Kingdom of Saudi Arabia Enterprise Cookies Policy

What should enterprises know about kingdom of Saudi Arabia Enterprise Cookies Policy?

Legal Scope and Governing Standard

What should enterprises know about pDPL-Aligned Processing Position?

K® shall process cookie-derived personal data in accordance with the Saudi Personal Data Protection Law, its Implementing Regulations, applicable SDAIA requirements, cybersecurity obligations, contractual commitments, and any stricter enterprise privacy standard adopted by K®.

What should enterprises know about kSA Enterprise Enforcement Statement?

Where Saudi law, sector regulation, customer contract, cybersecurity obligation, or global privacy policy imposes different requirements, K® (Kenzie) SAUDI GULF HOSTiNG shall apply the strictest enforceable standard to protect KSA users, customers, employees, visitors, and authorized representatives.

Enterprise Cookie Categories

• Strictly necessary cookies for authentication, session integrity, fraud prevention, cyber defense, load balancing, service continuity, and consent records.
• Functional cookies for language, region, accessibility, saved preferences, and customer portal configuration.
• Analytics cookies for service diagnostics, uptime, performance, error reporting, and product improvement.
• Marketing, personalization, profiling, and third-party tracking cookies only where legally permitted and consented to where required.

Mandatory Legal Controls

1. Non-essential cookies shall not be deployed for KSA users unless a lawful basis and, where required, valid consent exists.
2. Cookie notices shall identify purposes, categories, retention periods, third parties, transfer locations, withdrawal methods, and complaint channels.
3. Cookie data shall not be used for undisclosed profiling, automated decision-making, sensitive data inference, or unlawful behavioral monitoring.
4. Transfers of cookie-derived personal data outside KSA shall be subject to transfer impact review, contractual safeguards, data minimization, and applicable regulatory conditions.
5. Records shall be maintained for consent, rejection, withdrawal, vendor deployment, data retention, cross-border transfer review, and security review.