Privacy policy

Last updated: 5 October 2026

Draft pending legal review. This policy is a working draft prepared for review by qualified legal counsel. It is not final and may change before publication. Items marked [CONTENT REQUIRED: …] must be completed and verified.

This privacy policy explains how Selorin Environmental Advisory & Services (“Selorin”, “we”, “us”) collects, uses, shares and protects personal data when you visit https://selorin.co (the “website”) or contact us through it. It applies to the English and Arabic versions of the website.

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, and other applicable laws of the Kingdom of Saudi Arabia.

1. Who we are

The controller responsible for personal data collected through the website is:

Legal entity: [CONTENT REQUIRED: registered legal name of the entity]
Commercial Registration (CR) number: [CONTENT REQUIRED: CR number]
Registered address: [CONTENT REQUIRED: registered address]
Email: sales@selorin.co
Phone: +966 53 430 2332
Data protection contact: [CONTENT REQUIRED: name or role and contact details of the data protection officer or privacy contact]

2. Personal data we collect

Information you provide through our forms

When you submit a service request or contact form, we collect:

Your name and company name
Email address and phone number
Location or city
The service you are interested in and the project details you describe
Any attachments you choose to upload (PDF, Microsoft Office files, images, or ZIP/KMZ files, up to 10 MB in total)
Your preferred contact method
Your consent confirmation

Please include in your message and attachments only the information we need to respond to your enquiry. Avoid sending sensitive personal data, or personal data about other people, unless it is necessary and you are entitled to share it.

Technical information collected with a form submission

When a form is submitted, we also record:

The page from which the form was submitted
Campaign (UTM) parameters in the page address, where present
The date and time of submission
Your IP address, which is used to prevent spam and to limit repeated submissions

If you accept analytics cookies, Google Analytics 4 collects information about how you use the website, such as pages viewed, approximate location derived from your IP address, device and browser type, and referring source. See our cookie policy for details.

3. How and why we use personal data

Purpose	Data used	Basis for processing
Responding to your enquiry or service request, preparing proposals and following up	Form details and attachments	Your consent and steps taken at your request before entering into a contract [CONTENT REQUIRED: legal review of the processing basis]
Keeping a record of enquiries for follow-up and customer relationship management	Minimal lead record (without attachments)	Your consent / our legitimate interest in managing business enquiries [CONTENT REQUIRED: legal review of the processing basis]
Protecting the website and our forms against spam, abuse and automated submissions	IP address, Cloudflare Turnstile verification result, hidden spam-detection field, submission time	Our legitimate interest in keeping the website secure [CONTENT REQUIRED: legal review of the processing basis]
Understanding which pages and campaigns bring enquiries	Source page, UTM parameters	Our legitimate interest in improving the website [CONTENT REQUIRED: legal review of the processing basis]
Measuring website usage	Analytics data	Your consent, which you can withdraw at any time
Complying with legal obligations and responding to lawful requests from competent authorities	Data as required	Legal obligation

We do not sell personal data, and we do not use form submissions for automated decision-making that has legal or similarly significant effects on you.

4. How form submissions are handled

When you submit a form, it is processed by a serverless function running on our hosting infrastructure.
The function checks the submission against our spam protections (Cloudflare Turnstile and a hidden “honeypot” field) and applies rate limiting based on your IP address.
The submission, including any attachments, is sent by email to Selorin’s sales team through a transactional email provider.
A minimal lead record, without attachments, is stored so that we can follow up on your enquiry and, where applicable, transfer it to our customer relationship management (CRM) system.
Attachments are forwarded by email only. They are not stored on the website.

We share personal data only with service providers that process it on our behalf and under our instructions, and only to the extent needed for the purposes above:

Cloudflare — website hosting, content delivery network (CDN), serverless processing of form submissions, and spam protection (Cloudflare Turnstile)
Google — Google Tag Manager and Google Analytics 4, loaded only after you consent to analytics
Transactional email provider — delivery of form submissions to our sales team: [CONTENT REQUIRED: name of the transactional email provider]
Lead storage and CRM — storage of the minimal lead record and CRM integration: [CONTENT REQUIRED: name(s) of the lead storage and CRM provider(s)]
Email hosting — the mailbox that receives submissions: [CONTENT REQUIRED: name of the email hosting provider]

We may also disclose personal data where required by law, by a court order, or by a competent government authority, or where necessary to establish, exercise or defend legal claims.

[CONTENT REQUIRED: complete and verified list of processors and sub-processors]

6. Transfers outside the Kingdom

Some of our service providers may process personal data outside the Kingdom of Saudi Arabia. Where this happens, we transfer personal data only in accordance with the requirements of the PDPL and its regulations on cross-border transfers, and we take appropriate measures to protect it.

[CONTENT REQUIRED: countries or regions where data is processed, and the transfer mechanism or safeguards relied on]

7. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this policy, or as required by law:

Lead records and form submissions: [CONTENT REQUIRED: retention period]
Emails containing submissions and attachments: [CONTENT REQUIRED: retention period]
Spam-prevention and rate-limiting data (including IP addresses): [CONTENT REQUIRED: retention period]
Analytics data: [CONTENT REQUIRED: Google Analytics 4 data retention setting]

When personal data is no longer needed, we delete it or anonymise it securely.

8. How we protect personal data

We apply technical and organisational measures appropriate to the nature of the data, including encrypted (HTTPS) connections, spam and abuse protection on our forms, limiting access to submissions to the staff who need it, and not storing attachments on the website. No method of transmission or storage is completely secure, but we work to protect personal data against unauthorised access, loss, alteration or disclosure.

9. Your rights

Subject to the conditions set out in the PDPL and its regulations, you have the right to:

Be informed about how and why your personal data is collected and processed
Access your personal data held by us and obtain a copy of it
Correct personal data that is inaccurate, incomplete or out of date
Request deletion of personal data that is no longer needed, subject to any legal obligation to retain it
Withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before it.

To exercise any of these rights, contact us at sales@selorin.co or [CONTENT REQUIRED: data protection contact email]. We may need to verify your identity before acting on your request. We will respond within the period required by law.

You can withdraw consent to analytics cookies at any time through the cookie settings on the website.

If you are not satisfied with our response, you may lodge a complaint with the competent authority, the Saudi Data & AI Authority (SDAIA). [CONTENT REQUIRED: confirm the competent authority and complaint channel]

10. Children

The website is intended for business users. It is not directed at children, and we do not knowingly collect personal data from children.

11. Links to other websites

The website may contain links to third-party websites. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. Where changes are significant, we will take reasonable steps to bring them to your attention.

13. Contact us

For questions about this policy or about how we handle personal data:

Email: sales@selorin.co
Phone: +966 53 430 2332
Data protection contact: [CONTENT REQUIRED: DPO or privacy contact details]
Address: [CONTENT REQUIRED: registered address]