SECTION 01
1. Compliance & Legal Framework
Altapete Solutions ("Altapete", "we", "us", or "our") operates as a premier digital transformation, enterprise ERP implementation, and regulatory compliance consulting firm headquartered in Riyadh, Kingdom of Saudi Arabia.
This Privacy Policy governs our collection, processing, storage, and protection of information obtained through our official digital touchpoints (including altapetesolutions.com), client advisory portals, ERP deployment sandboxes, and offline enterprise consultations. We operate in strict alignment with:
- The Saudi Personal Data Protection Law (PDPL) enacted under Royal Decree No. (M/19) and associated Executive Regulations.
- National Data Management Office (NDMO) guidelines for cybersecurity and data classification across government and private sectors.
- Zakat, Tax and Customs Authority (ZATCA) cryptographic standards governing Phase 2 e-invoicing data integrity.
- Global Data Protection Regulation (GDPR) principles where European Union citizens or entities engage with our services.
SECTION 02
2. Information We Collect
We collect only the minimum necessary data required to deliver high-integrity enterprise consulting, architectural design, and software integration services:
Business & Engagement Contacts
Full name, corporate email address, corporate telephone number, job title, entity legal name, and commercial jurisdiction.
Project Parameters & RFPs
Target ERP requirements (Oracle Fusion, Odoo, SAP), current software stack details, user tier count estimates, and projected implementation scopes.
System & Integration Telemetry
Server endpoint configurations, test payloads used during sandbox ERP staging, and technical communication logs.
Regulatory Staging Datasets
Mock tax identifiers, test UUID hashes, and cryptographic test certificates generated during ZATCA sandbox simulations.
SECTION 03
3. Processing & Usage of Enterprise Data
All client information is utilized exclusively for legitimate business and engineering purposes:
- Engineering and executing bespoke ERP migration roadmaps and software integration architecture.
- Conducting official feasibility studies, ZATCA Phase 2 compliance audits, and tax advisory reviews.
- Providing round-the-clock enterprise technical support and hypercare SLA management.
- Fulfilling statutory obligations mandated by the Ministry of Commerce, ZATCA, SAMA, and MISA.
Zero Monetization Policy: Altapete Solutions does not sell, rent, monetize, or lease your corporate datasets, technical blueprints, or personal employee data to any third-party advertisers, data aggregators, or unauthorized third parties.
SECTION 04
4. NDA & Strict Confidentiality Protocols
Enterprise trust is the cornerstone of our business. Before accessing any sensitive client schema, corporate ledger, or database environment, Altapete executes a comprehensive, legally binding Mutual Non-Disclosure Agreement (MNDA).
All senior enterprise architects, software engineers, and advisory consultants assigned to client accounts are bound by stringent confidentiality covenants. Client source code, database credentials, and commercial ledgers remain strictly compartmentalized behind role-based access control (RBAC) protocols.
SECTION 05
5. Data Residency & Cross-Border Transfers
In compliance with Saudi Arabia's National Cybersecurity Authority (NCA) and PDPL data residency mandates:
- Domestic Data Sovereignty: Primary production datasets, client ERP instances, and ZATCA compliance logs for Saudi entities are hosted on certified KSA-compliant data centers (e.g., Oracle Cloud Riyadh/Jeddah, AWS Bahrain/UAE, or sovereign client private clouds).
- Cross-Border Safeguards: Any technical review involving our global delivery centers (Pakistan or UAE) is conducted over encrypted, isolated virtual private networks (VPNs) with zero permanent local data replication.
SECTION 06
6. Your Rights Under KSA PDPL
Under the Saudi Personal Data Protection Law, authorized enterprise representatives have specific rights concerning their corporate contact and personal data:
- Right to be Informed: To know how your data is collected, its legal basis, and intended processing methods.
- Right of Access & Portability: To request a comprehensive copy of your stored records in a standardized format.
- Right of Rectification: To request immediate correction or updating of any inaccurate or outdated information.
- Right of Destruction: To request total purging of project records following contract expiration, subject to statutory retention laws.
SECTION 07
7. Security Architecture & Encryption Standards
We enforce defense-in-depth technical safeguards to preserve the confidentiality, integrity, and availability of all data assets:
AES-256 Data Encryption
TLS 1.3 in Transit
MFA on All Engineering Hubs
Zero-Trust Infrastructure
Continuous Penetration Testing
SECTION 08
8. Data Protection Officer (DPO) Inquiries
For any questions regarding our compliance practices, to exercise your PDPL statutory rights, or to submit vendor risk questionnaires, please contact our designated Data Protection Officer:
