Protecting your data is our responsibility

How we collect, use, and protect your data when you use SMMI and the albishi.net platform.

1. Who we are (data controller)

SMMI is the Saudi Marketing Maturity Index, a strategic diagnostic tool offered by Ismail Albishi (founder of albishi.net).

The data controller under this policy is: Ismail Albishi, via the albishi.net platform.

Privacy contact: privacy@albishi.net.

2. Data we collect

We collect the following when you submit the contact form or complete an SMMI assessment:

• Professional identity: full name, email address (personal or work), organization name, job title.
• Optional fields: LinkedIn URL, phone number (if you provide one).
• Assessment answers: your responses to the six SMMI maturity dimensions.
• Context data: sector, language, organization demographics (size, type, objectives).
• Technical data: traffic source (UTM), landing page, referrer, timestamp, session identifier.
• Consents: a record of the three consent decisions (processing, benchmark, follow-up).

We do not collect sensitive data such as religion, ethnicity, or health. We do not use tracking cookies beyond aggregated, anonymized analytics (Google Analytics and Microsoft Clarity).

3. Purposes of processing

• Diagnostic: generate a personalized marketing maturity report based on your answers.
• Communication: send your results and respond to inquiries (subject to your follow-up consent).
• Benchmark research: aggregate anonymized data to build a Saudi market benchmark (subject to your separate benchmark consent).
• Product improvement: aggregate-only analytics to improve the questions and content.

4. Legal basis

Our processing relies on your explicit consent under Article 6 of the PDPL. No data is processed before you tick the mandatory processing-consent checkbox in the form. The two additional consents (benchmark and follow-up) are optional and independent.

5. Retention

• Contact data and assessment results: 24 months from your last interaction, then deleted or permanently anonymized.
• Anonymized benchmark data: retained indefinitely because it does not identify you.
• Consent records: kept for the retention period as legal evidence.

You can request immediate deletion at any time (see section 8).

6. Sharing with third parties

We do not sell your data. We do not share it with anyone for marketing. We use a small number of service providers for purely technical purposes:

• Google (Workspace, Apps Script, Sheets): form database storage (within Google Cloud).
• Telegram: internal notifications to the founder when a qualified inquiry arrives (contains name, email, title; does not include full assessment answers).
• Google Analytics + Microsoft Clarity: anonymized usage statistics for the website.

Each provider is bound by its own privacy policy and is not used for any other purpose.

7. Your rights under PDPL

Saudi law grants you the following rights. You may exercise any of them free of charge within 30 days of your request:

• Right of access: obtain a copy of the data we hold about you.
• Right of correction: correct any inaccurate or incomplete data.
• Right of erasure: request deletion of your data (unless a legal obligation requires retention).
• Right to object: object to specific processing (for example, stop marketing follow-up).
• Withdraw consent: withdraw any of the three consents at any time, without affecting the lawfulness of prior processing.
• Right to portability: obtain your data in a structured format (JSON or CSV) to transfer.

8. How to exercise your rights

Send a request to privacy@albishi.net with:

• The right you wish to exercise.
• Your name and the email you used in the form (for verification).
• Any additional details that help us process your request.

We respond within 30 calendar days. If you believe your request was not handled appropriately, you have the right to file a complaint with the Saudi Data and AI Authority (SDAIA).

9. Data security

• All transmission is over HTTPS with TLS.
• Storage inside Google Cloud with enterprise-grade protection.
• Access restricted to the founder's account only.
• Telegram notifications are sent to a private chat owned by the founder.
• We do not store passwords or financial data.

10. Cross-border data transfer

Your data is processed via Google Cloud servers, which may include transient storage outside the Kingdom of Saudi Arabia. Google complies with global protection standards (ISO 27001, SOC 2). By consenting to processing, you consent to this transfer in line with PDPL requirements.

11. Policy updates

We may update this policy due to regulatory or operational changes. We will notify you of any material update by email to your registered address at least 14 days before it takes effect. The date at the top of the page reflects the latest update.

12. Contact and jurisdiction

This policy is governed by the laws of the Kingdom of Saudi Arabia, in particular the Personal Data Protection Law issued by Royal Decree No. (M/19) and its amendments. Any dispute falls under the jurisdiction of Saudi courts.