Privacy Policy & Data Protection

This Privacy Policy governs all digital services, web applications, mobile platforms, artificial intelligence tools, and cloud software solutions operated by Experto (referred to herein as "we", "us", or "our").

This document sets forth the basis upon which any personal data we collect from you, or that you provide to us through our website (experto.sa), customer inquiries, project agreements, and software tools, will be processed and protected.

Experto strictly complies with the Saudi Personal Data Protection Law (PDPL) promulgated under Royal Decree No. (M/19), amended by Royal Decree No. (M/148), and its Implementing Regulations supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA), as well as essential cybersecurity controls issued by the National Cybersecurity Authority (NCA).

We uphold fundamental data privacy principles including Purpose Limitation, Data Minimization, Storage Limitation, Accuracy, and robust Technical and Organizational Security Measures to ensure utmost confidentiality and integrity.

We process personal data strictly in reliance upon lawful bases defined under the Saudi PDPL:

We enforce rigorous multi-layered defense-in-depth mechanisms in accordance with top industry standards:

• State-of-the-Art Encryption: Full encryption in transit using modern TLS 1.3 / HTTPS suites and robust AES-256 encryption at rest.
• Role-Based Access Control (RBAC): Strict principle of least privilege, requiring Multi-Factor Authentication (MFA) for all engineering and administrative staff.
• Continuous Security Auditing: Periodic vulnerability assessments, automated intrusion detection, and active log monitoring.
• Confidentiality Agreements (NDA): All team members and partners are bound by legally enforceable non-disclosure agreements.

Data may only be shared on a strict need-to-know basis with vetted sub-processors subject to robust data protection agreements:

• Enterprise cloud hosting and database infrastructure providers.
• Licensed electronic payment gateways approved by the Saudi Central Bank (SAMA).
• Competent governmental and judicial authorities when mandatory under applicable Saudi law.

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, or as required by Saudi statutory retention periods (such as accounting and tax requirements).

Upon expiration of the retention schedule or upon verified erasure requests, data is securely and permanently destroyed using cryptographic wiping protocols or rendered irrevocably anonymized.

We utilize cookies and lightweight telemetry to deliver a secure, performant, and responsive experience:

• Essential Cookies: Vital for basic navigation, language selection (Arabic / English), and theme state.
• Performance & Analytics Cookies: Aggregate anonymized metrics to diagnose latency and improve navigation workflows.

You can manage or disable cookies at any time through your browser preferences without losing access to standard pages.