1. Introduction

MAFA Co. Ltd. (“MAFA”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy is prepared in accordance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and aligned with national data governance standards issued by the Saudi Data & AI Authority (SDAIA).

This Policy explains how we collect, use, store, disclose, and protect personal data when you:

• visit or use our website (www.mafa-co.com),
• submit an inquiry or contact form,
• apply for a job or submit a CV / application,
• download brochures or other documents,
• interact with our social media links or embedded content,
• attend our events or otherwise provide personal data.

By using or interacting with our website and services, you acknowledge that you have read, understood and accepted this Privacy Policy.

Certain activities (e.g., recruitment, events, media publication) may be subject to additional or separate notices. In case of conflict, the more specific notice will prevail.

‍

2. Data Controller Information

MAFA Co. Ltd.
Office # 413 and 414, Building 402,
Manarat Al Maarifa Business Center,
King Abdulaziz University, Prince Majid Street, Jeddah, Saudia Arabia

Commercial Registration (CR) No.: 4030178092
VAT Number (if applicable): 310889441700003
Contact Email: info@mafa-co.com
Contact Phone: +966 92000 5862

For all privacy or data protection inquiries, including requests regarding your personal data, please contact: info@mafa-co.com.

3. Types of Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Data You Provide Directly

• Name, company name, role / job title, contact information (email, phone), request / message content.
• Uploaded files (e.g., CVs, portfolios, application materials).
• Other data you submit through forms, emails or otherwise communicated to us.

3.2 Recruitment & Career Data

• Employment history, education, qualifications, skills, references (if provided).
• Interview notes, assessments.
• LinkedIn or other public profile URLs (if you choose to share).
• Optional consent to retain your profile for future opportunities.

3.3 Website Usage Data

• IP address, device type, browser type, operating system.
• Pages visited, timestamps, session duration, referrer information.
• Cookies and similar tracking technologies (see Cookie Policy).

3.4 Media & Event Content

• Photographs, videos, or other media captured during events, exhibitions, project installations, site visits when individuals may be identifiable. Media and event images may be processed based on consent or legitimate interest, depending on the context and PDPL requirements.
• Some images on the website are licensed stock photographs used for illustrative purposes only and do not represent identifiable individuals related to MAFA. These images do not involve the processing of personal data.

3.5 Data from Third Parties or Public Sources

• Data from recruitment agencies or job portals (if used).
• Publicly available information (e.g., LinkedIn profile).
• Information from partners, business contacts, or other third parties.

‍

4. Lawful Bases for Processing (under PDPL)

We process personal data based on one or more of the following lawful bases, as permitted under PDPL:

• Consent, when you have explicitly agreed (e.g., for marketing communications, talent-pool retention, optional cookies).
• Performance of a contract or pre-contractual steps, such as handling your inquiries, requests for quotations, or processing job applications.
• Compliance with legal obligations, including regulatory or statutory duties.
• Protection of vital interests, in case of emergencies.
• Legitimate interests of MAFA or third parties, such as improving our website or providing our services, provided these do not unduly infringe on your rights.
• Other bases permitted by PDPL, where applicable.

‍

5. Purposes of Processing

We process personal data for the following purposes:

• Operating and maintaining our website and services.
• Responding to inquiries, contact requests or sales leads.
• Managing recruitment processes and talent acquisition.
• Sending newsletters, updates, or marketing communications (only if you opt-in).
• Analytics, performance monitoring, and site optimisation (with your consent for non-essential cookies).
• Compliance with legal, regulatory or contractual obligations.
• Security, fraud prevention, investigation, and ensuring safe operation of our services.
• Other purposes as notified to you at collection or in subsequent notices (e.g., event participation, media consent).

If you decline to provide required data, for instance via a contact form or job application, we may be unable to process your request, respond to inquiries, or consider your application.

‍

6. Sharing & Disclosure of Personal Data

We may share personal data with:

• Service providers and processors (e.g. hosting provider, CMS,  Webflow, cloud/email providers, analytics or marketing platforms, ATS or HR systems).
• Business partners, third-party vendors or subcontractors assisting with services, recruitment, or marketing.
• Authorities, regulators or legal bodies when required by law.
• Potential transferees in case of corporate transactions (merger, acquisition, restructuring, sale of assets) with appropriate safeguards.

We do not sell your personal data or share it for direct commercial benefit with third parties.

All third parties receiving your data are subject to confidentiality and data-protection obligations, in line with PDPL and our internal requirements.

