Privacy policy

01Who we are

Prime Shield Company (limited liability company, unified national number 7052877623), Building 7477, Prince Salman Ibn Muhammad Ibn Saud St., Al Sahafah, Riyadh 13321. We are the controller of the personal data we receive through this website.

We comply with the Kingdom of Saudi Arabia’s Personal Data Protection Law and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA).

02The data we collect

Requests for quotation

When you send the request we receive: your company, the contact person and job title, mobile number, email (optional), the project name and city, the owner, consultant and main contractor if you name them, the project stage, the services and applications you need, the approximate area, the preferred system, the type of supply, the expected start date, your notes, the files you attach (bills of quantities, drawings, specifications, photos and videos) and your consent. We also record technical data with it: IP address, browser type, the time taken to fill in the form, the result of the automated file check, the page where the request started and the campaign tag, if any.

Technical consultation requests

Your name, company, mobile number, email (optional), the project and its city, the description of the problem, the photos or videos you attach and your consent, with the same technical data.

The Prime Shield Advisor

The messages you type, and any photo you choose to send, are processed only to produce an answer. Our server does not keep the conversation, just one technical line per request (time, sizes and a pseudonymised identifier derived from the IP address). The conversation stays in your browser until you close the tab or clear it, and for no longer than six hours.

Direct contact

Whatever you send us on WhatsApp, by email or by phone, including CVs sent to us for jobs.

Visiting the website

The web server records standard technical data (IP address, time, page requested and browser type) for security and to keep the site running.

Visit statistics

We use a self-hosted statistics tool on our own server, with no cookies and no stored IP addresses or per-visitor records. Figures are kept as daily totals only: pages, traffic source, language, device type, time on page and specific events such as opening WhatsApp, starting a request for quotation or downloading a document — never personal data. To count a visitor once a day we use a temporary token that is deleted, with its key, every day. We honour your browser’s “Do Not Track” and “Global Privacy Control” settings: when either is on, nothing is recorded.

Third-party analytics

We do not use Google Analytics or Microsoft Clarity. If we ever decide to enable either, it will only run after your explicit consent through a clear notice, and we will update this policy first.

Request tracking and warranty checks

To show the status of your request we ask for its reference and the last four digits of the mobile number used in it, and we show no personal data. The warranty verification page shows only the certificate’s status, the project, the systems and the dates — never client details.

03Customer accounts

Creating an account on the website is optional and free. If you create one, we process only the following:

• Account details: your name, e-mail address and preferred language, plus what you choose to add: mobile number, organisation and city.
• Your password, stored only as a one-way scrypt hash that nobody can read, our team included.
• If you sign in with Google: only your name, verified e-mail address and Google account ID. If you use a passkey (fingerprint, face or device PIN): its public key and when it was used; your fingerprint or face stays on your device and never reaches us.
• A record of your consents: the version of the terms and privacy policy you accepted and when, and your choice about hearing what is new (channels and topics), with the date of every change.
• Your “My downloads” list: the files you downloaded from the website while signed in, and when.
• Sign-in sessions and a short security log: when a session started, its last activity and the sign-in method, and important account actions (sign-in, password change, export, deletion…) with their times. Session IDs are stored only in hashed form, and we keep no IP address — only a keyed code derived from it.

Why, and on what basis

We use this data to provide the account you asked for and keep sign-in secure, to keep your downloads list, to prevent abuse and to document your consents. The legal basis is necessity to provide what you requested, your consent for news, and our legitimate interest in a secure website. We contact you about news only if you agreed, and only through the channels and topics you chose.

Messages

We do not currently send news or password-reset messages. To reset your password, contact us at contact@primeshield.com.sa so that we can check that the account is yours.

How long

We keep account data while the account is open. When you delete it, we immediately delete the profile, sign-in methods, sessions, consents and downloads list; the short security log stays, without your name or e-mail address, for up to 12 months and is then deleted automatically. A copy may remain in the server’s daily backups for up to 14 days before it is overwritten.

Your controls

From your account page you can correct your details, download a copy of your data (JSON), withdraw your consent to news and delete the account yourself. For anything else, write to contact@primeshield.com.sa.

