Privacy
Policy.

This Privacy Policy (hereinafter referred to as the "Policy" or "Privacy Document") sets forth the manner in which Seven Dimensions Marketing Agency, a commercial establishment registered under the laws of the Kingdom of Saudi Arabia, having its principal seat of business in Riyadh, Saudi Arabia (hereinafter referred to as the "Company," "Agency," "7 Dimensions," "we," "us," or "our"), collects, records, organizes, stores, retrieves, discloses, transmits, and otherwise processes personal data in the course of operating, maintaining, and improving the website and any related digital services, functionalities, applications, or communications made available therein, including the digital property accessible at the domain `7di.sa` (collectively, the "Services"). By accessing or continuing to access the Services, the User (hereinafter referred to as "you" or "your") shall be deemed to have acknowledged, accepted, and consented to the practices described herein, subject to the limitations, qualifications, and carve-outs set forth in the subsequent provisions, which shall be read together as a single, integrated instrument, construed in accordance with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19, and the regulations of the Saudi Data and AI Authority (SDAIA).

The Company may collect, inter alia, the following categories of information: (a) "Personal Data," being any information relating to an identified or identifiable natural person, including but not limited to full legal names, business titles, corporate entity designations, electronic mail addresses, telephone numbers, IP addresses, organizational affiliations, geographical coordinates, and persistent online identifier tokens furnished through the contact mechanisms provided within the Services; (b) "Technical Data," including Internet Protocol (IP) addresses, Internet Service Provider (ISP) identifiers, device characteristics, operating system build parameters, browser type and version, and session durations; (c) "Usage Data," comprising pages viewed, navigation paths, clickstream sequences, scroll-depth metrics, and interaction events generated through the operation of the Services; and (d) "Communication Metadata," including timestamps, origin headers, and records of digital correspondence exchanged between the Data Subject and Company representatives. The collection of such data may occur notwithstanding the absence of a registered user account, by virtue of the mere transmission of requests to the Company's servers.

Personal Data is obtained through direct, indirect, and automated means, including without limitation: information voluntarily submitted via contact, inquiry, or consultation forms (including the interactive web forms present at `contact-us.html`); data gathered through the deployment of cookies, local storage objects (LSOs), web beacons, pixel tags, transparent GIFs, and script headers; and data received from third-party analytics and tag-management providers, notably Google Tag Manager, Google Analytics, Meta Pixel, and LinkedIn Insight Tag, which may process such information on the Company's behalf. The foregoing enumeration is illustrative and not exhaustive, and the Company reserves the right to employ additional collection methodologies as technological or operational circumstances may require, without prior individualized notice.

The Company may use the collected information for, among other purposes: the provision, administration, and personalization of the Services; the response to inquiries and the performance of pre-contractual measures, including B2B proposal and RFP processing; the analysis of usage trends and the optimization of user experience; the delivery of marketing communications where permitted; the detection, prevention, and mitigation of fraudulent, abusive, or unlawful activity; and compliance with legal, regulatory, and contractual obligations. Such use may be conducted by automated means, and the Company makes no representation that any particular use will be limited to a single stated purpose.

Where applicable under the applicable data protection framework, the Company relies upon one or more of the following legal bases: the necessity of processing for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract; compliance with a legal obligation to which the Company is subject; the pursuit of the legitimate interests of the Company or a third party, balanced against the interests and fundamental rights of the data subject; and, where required, the consent of the data subject, which may be withdrawn at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

The Company may disclose Personal Data to recipients including, without limitation: service providers, processors, and infrastructure vendors engaged in the operation of the Services, including cloud hosting, content delivery networks (CDNs), and server providers hosting `7di.sa`; analytics and advertising partners such as Google, Meta, and LinkedIn, pursuant to whose terms such data may be processed; customer relationship management platforms, automated mailing services, and enterprise software suites used to process client inquiries; professional advisers, auditors, and regulators, including the Saudi Data and AI Authority (SDAIA), the Ministry of Commerce, and competent judicial bodies; and successors in interest in connection with a merger, acquisition, reorganization, or sale of assets. The Company shall endeavor, where practicable, to ensure that recipients are bound by obligations of confidentiality and data protection, though the Company does not warrant the practices of any third party operating outside its direct control and disclaims all control over the data processing algorithms employed by independent vendors.

Personal Data may be transferred to, and processed in, jurisdictions other than the jurisdiction in which it was collected, including jurisdictions that may not provide an adequate level of protection under the laws of the data subject's home country. By submitting Personal Data, the data subject consents to such transfers and acknowledges that the Company may rely upon standard contractual clauses, corporate binding rules, or other lawful transfer mechanisms, the specifics of which may be supplied upon reasonable written request.

The Company retains Personal Data for the period necessary to fulfill the purposes outlined in this Policy, or for such longer period as may be required to comply with legal, accounting, or reporting obligations, to resolve disputes, or to enforce its agreements. Retention periods may vary depending on the category of data and the context of collection, and the Company applies deletion or anonymization procedures upon the expiration of the applicable retention period, subject to technical and operational constraints that may delay final erasure.

The Company implements technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. Notwithstanding such measures, no method of transmission over the internet or electronic storage is guaranteed to be secure, and the Company expressly disclaims any warranty, express or implied, that the Services are invulnerable to breach, interception, or compromise. The data subject assumes all risk arising from the transmission of information via the Services.

Subject to verification of identity and applicable law, data subjects may possess the right to be informed of the legal basis and purposes of processing; the right of access to a copy of personal data held; the right to rectification of inaccurate or incomplete records; the right to destruction or erasure where processing is no longer necessary; the right to restrict or port their Personal Data; and the right to object to certain processing, including processing for direct marketing purposes. To exercise any statutory right, the Data Subject must submit a formal written application to `Contact@7di.sa` accompanied by notarized proof of identity, official corporate verification documents where applicable, and a detailed specification of the requested action; the Company reserves thirty (30) business days to evaluate and respond. The data subject further retains the right to lodge a complaint with the Saudi Data and AI Authority (SDAIA) or a supervisory authority.

The Services are not directed to, and the Company does not knowingly collect Personal Data from, children below the age of majority in their applicable jurisdiction. Where the Company becomes aware of having inadvertently obtained Personal Data from a minor, it shall take reasonable steps to delete such information, notwithstanding that the Company assumes no obligation to actively monitor the age of users beyond what is technically feasible.

The Company reserves the right, at its sole discretion and without prior individual notice, to amend, modify, or replace this Policy at any time; revisions become effective immediately upon publishing to `7di.sa`, and continued use following the posting of revisions shall constitute irrevocable acceptance of the amended terms. Material changes shall be reflected by an updated "Last Revised" date, and the data subject is encouraged, though not obligated, to review this Policy periodically.

All inquiries, requests, or concerns regarding this Policy or the processing of Personal Data may be directed to the Company at the electronic mail address `Contact@7di.sa` or by telephone at `+966 535553380`, with registered headquarters situated in Riyadh, Kingdom of Saudi Arabia. The Company, as the data controller, shall endeavor to address such communications within a reasonable period, though no binding response timeframe is assumed beyond that mandated by applicable law.

Last Revised: August 25, 2026. This Policy is provided in the English language, which shall prevail in the event of any inconsistency with any translation.