Privacy & trust
Privacy policy
This policy explains how MENA GRC Community handles your personal data under the personal data protection framework of the Kingdom of Saudi Arabia.
1. Who we are
This website is operated by MENA GRC Community. For privacy questions or to exercise your data rights, contact us at info@menagrc.com.
2. What personal data we collect
We collect information you choose to provide: name, email, organisation, job role, message text, survey responses, article submissions and uploaded files. We also collect technical data needed to operate and secure the site (IP address, browser type, pages visited) and, only with your consent, anonymous usage statistics through cookies. When you complete an assessment tool we store an anonymous score record (tool, overall and section percentages, result level, language and date) to show aggregate averages; your individual answers, name and email are not stored with it.
3. Why we collect it (lawful basis under KSA PDPA)
We process data to perform our contract with you (account access, publishing your contributions), to comply with legal obligations, to protect our legitimate interests (security, fraud prevention, service improvement), and — only where you consent — to measure anonymous engagement. You can withdraw consent at any time by contacting info@menagrc.com.
4. How we use personal data
We use data to operate the library, manage member and contributor access, respond to enquiries, publish credited contributions, send transactional emails, improve the community experience and protect the service from misuse. We do not sell personal data.
5. Cookies and consent
Essential browser storage is used for language preference and authentication. Non-essential analytics and engagement tracking are only enabled after you click Accept in the cookie banner. You can change your choice at any time by clearing your browser storage or contacting us.
6. Contact messages
Contact submissions are stored securely so the community team can review and respond. They are not publicly visible. A copy is sent by email to info@menagrc.com.
7. Assistant conversations
The GRC Assistant sends the current conversation to an AI service to generate a response. Conversation history is held only in the current browser visit and is not intentionally stored by this website. Do not enter confidential, sensitive or personal information.
8. Storage, security and cross-border transfer
Data is hosted on cloud infrastructure located in the United States. By using this site, you understand and accept that your personal data will be transferred to and processed in the United States, a jurisdiction with different data-protection laws. We apply technical and organisational safeguards including encryption in transit, access controls and row-level security.
9. How long we keep data
We keep account and published-resource data while the account or content remains active. Contact messages are kept only as long as reasonably needed for follow-up, security and applicable legal obligations. You can ask us to delete your data at any time.
10. Your rights under KSA PDPA
You have the right to know what personal data we hold, to access it, correct it, request destruction or anonymisation, and withdraw your consent. To exercise these rights, email info@menagrc.com. We may need to verify your identity before acting. You also have the right to lodge a complaint with the relevant authority in the Kingdom of Saudi Arabia.
11. Sharing and recipients
Data is shared only with trusted service providers needed to run the site (hosting, database, email, AI services). All providers are contractually bound to use data only for the purposes described here.
12. Changes
We may update this policy as the service develops. The current version is always shown on this page with its last-updated date.