Privacy Policy

1. Who we are

The controller responsible for your personal data is:

For any privacy question or request, contact us at info@lanternsystems.com with the subject line “Privacy Request”.

2. Scope

This Policy applies to personal data we collect through:

• our website and its pages, including the Contact, Request a Quote and Careers forms;
• email, telephone and WhatsApp communications with us;
• our social media pages (LinkedIn and Facebook), to the extent we receive personal data through them; and
• business development, tendering and pre-contract discussions.

This Policy does not cover personal data we process when we deliver projects or managed services under a contract with a client (for example, data handled within security, surveillance, access-control or communications systems at a client site). That processing is governed by the relevant contract and the client's own privacy notices, and we act in accordance with the client's instructions and applicable law.

3. Personal data we collect

3.1 Information you provide to us

Please do not include sensitive personal data (such as health, biometric, security-clearance or identity-document information) in forms or attachments unless it is strictly necessary and we have asked for it. If tender documents contain personal data of other people, please ensure you are entitled to share it with us.

3.2 Information collected automatically

When you use our website, we and our hosting providers may automatically collect limited technical data, such as:

• IP address, browser type, device type and screen or viewport size;
• date and time of access, pages requested and referring URLs; and
• security and anti-abuse signals used to detect spam and automated or malicious traffic, including verification by Cloudflare Turnstile when you submit a form; and
• if you accept analytics cookies, aggregated usage statistics about how the website is used (see Section 5). These never include form content, attachment names or contact details.

3.3 Information from third parties

We may receive business contact details from our partners, EPC contractors, clients, public tender portals, or professional networking sites (such as LinkedIn) when you or your organisation engage with us through those channels.

4. How and why we use personal data

We process personal data only where we have a lawful basis under the PDPL:

We do not sell personal data, and we do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

5. Cookies and similar technologies

Our website uses two kinds of cookies and similar technologies:

• Strictly necessary: cookies and technologies needed to deliver and secure the site, such as spam protection on our forms and remembering your cookie choice. These do not require consent.
• Analytics (optional): only if you accept cookies, we use Google Analytics and Microsoft Clarity to produce aggregated statistics about how visitors use the website, so we can improve it. Google and Microsoft act as our data processors for this purpose. Analytics never captures form content, attachment names or contact details.

We do not use advertising cookies, and no advertising network receives your data.

You can accept or decline analytics cookies when you first visit, and change your choice at any time by clearing cookies in your browser. You can also control or delete cookies through your browser settings. Blocking strictly necessary cookies may affect how the website works.

6. Who we share personal data with

We share personal data only where necessary and subject to appropriate safeguards:

• Service providers who support our operations, such as hosting, email delivery and IT security, acting on our instructions and under confidentiality obligations. Form submissions and attachments stay within our self-hosted systems: no third-party CRM or advertising network receives them.
• Analytics processors (Google and Microsoft), only if you have accepted analytics cookies, and only for aggregated usage statistics.
• Partners and subcontractors, such as manufacturers, distributors or engineering partners, where needed to prepare a proposal or deliver a project you have asked us about. We share only what is necessary for that purpose.
• Professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality.
• Government and regulatory authorities, including the High Commission for Industrial Security (HCIS) and the Saudi Data & AI Authority (SDAIA), courts or law-enforcement bodies, where required by law or to protect our rights.
• A successor business, in connection with a merger, acquisition or reorganisation, subject to equivalent protections.

When you contact us via WhatsApp, LinkedIn or Facebook, those platforms process your data under their own privacy policies. We encourage you to review them.

7. Where data is stored and international transfers

We self-host our website, content management system, form submissions and uploaded attachments on servers in the GCC region. Some service providers, including our content-delivery and anti-spam provider (Cloudflare) and, if you accept analytics cookies, Google and Microsoft, may process limited personal data outside the Kingdom of Saudi Arabia. Where personal data is transferred or disclosed outside the Kingdom, we do so only as permitted by the PDPL and its Regulations on Personal Data Transfer outside the Kingdom. Where required, we put appropriate safeguards in place, such as contractual protections, and we transfer only the minimum personal data necessary.

8. Data security

We apply technical and organisational measures appropriate to the nature of the data and the risks involved. These include encrypted connections (HTTPS), private storage for uploaded files, verification and rate-limiting of form submissions before they reach storage, and access controls that restrict submissions to the staff handling your enquiry or application.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to harm you or your rights, we will notify SDAIA and, where required, affected individuals, in accordance with the PDPL.

9. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy:

• Enquiries and quote requests that do not lead to a contract: generally up to 24 months after our last communication, so that we can follow up on related tenders.
• Job applications and CVs: up to 12 months, unless you ask us to delete them sooner or you are hired.
• Client and contract records: for the duration of the relationship and for the period afterwards required by applicable commercial, tax and regulatory laws.
• Website technical and security logs: for a limited period consistent with security and performance monitoring needs.

When personal data is no longer needed, we securely destroy or anonymise it, unless we must keep it to comply with the law or to establish, exercise or defend legal claims.

10. Your rights

Subject to the conditions and exceptions in the PDPL, you have the right to:

1. Be informed of the legal basis and purpose of collecting and processing your personal data.
2. Access your personal data held by us.
3. Obtain a copy of your personal data in a readable and clear format.
4. Request correction, completion or updating of your personal data.
5. Request destruction of your personal data when it is no longer needed.
6. Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before you withdrew it.

To exercise any of these rights, email info@lanternsystems.com with the subject line “Privacy Request”. We may need to verify your identity before acting on your request, and we will respond within the period required by the PDPL.

If you believe we have not handled your personal data in line with the law, you may contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA), the competent authority under the PDPL.

11. Children's privacy

Our Services are intended for businesses and professionals and are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-party websites

Our website may contain links to third-party websites and platforms, including WhatsApp, LinkedIn and Facebook. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top shows when it was last revised. Where changes are significant, we will take reasonable steps to notify you, for example by posting a notice on our website.

14. Language

This Policy may be provided in Arabic and English. In the event of any inconsistency, the Arabic version prevails to the extent required by the laws of the Kingdom of Saudi Arabia.

15. Contact us