Privacy Policy

Who we are

This website (M and L Technologies, ml-technologies.net) is operated by M & L Technologies (Sole establishment), referred to in this policy as the "Controller", "we", or "us". The Controller is the party that determines the purposes and means of processing your personal data.

• Unified National Number: 7050490098
• Commercial Registration number: 7050490098
• National Address: Building 4899, Jabal Khiraz Street, East Umm Al Hamam District, Riyadh 12323, Kingdom of Saudi Arabia (short code RGUA4899)
• Data protection contact: privacy@ml-technologies.net

This policy explains what personal data we collect about you, why we collect it, the lawful basis for each purpose, who receives it, where it is processed, how long we keep it, and your rights under the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations. We comply with the PDPL, in particular the notice obligation in Article 12 of the Law and Article 11 of the Implementing Regulations.

What we process, why, and on what basis

This is our corporate website. It does not run tools, accept file uploads, hold accounts, or take payments; it collects personal data from you through the contact form and — only after you consent — pseudonymous usage and analytics data. We process your personal data for specific purposes, and each purpose has its own lawful basis. We do not process your data for any other purpose without notifying you or obtaining your consent where required.

1. Responding to an enquiry you send through the contact form

• Data: your name, your email address, the message you send us, and — if you choose to give it — your company name.
• Lawful basis: to take steps at your request and respond to your enquiry, and our legitimate interest in answering messages sent to us.
• Providing it: your name, email, and message are required to send us an enquiry through the form so that we can reply; the company field is optional. You may instead contact us directly by email or WhatsApp without using the form.

2. Security and anti-abuse

• Data: your IP address, which our hosting and edge-network provider processes to protect the site from automated abuse and denial-of-service attacks, together with basic checks on the contact form (such as a hidden anti-spam field).
• Lawful basis: legitimate interest — protecting the site and its visitors from fraud and abuse is an interest not overridden by your rights and freedoms.
• Providing it: this is collected automatically as part of visiting the site and submitting the form and is necessary to protect it; it cannot be switched off while you use the site.

3. Error diagnostics

• Data: technical error reports (error type, path, and context data stripped of personal identifiers) sent to our error-tracking system.
• Lawful basis: legitimate interest — detecting and fixing faults to keep the service reliable. We scrub these reports of personal data before they are sent.
• Providing it: these reports are generated automatically only when a fault occurs, are stripped of personal identifiers, and are necessary to run a reliable service.

4. Product analytics

• Data: anonymised or limited-identifier usage signals (such as pages visited), without passing identifying data to them.
• Lawful basis: consent — product analytics are opt-in and run only with your explicit consent through the consent banner. These analytics are currently inactive entirely; when activated, they will run only after you grant consent.
• Providing it: this is optional. Refusing it changes nothing about your ability to use the site.

5. Usage and traffic analytics

• Data: pseudonymous usage and interaction data — such as the pages you view and how you move through the site, an approximate location derived from your network (not a precise location), and general device and browser information — with no precise identifiers and without your IP address being stored.
• Lawful basis: consent — usage and traffic analytics are opt-in and run only with your explicit consent through the consent banner, so that we can understand and improve how the site is used. If you do not consent, they do not run.
• Providing it: this is optional. Refusing it changes nothing about your ability to use the site.

Who receives your data — recipients

We do not sell your personal data. Your personal data is processed on our behalf and under our instructions by a limited set of service providers. These fall into the following categories, including:

• a cloud hosting and edge-network provider — front-end hosting of this website and an aggregate, cookieless website-analytics beacon, operating over a global edge network;
• an email-delivery provider — delivering the enquiries you send through the contact form to us;
• analytics providers located outside the Kingdom — opt-in product analytics and usage/traffic analytics that run only after you grant consent (see below).

Our error-tracking system is self-hosted on our own infrastructure (with personal identifiers scrubbed before an error is recorded) and is not a third-party recipient.

Transfer outside the Kingdom

Some of your personal data is processed outside the Kingdom of Saudi Arabia: our hosting and edge-network services operate over a global edge network; the enquiries you send through the contact form are delivered by an email-delivery provider whose servers are in the European Union; and, where you consent to product analytics or usage/traffic analytics, those analytics providers process that data outside the Kingdom.

Where we transfer your personal data outside the Kingdom, we do so under the conditions the Personal Data Protection Law and its Implementing Regulations permit for transfers outside the Kingdom.

Retention

We keep your data for as long as is necessary to fulfil the purpose it was collected for, then delete or anonymise it:

Category	Retention
Enquiries you send through the contact form	Kept only as long as is necessary to handle your enquiry and any related follow-up, then deleted
Email delivery metadata held by the email-delivery provider (the sender and recipient address, the message subject line, and delivery events)	Retained by that provider outside our direct control. The query windows it publishes — up to 30 days, and up to 60 days in aggregate — are query windows, not deletion guarantees, and it documents no procedure to delete this metadata.
Product-analytics click and heatmap data (when active)	13 months (session replay is kept for 30 days)
Usage/traffic analytics data (when active)	Up to 14 months
Error reports (stripped of identifiers)	For a limited period sufficient to diagnose and fix the fault

Your rights

Article 4 of the PDPL grants you the following five rights in your personal data:

• The right to be informed — to know how your personal data is collected and processed, and the legal basis for it (which this policy provides).
• The right to access your personal data held by us.
• The right to obtain your personal data in a readable, clear format. On request we provide it in a commonly used electronic format, and a printed copy where you ask for one (Article 6 of the Implementing Regulations).
• The right to correction — to have your personal data corrected, completed, or updated.
• The right to destruction — to have your personal data destroyed once it is no longer needed for the purpose it was collected for.

One limit we state plainly: when we destroy your personal data we delete our own copies, but we cannot delete the delivery metadata — including the message subject line — that the email-delivery provider retains when your enquiry is delivered to us, as described in the retention table above.

To exercise any of these rights, contact us at privacy@ml-technologies.net. We respond to your request within the statutory period. Withdrawing a consent you have given is covered under "Withdrawing consent" below.

Withdrawing consent

Where processing is based on your consent (product analytics), you can withdraw it at any time, as easily as you gave it (Article 5(2) of the Law and Article 12 of the Implementing Regulations), from the consent controls on this page, without affecting the lawfulness of processing before the withdrawal.

Website analytics

We use a privacy-focused website-analytics service to measure site performance and traffic in aggregate. It uses no cookies and sets no identifier that tracks you across sites, and it loads without requiring prior consent. We operate it on the basis of legitimate interest (measuring our service's performance), and we disclose it here explicitly.

Changes to this policy

We may update this policy from time to time. When we make a material change, we update the "Last updated" date and version number at the top of the page, and we may notify you by email or through a notice on the site. Your continued use of the site after an update takes effect constitutes your awareness of it.