Privacy Policy
Last updated: 9 August 2026
This notice explains what personal data Richmond Consulting Services ("RCS", "we") collects through this website, why we collect it, where it is processed, and the rights available to you under the Saudi Personal Data Protection Law (PDPL).
1. Data we collect
We collect personal data only when you choose to submit it through one of our forms. We do not operate analytics, advertising or tracking technologies on this website.
| Form | Data collected |
|---|---|
| Contact | Full name, email address, phone number, company, service interest, sector interest, and your message. |
| Careers | Full name, email address, phone number, target position, LinkedIn profile URL, and your CV (PDF, up to 5 MB). |
2. Purpose and legal basis
- Contact enquiries — to respond to your enquiry and, where relevant, to prepare a proposal. Basis: steps taken at your request prior to entering a contract.
- Job applications — to assess your suitability for a role. Basis: steps taken at your request prior to entering an employment relationship.
3. International transfer of your data
Form submissions are transmitted to Google Workspace services (Google Apps Script, Google Sheets and Google Drive), operated by Google LLC. Your data is therefore transferred to and stored on servers outside the Kingdom of Saudi Arabia, including in the United States.
Transfers of personal data outside the Kingdom are governed by the PDPL, the SDAIA Regulation on Personal Data Transfer Outside the Kingdom, and the SDAIA Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (February 2025). A transfer is permitted only where it does not prejudice national security or the vital interests of the Kingdom, is limited to the minimum data necessary for the stated purpose, and is protected by an appropriate safeguard.
SDAIA has not published an adequacy list of approved countries. Transfers to countries without an adequacy determination must therefore rely on an approved safeguard — Standard Contractual Clauses (SCCs) approved by SDAIA, Binding Corporate Rules, or an equivalent contractual mechanism — supported by a documented transfer risk assessment.
Where personal data is transferred outside the Kingdom, RCS applies the safeguards required by the PDPL and its implementing regulations, and limits the transfer to the minimum data necessary for the purpose. You may request details of the safeguard applied to a particular transfer by contacting us using the details in section 8.
4. Retention
Contact enquiries, and the personal data submitted with them, are retained for 24 months from the date of the enquiry. CVs and job-application data are retained for 12 months after the recruitment decision, so that we may consider you for comparable roles, unless you ask us to delete them sooner. Personal data is destroyed once the purpose for collecting it no longer exists, as required by the PDPL.
5. Sharing
We do not sell personal data. We do not share it with third parties for marketing. It is accessible only to RCS personnel who need it for the purposes above, and to Google as our processor.
6. Your rights under the PDPL
- To be informed about how your data is used
- To access your data
- To request correction of inaccurate data
- To request deletion of your data
- To withdraw consent where consent is the basis
To exercise any of these, contact us at info@richmondcs.ca. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).
7. Security
This website is served exclusively over HTTPS with HSTS enforced, applies a Content Security Policy, and does not store personal data in your browser. Submitted data is protected by the access controls of our Google Workspace environment.
8. Contact
Richmond Consulting Services
Imam Saud Street, Altaawon Commercial Center, Riyadh, Saudi Arabia
info@richmondcs.ca · +966 11 562 4422