Privacy Notice

Controller of personal information

Any personal information processed by Fiduca in connection with this Notice is controlled by Fiduca (“we”, “us”, “our”), which is the “data controller” for your personal information under applicable data protection law, including the Saudi Personal Data Protection Law (PDPL) and the UK/EU General Data Protection Regulation (GDPR) where applicable.

To contact our Data Protection contact, email privacy@fiduca.io.

How to contact us

For all data-related queries, contact us at:

Updates to this Notice

We may update this Notice from time to time to keep it up to date with legal requirements and changes to our platform. Any updates will be published on this page. The date at the top reflects the most recent revision. If a change affects how we process your data in a material way, we will notify you by email.

What do we mean by personal information?

Personal information means details that identify you or could be used to identify you, such as your name, work email address, job title, and organisation. It may also include information about how you use our platform, the assessment responses and notes you submit, and technical data such as your IP address and device identifiers.

When does this Notice apply?

This Notice applies to personal information we collect, use, and otherwise process when you:

• Use the Fiduca platform at fiduca.io, including the customer portal and the partner console.
• Register for an account or are provisioned an account by your organisation's administrator.
• Interact with our website or contact us by email or support channels.
• Book or access our platform through a partner or operator acting on our behalf.

How we protect your personal information

We take the security of your personal information seriously. We implement robust technical and organisational measures, including:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls so that only authorised personnel can access production data.
• Confidentiality obligations on all staff and service providers.
• Regular security reviews and a documented incident response process.
• Secure disposal or anonymisation of personal data when it is no longer required.

If you discover a security vulnerability, please disclose it responsibly to security@fiduca.io.

Cookies

We use cookies and similar technologies on our website and platform to keep you signed in, remember your preferences, and understand how the platform is used. For full details, see our Cookies Policy.

What types of personal information do we collect?

The information we collect depends on how you interact with us. It typically includes:

• Account data — name, work email address, organisation name, job title, and role (customer user or operator/partner).
• Authentication data — password hash (never stored in plain text) or the Google account identifier used for sign-in. Refresh tokens are stored as secure hashes.
• Usage data — pages visited, features used, session duration, and interaction events collected through Google Analytics (only with your performance consent).
• Assessment data — questionnaire responses, self-assessment scores, evidence notes, and comments you submit within the platform. This data belongs to your organisation and is held within your account tenant.
• Communication data — the content of emails you send to our support or privacy addresses.
• Technical data — IP address, browser type and version, device identifiers, and session cookies.

When do we collect personal information?

We collect personal information when you:

• Register for an account or complete your profile.
• Sign in using email and password or via Google OAuth.
• Use the platform — navigating pages, completing assessments, uploading evidence, or viewing reports.
• Contact us by email or through a support channel.
• Are added to the platform by an operator or administrator on behalf of your organisation.

Sensitive personal data

We do not intentionally collect special categories of sensitive personal data (such as health information, religious beliefs, or biometric data) through our standard platform flows.

If the content of your compliance assessment responses contains information that implies sensitive categories, this data is held strictly within your organisation's account tenant and is processed only to deliver the service you have requested. We do not use such content for any other purpose.

1. Platform delivery and contractual obligations

We use your personal information to:

• Provide, maintain, and secure the Fiduca platform and all features you have access to.
• Manage your account, authenticate your identity, and route you to the correct portal (customer or partner).
• Send you transactional communications related to your account — such as password reset emails, sign-in confirmations, and service status updates.
• Process your organisation's subscription and billing.

2. Security and fraud prevention

We use your personal information to:

• Detect and prevent unauthorised access, fraud, and abuse of the platform.
• Maintain audit logs of authentication events and data changes for security and compliance purposes.
• Comply with applicable laws and regulations, including responding to valid legal requests.

3. Platform improvement and analytics

With your performance consent, we use Google Analytics to understand how the platform is used in aggregate — which features are most active, where users encounter friction, and how navigation flows work. This data is anonymised and is used solely to improve the platform. See our Cookies Policy for details.

4. Customer support and service improvement

We use your personal information to:

• Respond to support requests, questions, and complaints.
• Improve our documentation, onboarding, and platform based on feedback.
• Produce aggregated, anonymised statistics for internal reporting.

5. Marketing and communications

We send only service-related communications unless you have explicitly opted in to marketing messages. If you subscribe to product updates or newsletters, you can unsubscribe at any time using the link in any email we send or by contacting us at privacy@fiduca.io.

We do not share your personal information with third-party advertising networks and do not run personalised ad campaigns that use your individual data.

