1. Who we are and what this policy covers
IBEA Co. for Information Technology ("IBEA", "we", "us") protects the personal data of everyone who uses our website and services, in line with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.
This policy explains what personal data we collect, why we use it, who we share it with and the rights you have. It applies to:
- our website, www.ibea.com
- the IBEA Dynamic Payments Portal, including registration at register.ibea.com
- demo bookings, sales calls, webinars (including the IBEA Executive Series), events, emails and support
IBEA is the controller of the personal data described here. IBEA Co. for Information Technology is a limited liability company registered in Riyadh under Commercial Registration No. 1009021311 (Unified No. 7038976044), with its national address at Building 2340, Juaithin Al Yazidi Street, Irqah District, Additional No. 6057, Riyadh 12587, Kingdom of Saudi Arabia.
When a business uses IBEA to pay or receive payments, it may give us data about its own staff, buyers or suppliers. For that data we act on the business's instructions, and the business's own privacy notice also applies.
2. The personal data we collect
We collect only the data we need for the purposes in section 3. Fields marked as required on our forms are needed to provide the service; all others are optional.
- Contact and identity
Examples: Name, job title, company, work email, phone number
How we get it: You give it in forms, demo bookings, registration and emails - Account and business
Examples: Login details, company profile, commercial registration and VAT number, program settings
How we get it: You or your company give it when setting up a Dynamic Payments Portal account - Payment and invoice
Examples: Invoice details, payment amounts and dates, bank account details for payouts
How we get it: You, your company or your trading partners give it when using the portal - Communications
Examples: Messages, call notes, support requests, survey answers, webinar and event registrations
How we get it: You give it when you contact or meet us - Technical and usage
Examples: IP address, device and browser type, pages viewed, clicks, referring site, approximate location
How we get it: Collected automatically through cookies and similar tools (section 6) - From third parties
Examples: Business contact details, company information, verification checks
How we get it: Our partners, event co-hosts, LinkedIn and other public business sources, and identity or company verification providers
We do not ask for sensitive data, such as health or religious information, through our website. Please do not send it to us.
3. How we use your data and why
We use personal data only for the purposes below, each with a legal basis under the PDPL.
- Create and run your Dynamic Payments Portal account, process invoices and payments
Legal basis: Performing our agreement with you or your company - Answer enquiries, book demos and sales calls, and provide support
Legal basis: Your consent, or steps you ask us to take before an agreement - Verify companies and prevent fraud, money laundering and misuse
Legal basis: Legal obligations and our legitimate interests - Send newsletters, event and webinar invitations and product news
Legal basis: Your consent, which you can withdraw at any time (section 9) - Run webinars and events, including the IBEA Executive Series
Legal basis: Your consent when you register - Improve our website, portal and services, and measure our marketing
Legal basis: Your consent for non-essential cookies; our legitimate interests for anonymous statistics - Keep records and meet tax, accounting and regulatory duties
Legal basis: Legal obligations
We rely on legitimate interests only where they do not override your rights and interests, and never for sensitive data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
We do not sell your personal data. We share it only as follows, and only as much as each party needs:
- Payment and banking partners, such as licensed payment processors, card schemes and banks, to process payments and payouts you request.
- Your trading partners on the portal (for example, a buyer and its suppliers) to the extent needed to settle invoices.
- Service providers that work for us under contract, such as cloud hosting, CRM and email, webinar, analytics and customer support tools. They may use the data only on our instructions.
- Event and webinar co-hosts, when you register for an event we run with them; the registration form names them.
- Professional advisers, such as auditors and lawyers, under confidentiality duties.
- Authorities, when Saudi law, a court or a regulator requires it.
- A buyer or successor, if IBEA is involved in a merger, acquisition or sale of assets, under the same protections as this policy.
5. Transfers outside Saudi Arabia
We store and process personal data in the Kingdom wherever possible. Some service providers, such as cloud, email or webinar tools, may process data outside the Kingdom.
When that happens, we transfer only what is needed and follow the PDPL and its transfer regulations: we use an approved safeguard such as SDAIA standard contractual clauses, or another basis the regulations allow, and we assess the risks first. You can ask us for details of these safeguards (section 11).
6. Cookies and similar technologies
Our website uses cookies and similar tools. Essential cookies keep the site and portal working and secure, and are always on. Analytics and marketing cookies, which help us understand how the site is used and measure our campaigns, are used only if you accept them in our cookie banner.
You can change your choice at any time through the cookie settings link in our website footer or in your browser settings. Blocking essential cookies may stop parts of the site or portal from working.
7. How long we keep it and how we protect it
We keep personal data for one month after the purpose it was collected for ends, for example after your account is closed, your enquiry is resolved or you unsubscribe. We then delete it or make it anonymous. The only exception is records Saudi law requires us to keep longer, such as tax and accounting records; we keep those only for the period the law sets and use them for nothing else.
We protect data with encryption in transit and at rest, access controls, staff confidentiality duties, regular security testing and contracts with every provider that handles it. If a breach is likely to harm you, we will notify SDAIA within 72 hours of becoming aware of it and tell you without undue delay, with the steps to protect yourself.
8. Your rights
Under the PDPL you have the right to:
- Be informed about how and why we process your personal data, as set out in this policy.
- Access your personal data and receive a copy in a clear, readable format.
- Correct data that is inaccurate, incomplete or out of date.
- Have it destroyed when we no longer need it, unless the law requires us to keep it.
- Withdraw consent at any time, without affecting processing already done.
To use any right, email hello@ibea.com from the address we hold for you, or write to us at the address in section 11. We may ask you to confirm your identity. We reply within 30 days; if a request needs unusual effort, we may extend this by another 30 days and will tell you why.
If you are not satisfied with our response, you can complain to the Saudi Data & AI Authority (SDAIA), which supervises the PDPL.
9. Marketing emails
We send newsletters, webinar and event invitations only with your consent. Every email has an unsubscribe link, or you can email hello@ibea.com. Service messages about your account, such as payment notices, will still reach you.
10. Children
Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect their data; if we learn we have, we will delete it.
11. Changes and contact
We may update this policy as our services or the law change, including any amendments to the PDPL implementing regulations. We will post the new version here with a new "Last updated" date and tell registered users of significant changes by email.
For questions or to use your rights, contact us:
- Email: hello@ibea.com
- Phone: +966 11 520 2880
- Post: IBEA Co. for Information Technology, Building 2340, Juaithin Al Yazidi Street, Irqah District, Additional No. 6057, Riyadh 12587, Kingdom of Saudi Arabia
- Commercial Registration No.: 1009021311