Privacy Policy

Effective Date: January 1, 2026 

By accessing our website, engaging with our services, or submitting your information to us, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires your explicit consent for the processing of your personal data, we will obtain it independently. Otherwise, your continued interaction with OmniOps constitutes your acknowledgment of the data practices described herein. 

1. Introduction 

OmniOps ("we," "us," or "our") is committed to protecting the privacy and sovereignty of personal data. As Saudi Arabia’s leading ai infra technology provider. We adhere to the highest standards of data protection, strictly complying with the Personal Data Protection Law (PDPL) enacted by Royal Decree M/19, the regulations of the National Data Management Office (NDMO), and the controls of the National Cybersecurity Authority (NCA). 

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website (omniops.sa). 

2. Scope and Application 

This policy applies to: 

• Website Visitors: Individuals navigating our digital platforms. 

• Business Partners & Clients: Representatives of entities engaging with our sovereign cloud and AI services. 

• Job Applicants: Candidates applying for roles via our Careers portal. 

Note: For clients using our products (e.g., Bunyan, Rekaz) to process their own data, OmniOps acts as a Data Processor. In such cases, the client’s own privacy policy governs the data, and our processing is defined by a separate Data Processing Agreement (DPA). 

3. Data We Collect 

We may process the following categories of personal data that you provide to us directly, that are generated through your use of our Website or Services, or that we receive from third-party services or publicly available sources: 

• Contact Data (i.e. information used to identify and contact you, such as name, email address, phone number, country or place of residence); 

• Communication Data (i.e. information contained in communications with us, such as emails, chat messages, support requests, feedback, or other content you voluntarily provide when contacting us or using our Website or Services); 

• Account and Usage Data (i.e. information relating to your account, workspace, subscription and use of the Services, such as pseudonymized User and workspace identifiers, account settings, authentication events, workflow usage metrics, enabled integrations, and billing information); 

• Marketing Data (i.e. information relating to marketing communications and interactions, such as contact preferences, newsletter subscriptions, email engagement, and registrations for events, webinars or product updates); 

• Traffic and Device Data (i.e. technical information generated when you access or use the Website or Services, such as IP address, device and browser type, operating system, language settings, access times, cookie identifiers, and usage or interaction data). 

4. Legal Basis & Purpose of Processing 

We process personal data in accordance with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL). 

As a general principle, personal data is processed based on the data subject’s consent, unless another lawful basis applies. 

Depending on the nature of the service and interaction, we may process personal data under the following legal grounds: 

Consent 

Where individuals voluntarily provide their information for specific purposes, such as receiving updates, requesting demos, or engaging with our services. Consent can be withdrawn at any time.

Contractual Necessity 

Where processing is required to provide requested services, including consultations, platform access, or technical support. 

Legal Obligation 

Where processing is necessary to comply with applicable laws and regulatory requirements within the Kingdom. 

Legitimate Interest 

Where processing is required to support our operational integrity, including maintaining platform security, preventing fraud, and ensuring service reliability, provided such processing does not override the rights of the data subject and does not involve sensitive personal data. 

5. Data Sovereignty and Storage 

Protecting data within the Kingdom is a core part of our platform design. 

Platform & Customer Data 

Data processed through OmniOps platforms is hosted within the Kingdom of Saudi Arabia, leveraging Tier 3/4 infrastructure aligned with local regulatory requirements. 

Website & Engagement Data 

Information submitted through our website (e.g., contact forms) may be processed using global service providers, which involve storage inside and outside the Kingdom. In such cases, transfers are conducted in accordance with the Saudi Personal Data Protection Law (PDPL), ensuring appropriate safeguards and protection measures are in place. 

6. Data Sharing and Disclosure 

We do not sell your data. We only share data in the following strictly controlled scenarios: 

• Trusted Processors: With vetted service providers bound by strict confidentiality and security obligations. 

• Legal Authorities: When required by Saudi law or to protect national security, in accordance with requests from competent authorities. 

• Affiliates: With OmniOps entities solely for administrative and support purposes, ensuring consistent security standards. 

7. Cybersecurity Measures 

We implement defense-in-depth security measures aligned with the NCA Essential Cybersecurity Controls (ECC): 

• Encryption: Data is encrypted at rest and in transit using industry-standard protocols. 

• Access Control: Strict Role-Based Access Control (RBAC) ensures only authorized personnel access personal data. 

• Monitoring: Continuous SOC monitoring to detect and neutralize threats. 

• Air-Gapping: For specific client deployments, we utilize air-gapped infrastructure that is physically isolated from the public internet. 

8. Your Rights Under PDPL 

As a data subject in Saudi Arabia, you have the following rights: 

1. Right to Be Informed: To know how we process your data (this policy). 

2. Right to Access: To request a copy of your personal data held by us. 

3. Right to Correction: To request updates to inaccurate or incomplete data. 

4. Right to Destruction: To request the deletion of your data when it is no longer needed.

5. Right to Withdraw Consent: To opt-out of marketing communications at any time. 

To exercise these rights, please contact our Data Protection Officer (DPO) at: [privacy@omniops.sa] 

9. Cookies and Tracking 

We use essential cookies to ensure our website functions securely. We may use analytical cookies to improve user experience, but only with your consent. You can manage your cookie preferences through your browser settings. 

10. Updates to This Policy 

We may update this policy to reflect changes in Saudi law or our operational practices. The latest version will always be available on this page. Significant changes will be communicated via email or a prominent notice on our website. 

Contact Us 

For any privacy-related inquiries or to exercise your rights: 

• Email: privacy@omniops.sa 

• Address: OmniOps HQ, Riyadh, Kingdom of Saudi Arabia.