6. Legal, regulatory, and governance obligations

We use your personal information to:

• Comply with applicable legal and regulatory obligations.
• Respond to valid court orders, subpoenas, regulatory requests, or law enforcement inquiries.
• Conduct internal audits, risk assessments, and compliance reviews.
• Maintain records as required under applicable law.

Legal basis for processing

We process your personal information only where we have a legal basis to do so:

• Contract — to deliver the platform services you or your organisation has subscribed to.
• Legitimate interests — to operate, secure, and improve our platform as a commercial SaaS provider. We balance these interests against your rights and do not use them to justify processing that overrides your fundamental privacy interests.
• Legal obligation — to comply with applicable laws, including the Saudi PDPL, GDPR where applicable, and responses to valid legal process.
• Consent — for optional processing such as performance analytics cookies. You may withdraw consent at any time through the cookie preferences centre accessible from the footer of any page, or by emailing privacy@fiduca.io.

How long we keep personal information

We keep your personal information for as long as necessary for the purpose it was collected:

• Account data — for the duration of your active subscription, and for up to 12 months after the subscription ends to handle billing queries, support requests, or disputes.
• Assessment data — retained within your organisation's tenant for the life of the subscription. You may request deletion at any time.
• Analytics data — retained per Google Analytics data retention settings (maximum 14 months for user-level data).
• Support communications — up to 3 years to handle follow-up queries.
• Audit and security logs — up to 7 years as required by applicable law or for legal proceedings.

When personal information is no longer required, we delete it securely or anonymise it so that it can no longer be associated with you.

Third-party websites

Our website may contain links to external websites operated by third parties. This Notice does not apply to those websites. We are not responsible for the privacy practices of sites we do not operate and encourage you to review their privacy policies before sharing your information.

Who we share your personal information with

We do not sell your personal information. We share it only as described below:

• Infrastructure providers — Vercel Inc. (web hosting), Render Inc. (API hosting), Supabase Inc. (PostgreSQL database), and Railway Inc. (MySQL database). These providers host and process data on our behalf as part of their standard service terms.
• Analytics — Google LLC (Google Analytics), only when you have granted performance consent. Data shared is aggregated and anonymised.
• Your organisation's administrator — if your account was provisioned by an operator or partner, they may have access to your account status and role within the platform.
• Legal and regulatory authorities — where required by a valid court order, subpoena, or applicable law.
• Professional advisers — law firms or auditors, under confidentiality obligations, where necessary to protect our legal rights.

International data transfers

Our infrastructure providers operate data centres primarily in the United States and Europe. When your personal information is transferred outside Saudi Arabia, we implement appropriate safeguards — including contractual clauses and data processing agreements — to ensure your data continues to be protected to the standards set out in this Notice and under applicable law.

Our analytics provider (Google LLC) may process aggregated, anonymised usage data in the United States. This transfer occurs only with your performance consent.

When will we send you marketing messages?

We will send you marketing messages only with your explicit permission. You can change your preference at any time by contacting us at privacy@fiduca.io. After opting out, you will continue to receive essential service communications related to your account (such as billing confirmations and platform status notifications).

Your rights

Under the Saudi PDPL and UK/EU GDPR (where applicable), you have the following rights in relation to your personal information. We will respond within 30 days, or within 60 days for complex requests where permitted by applicable law — we will notify you if an extension applies. There is no fee for making a request.

• Right of access — you may request a copy of the personal information we hold about you.
• Right of rectification — you may ask us to correct inaccurate personal information. You can also update your name, email, and profile details directly in your account settings.
• Right of erasure — you may ask us to delete your personal information. Some data must be retained for legal or audit purposes; we will explain any exceptions when responding to your request.
• Right to restriction — you may ask us to restrict processing of your personal information in certain circumstances (for example, while the accuracy of data is disputed).
• Right to data portability — you may request your personal information in a structured, machine-readable format where processing is based on your consent or a contract.
• Right to object — you may object to processing based on our legitimate interests or for direct marketing. We will stop unless we have compelling legitimate grounds.
• Right to withdraw consent — where processing is based on consent (such as analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

How to exercise your rights

To exercise any of the rights above, contact us in writing at privacy@fiduca.io. Please include your name, the email address associated with your account, and a description of your request. We may ask you to verify your identity before processing the request.

If your request is particularly complex we may extend our response time to three months, but we will inform you if that is the case.

Changes to this Notice

We may update this Notice as our practices evolve or in response to regulatory changes. The date at the top of this page reflects when it was last revised. We will notify you of material changes by email or through a prominent notice on the platform.

Contact and complaints

If you have any questions about this Notice or how we handle your personal information, contact us at privacy@fiduca.io.

If you believe we have not handled your personal information correctly, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.