04What we keep on your device

The website sets no cookies for visitors who do not sign in. It uses your browser’s local storage for functional purposes only:

• Your preferences: language, the motion switch for the site or the logo strip, and how the profile viewer opens.
• An unsent RFQ draft (fields only — never files or consent), deleted after 30 days or when you send or clear it.
• The advisor conversation for the browsing session only, a request you start on one page to finish on another, and the visit’s campaign tag.
• A copy of the site’s pages so it works offline if you install the app.

When you sign in to your account we set one strictly necessary cookie that keeps your session (scripts on the page cannot read it); it is deleted when you sign out, after 7 days without use, or after 30 days at most. With Google sign-in we also set a ten-minute cookie that protects the sign-in step. Your browser also keeps a note that you signed in (only the first letter of your name) to show the account button, and your choice to hide the registration invitation.

Our team’s administration area (not visitors) uses one strictly necessary cookie to sign in. You can delete browser data at any time in your browser settings.

05Why we use your data

• To study your request, prepare the quotation or the technical answer, and contact you the way you chose.
• To email you a confirmation with your request reference, if you gave an email address.
• To perform the contract and issue and administer invoices and warranty certificates if we work together.
• To protect the site and the requests from spam, harmful files and abuse.
• To understand how the site is used, in aggregate, and improve it.
• To meet legal obligations, such as statutory and tax record-keeping.

06Legal basis

• Your consent: when you send a form after ticking the consent box, or when you write to us directly. You can withdraw it at any time; this does not affect earlier processing.
• Necessity to take steps at your request before a contract, or to perform a contract you are party to.
• Our legitimate interest in securing the site, preventing abuse and producing aggregate statistics, without overriding your rights.
• Legal obligations that apply to us.

07Sharing

We never sell or rent your data or share it for marketing. Only the team handling your request sees it, together with service providers working for us and on our instructions only:

• The provider hosting our web server, where requests and their files are stored.
• Our company email service, to deliver request notifications to our team and confirmations to you.
• The AI provider that generates the advisor’s answers, only when the AI mode is on.

We may also disclose data where a law or a competent authority requires it.

08Transfers outside the Kingdom

Some service providers, such as the email service and the AI provider, may process data outside the Kingdom. When that happens we follow the Regulation on Personal Data Transfer outside the Kingdom and limit it to the minimum necessary. For that reason, please do not type sensitive personal data into the advisor chat.

09How long we keep data

• Quote and consultation requests and their files: for as long as needed to answer and follow them up, and, if we sign a contract, for the contract and the legal record-keeping periods; then they are deleted or anonymised.
• The file download links sent to our team expire after 60 days.
• Submissions automatically classed as spam: 30 days, then deleted automatically.
• Advisor conversations: not stored on our server.
• Technical server logs: a short period for security, then deleted on a rolling basis.
• CVs: for as long as they are needed for recruitment, and deleted when you ask.
• Customer accounts: while the account is open; deleted as soon as you delete it (details in “Customer accounts”).

10Security

We use HTTPS only, check uploaded files by their actual content, keep them outside the website’s public folder with restricted access, send our team signed download links that expire, and apply rate limits against abuse. No system is perfectly secure, but we keep our measures under review.

11Your rights

The Personal Data Protection Law gives you the right:

• To be informed how your data is collected, why it is processed and on what legal basis — which this policy sets out.
• To access your data and obtain a copy in a clear, readable format.
• To have your data corrected, completed or updated.
• To have your data destroyed when it is no longer needed, unless a law requires us to keep it.
• To withdraw your consent at any time.

If you have an account on the website, your account page lets you download a copy of your data, correct it, withdraw your consent and delete the account directly.

Send your request to contact@primeshield.com.sa and we will reply within 30 days. If you are not satisfied with our answer, you may file a complaint with the Saudi Data & AI Authority (SDAIA).

12Children

The website is meant for adults and project owners, and we do not knowingly collect children’s data.

13Changes and contact

We may update this policy when the website or the law changes, and the date of the last update appears at the top of the page. For any privacy question: contact@primeshield.com.sa, or call +966 59 240 0524.