Privacy Policy

01Who we are & scope

"Ekal", "we", "us" or "our" refers to Ekal Digital & Marketing Solutions, a creative marketing agency operating in Saudi Arabia (Riyadh and Qassim), providing strategic planning, digital marketing, creative content, ad campaigns, video production and brand identity design.

This policy applies to:

• Visitors to our website ekal.io and all of its pages.
• Anyone who contacts us via WhatsApp, email, phone, or our social media accounts.
• Our clients and their representatives while we deliver our services.

It does not apply to third-party websites or applications you may reach through links on our site.

Ekal acts as the data controller for personal data it collects for its own purposes (such as enquiries and marketing), and as a data processor on behalf of its clients for data handled within their marketing projects.

02Information we collect

a) Information you give us directly

• Full name, company or brand name, and job title.
• Email address, mobile or phone number, and your WhatsApp number when you contact us there.
• The content of your communications with us: message text, attachments, project details and indicative budget.
• Contracting and billing details if you engage us: company registration details, VAT number, invoice and transfer information.

b) Information collected automatically on our website

• IP address and approximate location (city/country).
• Device type, operating system, browser, screen resolution and device language.
• Pages visited, time and duration of the visit, and the referring page you arrived from.
• Cookie identifiers, advertising identifiers and session identifiers.
• Campaign tags (UTM parameters) when you arrive via an ad or marketing link.

c) Information from other sources

• Aggregated or statistical data from the advertising and analytics platforms we use.
• Publicly available information about your business (such as your website or official accounts) used to prepare proposals.
• Referrals from our partners or existing clients who recommend you to us.

03How we use your data

We use the information we collect only for the following purposes:

• Responding to your enquiries, scheduling the free discovery session, and preparing proposals and pricing.
• Delivering our services, managing projects and campaigns, and producing performance reports.
• Managing the contractual relationship, including invoicing, collections, and legal and tax obligations.
• Improving our website and services by analysing visitor behaviour and measuring page and content performance.
• Marketing our own services by sending content or offers that may interest you — you can unsubscribe at any time.
• Measuring our own ad campaigns and retargeting people who have visited our website.
• Protecting site security, preventing fraud and misuse, and complying with applicable laws.

What we do not do: we do not sell your personal data to anyone, we do not rent or trade it, and we do not use it for purposes not disclosed in this policy.

04Legal basis for processing

We process your personal data on one of the following bases:

• Your consent: when you fill in a contact form, message us, accept non-essential cookies, or subscribe to our mailing list.
• Performance of a contract: where processing is necessary to perform an agreement with you or to take steps before entering into one.
• Legitimate interests: to improve our services, protect our systems and develop our business, without prejudice to your rights and freedoms.
• Legal obligation: where a law or competent authority in Saudi Arabia requires us to retain or disclose data.

05Cookies & tracking

Cookies are small text files stored in your browser that enable site functionality and measure performance. We may also use similar technologies such as pixels and browser local storage.

How to control cookies

• Your browser settings let you delete cookies or block them fully or partially.
• You can enable "Do Not Track" in browsers that support it.
• You can adjust ad preferences directly in your account settings on each advertising platform.

Disabling analytics and advertising cookies will not stop you browsing the site, but it may reduce the accuracy of our measurement.

06Advertising & measurement

As a marketing agency, we advertise our own services and measure the results of our campaigns. For this we may use measurement and tracking tools provided by advertising and analytics platforms, including:

These tools may link your visit to our website with your account on the relevant platform if you are logged in, and their processing of your data is governed by each platform's own privacy policy in addition to this one.

07Sharing your information

We share your data only in the following cases, and only to the extent necessary:

• Service providers: hosting, email, project management, analytics and messaging tools — all contractually bound to protect your data and use it only for our purposes.
• Advertising platforms: to the extent needed to run and measure campaigns, as described in section 6.
• Professional advisers: accountants, auditors and legal advisers where necessary.
• Competent authorities: where there is a lawful request, court order or legal obligation in Saudi Arabia.
• Mergers or acquisitions: if part of our business is sold or transferred, with notice to you.

