Skip to main content

Last Updated: May 12, 2026 — Version 2.5

Privacy & Personal Data Protection Policy

We are committed to protecting the privacy of your personal data in accordance with the Saudi Personal Data Protection Law (PDPL).

1. Introduction & Scope

At Excellence Pro Platform ("Platform", "We", "Us") — available at excellencepro.sa — we are committed to protecting the privacy of your personal data in accordance with the provisions of the Saudi Personal Data Protection Law (PDPL), its executive regulations, and subsequent amendments.

This policy applies to all users who access the Platform or use its services, whether inside or outside the Kingdom of Saudi Arabia, as long as their data is processed through the Platform, including visitors who book meetings with the sales team or consultants.

2. Data Controller

Excellence Pro Platform is the Data Controller responsible for determining the purposes and means of processing.

Data Protection Officer (DPO):
Email: Win@excellencepro.sa Phone: +966550554448 Address: Kingdom of Saudi Arabia, Riyadh, Granada District, Imam Abdullah bin Saud Road

3. Personal Data We Collect

We adhere to the data minimization principle, collecting only the minimum necessary data:

3.1 Registration & Account Data

  • Full name
  • Email address
  • Organization and department name
  • Job title / Role

3.2 Assessment & Performance Data

  • Assessment scores based on KAQA & EFQM models
  • Strengths, opportunities, and evidence documents
  • Vision, mission, strategic goals, and KPIs

3.3 Project & Initiative Data

  • Details of continuous improvement projects
  • Timelines and assigned responsibilities
  • Technical completion progress reports

3.4 Meeting Booking Data

  • Full name, email, and mobile number
  • Company name and meeting subject
  • Preferred date and time

4. Legal Basis for Processing

We process personal data based on the following legal grounds:

  • Explicit Consent: Provided when you accept terms for meeting booking or forms.
  • Contract Performance: To deliver Platform services agreed under the subscription agreement.
  • Legitimate Interest: To improve Platform quality, cybersecurity, and client support.
  • Statutory Obligation: To comply with regulatory requirements and applicable laws.

5. Processing Purposes & Artificial Intelligence

Data is utilized to deliver consulting services, generate reports and analytics, manage user accounts, deliver technical support, and ensure security and compliance.

Use of AI: The Platform may use AI technologies to analyze institutional performance data and extract patterns to offer optimization recommendations. This processing does not make automated decisions with material legal impacts without notifying the user and allowing human review.

6. Data Sharing & Disclosure

We never sell personal data. Sharing only occurs with:

  • Service Providers: Secure cloud providers and infrastructure services governed by DPAs.
  • External Consultants: Handled entirely through permission levels set and managed by the client entity.
  • Legal Compliance: Responding to requests from Saudi authorities in accordance with applicable systems.

7. Security Safeguards & Measures

We implement strict administrative and technical measures to protect personal data:

Technical Measures:

TLS 1.3 encryption for data in transit, AES-256 encryption for data at rest, Row-Level Security (RLS) data isolation, and Multi-Factor Authentication (MFA).

Organizational Measures:

Role-Based Access Control (RBAC), regular vulnerability scans and third-party audits, minimum permission access, and active incident response plans.

8. Data Subject Rights

In accordance with Saudi PDPL, you hold the following rights:

  • Right to know and access the personal data we process.
  • Right to request rectification or updating of inaccurate data.
  • Right to request deletion of data when processing purposes expire.
  • Right to portability, consent withdrawal, and objecting to specific processing.

Response timeline: 30 days maximum.

9. Data Retention & Cross-Border Transfers

Active account data is stored throughout the subscription. Project and assessment data is held for up to 12 months after account closure to facilitate retrieval before complete, irreversible deletion.

Data Transfers: All cross-border transfers align strictly with SDAIA guidelines to ensure equivalent data protection levels governed by binding DPAs.

What would your score be today?

Bring one assessment or one process. We walk your team through it on your own framework.

Book a Demo
Book a Demo