identifiers.
• Cookies and similar tracking technologies.

c. Usage and Interaction Data

• Technical support requests, service tickets, and feedback.
• Transaction, subscription, and billing history.
• Conversations with our team through official channels.

3. How We Collect Your Data

• Registration and contracting: when you create an account or sign a service contract with us.
• Direct forms: when you complete a service or quote request form on our website.
• Support channels: when you email or call our customer service.
• Browsing: automatically via cookies when you visit our site.
• Public sources: from commercial registries and publicly available information.

4. Cookies

The 8toZ website uses cookies to:

• Maintain your login session and language preference.
• Measure site performance and visitor behavior to improve the experience.
• Personalize the content shown to you based on your interests.

You may disable cookies in your browser settings; some features may be affected as a result.

5. Data Retention

We retain your data for the minimum period necessary to fulfill the purpose of collection, or for the duration mandated by Saudi laws — whichever is longer. After this period, data is destroyed via certified mechanisms that guarantee it cannot be recovered.

6. Visitor Analytics

We use a lightweight in-house analytics system to understand how the site is used and to improve it. It does not rely on any third-party service (no Google Analytics or similar), and all data is stored on our own servers.

What is recorded on each visit:

• The relative path of the page you visited (e.g. /page.php?slug=...).
• The page title, the time you spent on each page, and the furthest scroll percentage you reached.
• Device type (desktop / mobile / tablet), browser family (e.g. Chrome, Safari), and operating system (e.g. Windows, Android).
• Browser language preference (Arabic / English).
• The type of source that referred you (direct, search engine, social network, referral) and only its domain (e.g. google.com) — never the full URL or any search parameters.
• Generic interaction events: contact-form submissions and outbound link clicks. We do not log the content of fields you type.

What is NOT recorded:

• Your IP address is never stored. It is used once in memory to generate an anonymous fingerprint (sha256 with a daily-rotated key that changes every 24 hours), then immediately discarded. This makes cross-day tracking technically impossible.
• We do not collect device fingerprints (canvas, fonts, WebGL, audio context) or any advanced fingerprinting techniques.
• We do not share data with any third party.

How to opt out:

• Enable "Do Not Track" in your browser — we honor this setting and do not record your visit in that case, with no extra configuration needed.
• Use a tracker-blocking extension (such as uBlock Origin) — our site works fully even with analytics disabled.

Analytics data is automatically deleted 90 days after it is collected.

7. Data Security

We apply a set of technical safeguards to protect your data while you use the website, most notably:

• Encrypted communication (HTTPS): all data exchanged between your browser and the website travels over an encrypted channel.
• Password hashing: account passwords are stored as bcrypt hashes — never as plaintext.
• CSRF protection: every form submission is protected by anti-CSRF tokens that prevent unauthorized requests on your behalf.
• Secure sessions: session cookies are configured with HttpOnly and SameSite flags to reduce session hijacking risk.
• Login rate-limiting: failed login attempts are recorded, and repeated attempts from the same source are temporarily blocked to mitigate brute-force attacks.
• Input sanitization: any HTML content is sanitized before storage to prevent XSS and injection attacks.
• Backups: regular database backups are taken and can be restored when needed.
• Restricted access: access to the administration panel is limited to authorized administrator accounts only.

8. Sharing and Disclosure

8toZ does not sell, rent, or trade your data with any third party for commercial purposes. We may share specific data only in the following cases:

• With operating partners and cloud providers under strict data processing agreements.
• Upon official request from a competent judicial or regulatory authority in the Kingdom.
• To protect against documented fraud or security threats.
• With your explicit prior consent.

Your data is not transferred outside the Kingdom of Saudi Arabia except in cases permitted by the Personal Data Protection Law, and only under safeguards at least equivalent to the local level of protection.

9. Your Rights Under the Law

The Personal Data Protection Law grants you the following rights, which you may exercise free of charge by contacting us:

• Right to be informed: to know the legal basis and purpose of processing your data.
• Right of access: to request a copy of the data we hold about you.
• Right to rectification: to update or correct any inaccurate data.
• Right to withdraw consent: to cancel consent to specific processing at any time.
• Right to erasure: to request deletion of your data when the purpose of processing no longer applies.
• Right to restrict processing: to limit processing in specific cases as defined by the Law.

10. Updates to This Notice

We may periodically update this Privacy Notice to keep up with regulatory and technological developments. The date of the last update is shown at the top of this page. We recommend reviewing it periodically and will notify you of any material changes by email or a prominent notice on the website.

11. Contact and Inquiries

For any inquiry about this notice or to exercise your rights, you may contact the Data Protection Officer (DPO) at 8toZ via:

• Email: privacy@8toz.com
• Phone: +966 50 000 0000
• Address: Riyadh, Kingdom of Saudi Arabia

The competent supervisory authorities are the Saudi Data and AI Authority (SDAIA), represented by the National Data Management Office (NDMO), in addition to the Communications, Space and Technology Commission (CST) for matters related to the ICT sector.