Privacy Policy

Who we are and the scope of this policy

This platform is operated by STAGING — Cube Master test operator, commercial registration number STAGING-CR-0000000000, national address STAGING address — not a legal notice, referred to in this policy as “the Operator” or “we”. This policy applies to the platform, its website, its applications and the services connected to them.

Our role depends on the kind of data:

• Your account data and your firm’s data held by us: the Operator is its controller.
• Data your firm enters into the platform, or receives through it, about its clients, employees or others: the firm is its controller, and the Operator processes it on the firm’s behalf to provide the service. The firm is responsible for the lawfulness of collecting that data, for informing the people it concerns, and for obtaining any consent required.

The data we collect

We may collect the following categories of data, depending on the services you use and how you use them:

Account and contact data

Such as name, email address, mobile number, job title, sign-in details, and the role granted to each user.

Firm and billing data

Such as the firm’s name, commercial registration, VAT number, address, subscription plan, and payment and invoice history. Card details are processed by the payment gateways.

Data you enter into the platform

Such as client, trainee and employee records, contact details, national ID or residency numbers where the service requires them, contracts, appointments, financial documents, messages and attachments.

Technical and usage data

Such as IP address, device and browser type, operating system, sign-in times, the pages and features used, activity and error logs, and what is collected through cookies and similar technologies.

Data we receive from you or from others

Such as what you send us through support, email or forms, and what we receive from payment gateways or from the integrations you enable.

We do not sell your personal data.

How we use data

We use data for the following purposes and for purposes reasonably connected with them:

• Providing, operating and maintaining the services, and creating and managing accounts.
• Processing subscriptions and payments and issuing invoices.
• Providing technical support and answering enquiries.
• Improving and developing the services and analysing their use, including producing aggregated or anonymised statistics.
• Protecting the platform and its users, and detecting and preventing fraud and misuse.
• Sending service notifications, and marketing messages and offers where the law allows; you can stop marketing messages at any time.
• Complying with laws and regulations, responding to requests from competent authorities, protecting our rights and enforcing the terms of use.

Lawful basis for processing

We process personal data in accordance with the Personal Data Protection Law and its Implementing Regulations, on one or more of the following bases as the case may be:

• Performing the contract with you or with your firm.
• Meeting a statutory obligation.
• A legitimate interest of the Operator, provided it does not conflict with the rights of the data subject.
• Your consent, which you may withdraw at any time without affecting processing carried out before the withdrawal.

Data storage

Data is stored on cloud servers operated by third-party hosting providers. We may change the hosting provider or the storage location whenever we consider it appropriate, subject to what this policy says about transferring data.

Each firm’s data is kept separate from other firms’ data within the platform.

Sharing and disclosure of data

We share your personal data only to the extent necessary, and we may share it with:

• Authorised users within your firm, each according to their permissions.
• Our affiliates and sister companies, for purposes consistent with this policy.
• Service providers acting on our behalf, as described in the next section.
• Professional advisers such as lawyers and auditors, to the extent their work requires.
• Government, judicial or regulatory authorities, where the law requires it or where we believe in good faith that it is necessary to protect our rights or the rights or safety of others.
• Another party in the event of a merger, acquisition, restructuring or sale of all or part of our assets, provided it is bound to protect the data as the law requires.
• Any other party with your consent or at your direction, such as an external service you connect to your account.

We may also share aggregated or anonymised data that does not identify any individual, for statistical or analytical purposes.

Service providers

We use external service providers to deliver and operate the services, and we bind them by contract to protect the data and to use it only for the purpose entrusted to them. Their categories include, without limitation:

• Cloud hosting, databases, file storage and backup.
• Operational email and notifications.
• Payment gateways and e-invoicing solution providers.
• Commercial messaging platforms such as WhatsApp Business, wherever that channel is enabled.
• Analytics, error and performance monitoring, and customer service tools.

We may add or replace providers from time to time, and the current list is available at https://my.stg.cm.sa/staging-subprocessors.

External services and links

The platform may contain links to external websites, or options to connect services provided by others such as messaging platforms, payment gateways and accounting systems. When you use those services, your data is governed by their own terms and privacy policies, and we are not responsible for their practices.

Transfer of data

In accordance with the relevant laws and regulations, we may transfer or disclose your personal data to parties in other countries for hosting, storage, processing and the provision of the services, including the service providers referred to in this policy.