We require every party we work with to maintain a level of protection no lower than the one we commit to in this policy.

08International transfers

Some of the service providers we rely on (such as advertising, analytics and hosting platforms) operate servers outside Saudi Arabia. In those cases we take appropriate steps to ensure an adequate level of protection, including verifying the provider's contractual data protection commitments, limiting transfers to the data that is strictly necessary, and complying with the transfer requirements of the PDPL and its Implementing Regulations.

09Data retention

We keep your data only for as long as needed for the purpose it was collected for:

• Enquiries that did not become engagements: up to 24 months from last contact.
• Client and project data: for the duration of the engagement and up to 5 years afterwards, or for the period required by accounting and tax regulations — whichever is longer.
• Analytics and advertising data: according to each platform's retention periods, usually in aggregated or anonymised form.
• Marketing preferences: until you ask to unsubscribe.

Once the period ends, we destroy the data or anonymise it so it can no longer be linked to you.

10Information security

We apply appropriate technical and organisational measures to protect your data, including:

• Encrypted connections to our website over HTTPS.
• Restricting data access to the team members who need it.
• Strong passwords and two-factor authentication on sensitive accounts.
• Choosing service providers that meet recognised security standards.
• Reviewing access permissions regularly and revoking them when no longer needed.

That said, no method of electronic transmission or storage is 100% secure. If a breach affecting your data occurs, we will handle it in line with regulatory requirements and notify you and the competent authority as required by law.

11Your rights

Under Saudi Arabia's Personal Data Protection Law, you have the following rights:

• Right to be informed: to know the legal basis and purpose for collecting your data.
• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate or incomplete data corrected or updated.
• Right to destruction: to request deletion of your data when it is no longer needed.
• Right to withdraw consent: at any time, without affecting processing carried out before withdrawal.
• Right to object: to the use of your data for direct marketing.

To exercise any of these rights, email us at info@ekal.io. We respond within 30 days of receiving your request, and may ask you to verify your identity first to protect your data. Exercising these rights is free of charge.

If you believe our processing of your data breaches the law, you have the right to lodge a complaint with the competent data protection authority in Saudi Arabia.

12Deleting your data

You can request deletion of your personal data from our records at any time:

• Email info@ekal.io with the subject "Data Deletion Request", or message us on WhatsApp.
• Include the name, email address and/or mobile number you used when contacting us.
• State whether you want all of your data deleted or only specific data.

We verify your identity and complete the request within 30 days, then confirm completion in writing. Deletion covers your data in our internal systems and marketing lists, and we instruct our connected service providers to delete it on their side.

13Our clients' data

While delivering our services we may handle data belonging to our clients' audiences (such as customer lists, campaign data or ad accounts). In those cases we act as a data processor on the client's behalf, and the client remains the controller responsible for the lawfulness of that collection and for informing the individuals concerned.

Our commitments in this role:

• Process data only per the client's written instructions and the agreed purpose.
• Never use it for our own purposes or share it with any other client.
• Delete or return it at the end of the engagement, as the client instructs.
• Keep it strictly confidential and apply appropriate security controls.

If you are a customer of one of the brands we serve and wish to exercise your rights, it is best to contact that brand directly — we are happy to assist them in fulfilling your request.

14Children's privacy

Our services and website are aimed at businesses and business owners. We do not target anyone under 18 years old and do not knowingly collect their data. If we learn that we have collected personal data from a minor without parental consent, we will delete it immediately. If you are a parent or guardian and believe this has happened, contact us at info@ekal.io.

15Third-party websites

Our site may contain links to websites or platforms we do not own or control (such as WhatsApp, social media platforms and our partners' sites). We are not responsible for their privacy practices, and we recommend reviewing each one's privacy policy before sharing any data with them.

16Changes to this policy

We may update this policy from time to time to reflect changes in our services or in applicable law. When we make a material change we will publish the updated version on this page and update the "Last updated" date above, and we may notify you by email if the change directly affects your rights. Continuing to use the site after an update is published constitutes acceptance of the updated version.

17Contact us

For any question, request or complaint about your privacy or this policy, reach us at: