Scope and controller details
This policy covers the public PalmX website and the information a visitor may enter into its contact or careers experiences. The final legal entity name, registered address, privacy contact, and any data protection officer details are pending verification and must be completed before production publication.
The site is currently a static marketing experience. No production database, applicant intake service, analytics platform, advertising pixel, or third-party tracking tag was found in the repository audit.
Information we may receive
- Contact details and the content of an enquiry when you choose to send them through a supported channel.
- Applicant information such as name, email, role, portfolio link, message, and an optional CV file when the careers experience is used.
- Basic technical information needed to deliver, secure, and troubleshoot the website, subject to the hosting configuration actually used in production.
- Consent and preference records if you open the privacy-preferences panel. The current site does not activate optional analytics or advertising categories.
Purposes and legal basis
We use information only for the purpose explained at collection: responding to an enquiry, reviewing an application, maintaining site security and availability, or recording a privacy preference. The lawful basis and any additional purpose must be documented in the processing register before a new collection or integration is enabled.
We do not use an applicant or enquiry submission for marketing unless a separate, optional marketing choice is presented and recorded for that purpose.
Transfers outside Saudi Arabia
No cross-border data flow is asserted by this policy. If production hosting or a service provider transfers or makes personal data accessible outside the Kingdom, PalmX must complete the required transfer assessment, minimisation review, safeguards, contractual terms, and records before enabling that flow.
Retention and deletion
Retention periods are purpose-based. We keep information only for as long as needed for the stated purpose, a documented operational need, a legal requirement, or the resolution of a dispute. The final retention schedule, deletion owner, backup handling, and applicant retention period are pending approval in the internal register.
Your choices and rights
Subject to applicable law and verification requirements, a person may ask about access, correction, deletion, restriction or objection where available, withdrawal of consent, and the handling of their personal data. Use the data-request page once the routing banner confirms that the workflow is live.
We may need enough information to verify a request and may retain a minimal record of the request and response. Do not upload an identity document unless a verified channel specifically requests it and the legal basis for doing so has been confirmed.
Security and incidents
PalmX is designing administrative, technical, and organisational safeguards appropriate to the information and risk. A public page cannot promise that any website or transmission is risk-free. The incident response owner, notification workflow, and dedicated security channel must be confirmed before launch.
Changes and contact
This policy will show a version and effective date after approval. Material changes will be reflected in the policy manifest and, where required, communicated through an appropriate channel. Until a dedicated privacy mailbox is verified, the data-request workflow remains explicitly routing-disabled.
This is an operational draft for review and approval. Do not use it to determine rights or obligations until it is approved by the authorized owner.