This Privacy Policy explains how IOTA Technologies Company collects, uses, shares, and protects personal data, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL, issued by Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA), and consistent with National Data Management Office (NDMO) data governance standards. Last updated: 1 September 2026.

1. Who controls your data

IOTA Technologies Company (operating as “IOTA Labs”), 2885, Office #9, Jarir Street, AlMalaz, Riyadh 12836, Kingdom of Saudi Arabia, is the controller of personal data collected through this website. For any privacy matter, contact engagements@iotatechnologies.ai or +966 50534 0573.

2. What we collect

Contact and identity data you choose to share with us — your name, work email, phone number, company, and role — when you submit an enquiry, book a discovery call, or email us; the content of our correspondence; and limited technical data (browser type, device, pages visited) needed to keep the site secure and performing well.

3. Consent under the PDPL

We collect personal data on the basis of your explicit consent — given when you submit a form, book a call, or write to us — or on another basis the PDPL permits, such as performing or preparing a contract with you, meeting a legal obligation, or a legitimate (actual) interest recognised by the law that does not prejudice your rights. You may withdraw your consent at any time by writing to engagements@iotatechnologies.ai; withdrawal does not affect processing that occurred lawfully before it.

4. How we use personal data

To respond to your enquiries, schedule and hold discovery calls, prepare proposals, deliver engagements, keep this website secure, and meet legal obligations. We do not sell personal data, and we make no automated decisions about you that produce legal or similarly significant effects.

5. Sharing and processors

We share personal data only with service providers that help us operate — website hosting (Framer), call scheduling (Microsoft Bookings), cloud storage (Microsoft Azure), and business email — each acting under safeguards and only on our instructions. We may disclose data where the law requires it.

6. Cross-border transfers

IOTA operates from Saudi Arabia with hubs in India, the UAE, and the UK, and some of our providers process data outside the Kingdom. Where personal data is transferred outside Saudi Arabia, we do so only as the PDPL and SDAIA’s transfer regulations allow — relying on adequacy, appropriate safeguards, or your explicit consent, and preserving a level of protection no lower than the PDPL provides.

7. Retention

We keep personal data only as long as needed for the purposes above or as the law requires. Enquiry data is typically deleted within twenty-four months of our last contact unless an engagement follows, in which case contract-related records are retained for the legally required period.

8. Security

We apply encryption in transit, access controls, and least-privilege practices. Data minimisation is part of how we build: our own products are designed for on-premises and air-gapped deployment precisely so that sensitive data stays where it belongs.

9. Your rights under the PDPL

You have the right to be informed about how your data is processed; to access your personal data and obtain a copy of it; to request correction or completion; to request destruction of data we no longer have a lawful basis to keep; and to withdraw consent at any time. To exercise any right, email engagements@iotatechnologies.ai — we respond within the timelines the Implementing Regulations set. You may also lodge a complaint with the competent authority (SDAIA).

10. Cookies

This website uses only cookies that are strictly necessary for it to function, plus a single preference entry that remembers your cookie choice. When you make that choice, we also record it — the choice, time, page, and timezone only, nothing that identifies you — so consent can be evidenced. We set no advertising or cross-site tracking cookies. If we introduce optional analytics in the future, we will ask for your consent through the cookie banner before any such cookie is set. You can also clear or block cookies in your browser at any time.

11. Children

This website is directed at businesses and their professionals. It is not intended for children, and we do not knowingly collect children’s data.

12. Visitors from other jurisdictions

If you contact us from the UAE, the UK, the EU, India, or elsewhere, we honour the rights your local data protection law grants you — including under the UK GDPR and India’s DPDP Act — to the extent they apply to our processing.

13. Changes and contact

We may update this policy as our services or the law evolve; the date at the top reflects the latest revision. Questions and requests: engagements@iotatechnologies.ai — IOTA Technologies Company, 2885, Office #9, Jarir Street, AlMalaz, Riyadh 12836, Kingdom of Saudi Arabia.