Privacy notice

Controller

Name

Zullfa

Contact

hello@zullfa.com

We process personal data under the PDPL and its Implementing Regulations and, where you are in the United Kingdom or the European Union, in a way that respects the rights you have there.

What we collect and why

• Forms you submit (a price-list request, a question, the quarterly report, a follow-up after the eligibility checker): your name, your email or WhatsApp number, your nationality if you give it, your message, the page you were on and the project, zone or city it concerns, and the time you gave consent. We use them to reply to you, to send what you asked for and, only if you ask, to pass your request to a developer, licensed broker or lawyer.
• The chat: what you type goes to our answer service, which writes the reply from the sources on this site. The conversation carries a session id so that it holds together from page to page, and a conversation you ask to take further goes to a person at Zullfa. The chat also records that a reply was given (how many sources it cited, the language, the page) with the same session id, so that we can see whether the answers help.
• The advertisement licence check: the number you type goes to our answer service, which looks it up on REGA’s register, with a session id.
• Messages you send us by WhatsApp or email: the content and your contact details, for the same purposes.
• The tools (the eligibility checker, the cost calculator, Second Opinion) run in your browser. What you enter stays there unless you submit a form, and the eligibility checker’s question about religion is never sent to us.
• Visit counting: each page you open sends us, with no cookie, the page, the site that linked to it (its name only, never the search you typed), your browser’s time zone and language, your screen width, and the campaign tags or ad click id in the link you arrived by. We count visitors with a code made from your IP address and browser that changes every day; we store neither the IP address nor anything that follows you from one day to the next. We use it to see which pages help and which campaigns bring people, and a form you send carries the same campaign tags so that we know what brought it. Each page view also carries a session id that lasts only while the tab is open. When you send us a form from that tab, the pages you read in it are kept with your enquiry, so that whoever replies knows what you were reading; pages from any other visit are never linked to you.
• Server logs: our hosting provider records standard server logs (IP address, browser, page requested) for security and capacity, kept for a limited period.

Legal basis and consent

We rely on your explicit consent, given by ticking the consent box on a form, and on our legitimate interest in answering messages you send us. You can withdraw consent at any time by emailing us; withdrawal does not affect processing before it.

Sharing

We share your details with a developer, broker or lawyer only when you ask us to introduce you, and we tell you who we are sending them to. Service providers (hosting, email delivery, our CRM) process data on our instructions. We never sell personal data, and we never share it with listing portals.

Transfers outside Saudi Arabia

Some providers store data outside the Kingdom. Where that happens we apply the safeguards the PDPL requires for cross-border transfer and limit what is transferred to what the purpose needs.

Retention

Lead and alert records are kept while your request is open and for a limited period after, then deleted or anonymised. Subscriptions to the quarterly report are kept until you unsubscribe, which every email lets you do.

Your rights

You may ask to access, correct or delete your data, to restrict or object to processing, to receive a copy in a portable form, and to withdraw consent. Write to hello@zullfa.com; we respond within the period the PDPL sets. You may also complain to the Saudi Data and AI Authority (SDAIA) or, where it applies, to your local supervisory authority.

Cookies and browser storage

We set no tracking cookies. The site keeps up to five things in your browser, and none of them goes to a third party:

• the currency you choose for prices, kept on your device until you clear it;
• while the tab is open, the chat’s session id and the conversation so far (its last 30 turns), so that the chat keeps its place from page to page;
• while the tab is open, a session id sent with an advertisement licence check;
• while the tab is open, the campaign tags or ad click id of the link you arrived by, sent with each page you open and any form you send;
• only on the browsers of our own team, a note that leaves that browser out of the visit count.

The three kept while the tab is open are cleared when you close it. The fonts are served from this site, so no font provider sees your visit.

Children

The site is not directed at children and we do not knowingly collect their data.

Changes

We update this notice when the site changes what it keeps or why.