Such a transfer or disclosure takes place only where appropriate safeguards are in place to protect your privacy, including contractual agreements with the receiving parties that bind them to protection standards equivalent to those we apply and to those the Personal Data Protection Law requires, and without prejudice to the level of protection guaranteed to your data under the Law and its Regulations. This means the transfer or disclosure does not affect your ability to exercise your rights, or the controller’s ability to comply with the requirements for notifying personal data breaches, destroying and controlling personal data, and disclosing it.

The firm is responsible for checking whether its activity is subject to statutory or regulatory requirements specific to keeping or processing its data, before using the platform to process that data.

Retention and deletion

We retain and use your personal data for as long as is necessary to fulfil the purposes in this policy and to meet our contractual and statutory obligations, and we destroy it once the purpose of collecting it has ended. We may keep it beyond that point once everything identifying its owner has been removed, in accordance with the statutory controls.

• When your firm’s subscription ends, its account stays open for 7 days for reading and exporting only, and nothing in it can be changed; we then delete its data from the live systems after a final backup, unless the subscription is renewed within that time.
• Copies of data may remain in backups until they are overwritten in their normal cycle of approximately 30 (STAGING).
• Financial documents, tax invoices and audit logs are kept for the periods the regulations require or a legitimate need justifies.

We keep data after the purpose of collecting it has ended in the cases the law permits, including: where a statutory justification requires it to be kept for a set period, in which case it is destroyed when that period or the purpose ends, whichever is later; or where it is closely linked to a case before a judicial authority, in which case it is destroyed once the proceedings are complete.

Your firm’s data

The data your firm enters into the platform remains its property, and your firm grants us the right to host and process it to the extent necessary to provide, operate, improve and protect the services.

You can export your data using the export tools available in the platform.

Your rights

Under the Personal Data Protection Law, you have the following rights:

• To be informed of how your data is collected, why, and on what lawful basis.
• To access your data and obtain a copy of it.
• To request that your data be corrected, completed or updated.
• To request the destruction of your data once it is no longer needed, unless a statutory obligation requires it to be kept.
• To withdraw your consent where the processing rests on it.

To exercise any of these rights, write to us at privacy@stg.cm.sa and we will respond within the period set by the regulations. We may ask for what is needed to verify your identity before acting on a request, and we may decline it in whole or in part in the cases the law permits. Requests from people whose data was entered by a subscribing firm are addressed to that firm, as the controller.

You have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority.

Data relating to minors

The platform is directed at firms and is not directed at anyone under eighteen. Where a firm, such as a training provider, enters data about minors, it is responsible for obtaining the guardian’s consent and for the lawfulness of the processing.

Cookies

We use cookies and similar technologies to operate the platform, keep your session and preferences — including the language this page is being read in — protect forms, analyse use and improve the services, and some of them may belong to analytics providers. You can control them from your browser settings, bearing in mind that disabling some of them may stop the platform or some of its features from working.

Data security

We take reasonable organisational, administrative and technical measures to protect data against unauthorised access, use or disclosure, and we review and update them from time to time.

Even so, no method of transmission over the internet or of electronic storage is 100% secure, so we cannot guarantee the absolute security of data. You are responsible for keeping your sign-in details confidential and for everything done through your account: never share your password with anyone, and tell us at once at support@stg.cm.sa if you suspect any unauthorised access.

Notification of data breaches

If a security incident results in unauthorised access to or tampering with personal data, we take the measures needed to contain it and address its effects, and we notify the competent authorities and anyone who must be notified, as the relevant regulations require and within the periods they set. Where the incident concerns data controlled by a subscribing firm, we notify that firm so that it can act as the controller.

Changes to this policy

We reserve the right to amend or update this policy from time to time, and an amendment takes effect from the date it is published on this page unless stated otherwise. We may notify you of material changes by whatever means we consider appropriate, and your continued use of the platform after an amendment is published constitutes acceptance of it.

Authoritative language

This policy was written in Arabic, and the Arabic text prevails in the event of any difference between it and any translation.

Contact us

For any question about this policy or to exercise your rights: privacy@stg.cm.sa. For technical support: support@stg.cm.sa or STAGING +966 00 000 0000. Address: STAGING address — not a legal notice.