‍

7. International Data Transfers

Some of the processors or service providers we use may be located outside the Kingdom of Saudi Arabia (e.g. Webflow hosting, email/analytics providers). This may involve cross-border data transfer or storage.

Such transfers occur only:

• when necessary for providing the requested services, or
• under lawful bases permitted by PDPL, and
• under technical and organizational safeguards ensuring adequate protection and data security.

Transfers outside KSA occur in accordance with PDPL requirements, including adequacy decisions, contractual safeguards, or other lawful bases where required.

‍

8. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with applicable legal, regulatory, or operational requirements.

When personal data is no longer needed for these purposes, we take reasonable steps to delete it, anonymize it, or otherwise securely remove it from our systems, unless retention is required to meet legal obligations, resolve disputes, or enforce our agreements.

The specific retention period may vary depending on the type of data, the context of the interaction, and our legitimate business needs. Because of these variations, we do not commit to fixed deletion timelines, but we ensure that data is not kept longer than reasonably necessary.

Recruitment Data Retention

Personal data collected during recruitment is retained for the time necessary to manage the recruitment process and to comply with applicable legal or operational requirements.

If we wish to keep your information for future opportunities, we will request your consent. You may withdraw this consent at any time, after which your data will be removed unless retention is required for legal purposes.

Actual retention duration may vary depending on business needs, regulatory obligations, or internal policies.

‍

‍9. Your Rights Under PDPL

Under PDPL, you have the following rights with respect to your personal data:

• Right to be informed about how your data is processed.
• Right to request access and obtain a copy of your personal data.
• Right to request correction, update, or completion of your data.
• Right to request deletion / destruction of your data, where applicable.
• Right to withdraw consent at any time (e.g., for marketing or data retention).
• Right to request restriction of processing in certain circumstances.

To exercise any of these rights, please contact us at info@mafa-co.com or via our contact form indicating “Subject Access / Data Request.”

If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia (e.g. SDAIA / National Data Management Office), as foreseen under PDPL.

‍

10. Cookies & Tracking Technologies

We use cookies and similar technologies on our website. For details on the types of cookies, their purposes and your consent options, please refer to our Cookie Policy.

Strictly-necessary cookies are essential for website operation and deployed by default.
Other cookies (analytics, marketing, social media) are only activated with your explicit consent.

You can manage or withdraw your consent at any time using the “Cookie Settings” link in the footer, or via your browser settings, although disabling some cookies may impact website functionality.

‍

11. Data Security & Breach Handling

MAFA implements appropriate technical and organizational measures to safeguard personal data, including:

• Secure transmission (HTTPS),
• Access control, authentication, and role-based data access,
• Regular backups and system updates,
• Vendor due diligence and confidentiality obligations,
• Internal policies for handling and storing data.

In the event of a data security incident or breach, MAFA will assess the risks, and notify affected individuals and the relevant regulatory authority in accordance with PDPL obligations, when required.

‍

12. Children’s Data / Minors

This website and our services are not intended for children under 18. We do not knowingly collect personal data from minors. If we become aware that data of a minor has been collected, we will delete it promptly unless PDPL allows continued processing with guardian consent.

‍

13. Scope and Additional Notices / Layered Privacy

This Privacy Policy covers operations on www.mafa-co.com and general interactions as described above.

For specific services, e.g. recruitment portal, event registration, media publication, additional or separate privacy notices may apply. In such cases, that notice will supersede this general Policy for the relevant data and purpose.

‍

14. Changes to This Policy

We may update this Privacy Policy from time to time due to changes in law, business practices, service features, or regulatory guidance.

Whenever we make material changes, we will highlight this on our website. The “Last Updated” date will be revised accordingly.

Your continued use of the website after such changes constitutes acceptance of the updated policy.

‍

15. Contact & Data-Protection Inquiries

If you have any questions about this Privacy Policy, wish to exercise your rights, or raise a complaint, please contact:

info@mafa-co.com
Phone: +966 92000 5862

MAFA Co. Ltd.

Office # 413 and 414, Building 402,
Manarat Al Maarifa Business Center,
King Abdulaziz University, Prince Majid Street, Jeddah, Saudia Arabia

‍

16. Governing Law & Jurisdiction

This Privacy Policy, and any disputes regarding it, are governed by the laws of the Kingdom of Saudi Arabia, including PDPL and applicable regulations.

‍

17. Language & Precedence

This Privacy Policy is issued in both English and Arabic. In the event of any inconsistency or conflict between the two versions, the Arabic version shall prevail.