1. Policy scope and responsible entity
This policy governs the collection, processing, and protection of personal data when visiting or using Bahareth.org.sa andDyslexia.sa or interacting with their forms, accounts, and related contact channels. Read this policy together with the Terms and Conditions Agreement andFinancial Assistance Notice. Mohammad Bahareth Charitable Company manages the relevant websites and digital channels according to the scope of the service offered.
2. Data handling principles
To the extent required by applicable law, we commit to processing that is lawful, fair, transparent, purpose-specific, and proportionate to need, and to taking reasonable organizational and technical measures to protect data. We do not request data without a clear need and purpose, and we review its retention when that purpose ends or the statutory retention period expires.
3. Data we may collect
The data we process depends on how you interact with the website and may include the following:
| Category | Details and purpose |
|---|---|
| Identification and contact data | Name, email address, telephone number, and organization name when included in your correspondence. |
| Request and correspondence data | The message subject and content, partnership description, and attachments or links the user chooses to share. |
| Technical and operational data | IP address, browser and device type, referring pages, error logs, and anti-abuse logs where available. |
| Consent data | A record of the time and means of consent to terms, privacy provisions, or notices associated with the request. |
| Derived security data | Reasonable technical indicators for detecting spam, automated attempts, or misuse of contact details. |
Please do not send banking information, official identification, detailed health data, or any highly sensitive information through public forms unless we expressly request it through a secure and lawful channel.
4. Data sources and collection methods
- Directly from you when you email us or choose to send a file or link.
- Automatically when you use the website, such as certain technical logs, essential cookies, and performance reports.
- From internal records created when following up your request, documenting your consent, or protecting the website from misuse.
5. Processing purposes
| Category | Details and purpose |
|---|---|
| Request management | Receiving contact, partnership, or volunteering requests, conducting initial checks, and responding where appropriate. |
| Website operation and improvement | Providing pages and forms, measuring aggregate performance, addressing faults, and improving usability. |
| Security and compliance | Preventing fraud and spam, protecting contact details, retaining records when necessary, and meeting legal obligations. |
| Protection of rights and claims | Bringing proceedings or submitting complaints or reports, defending rights, and responding to claims in the event of a violation, harm, or documented threat, within applicable law. |
| Legitimate communication | Sending operational notices or responses directly related to a legitimate request or relationship, rather than selling services or marketing for third parties. |
6. Legal bases for processing
We rely on the appropriate basis for each purpose, including your explicit consent when required, carrying out a request you submit, meeting a legal obligation, or protecting a legitimate right such as website security and the prevention of fraud and misuse of contact details, always within applicable law.
7. Forms and consent records
When you email us about contact, partnership, or volunteering, we may retain the time of correspondence, request data, and consents provided in it. This includes acknowledgment that the communication is legitimate and does not contain requests for donations or financial assistance, offers of paid products or services, or unauthorized marketing referrals. Correspondence does not create a contractual relationship or an obligation to respond, accept, or enter into a partnership.
8. Cookies and similar technologies
We may use cookies and similar technologies to operate the website, save preferences, measure aggregate performance, and improve protection. You can manage some cookies through your browser settings, although disabling essential cookies may affect website functions. We do not use published contact details to create advertising lists or marketing campaigns for third parties.
9. Communication and notices
We may use your data to respond to your request, send an operational or legal notice directly related to your correspondence, or follow up a legitimate request. We do not use this data to sell products or services for third parties, and we do not permit its addition to mailing lists, mass messages, or paid offers without a legal basis and appropriate consent. Where possible, we aim to respond to legitimate inquiries within seven business days.
10. Artificial intelligence, automated extraction, and automated decisions
We do not use your personal data or correspondence to train generative AI models or large language models without an appropriate legal basis and necessary consent where required. The platform also does not make an automated decision with a legal or significant effect on you based solely on your personal data. No party may automatically scrape, index, or extract website data or contact details for training, analysis, or reuse without written permission.
11. Data sharing and service providers
We may share the minimum necessary data with providers of hosting, storage, technical infrastructure, website protection, or request management, subject to appropriate confidentiality and security obligations and use only for the specified purpose. We may disclose data to meet a legal obligation, respond to a lawful request from a competent authority, protect rights, or prevent misuse. We do not sell data or exchange it with marketing entities, and this does not give any party the right to use published contact details to offer or promote its services.
12. Transfer or processing outside the Kingdom
Some hosting, technical support, or protection services may require data to be processed, or technical access to data to be provided, outside the Kingdom. When this occurs, we seek to apply safeguards and procedures required by applicable law, including assessing the need, minimizing data, controlling access permissions, and obtaining any necessary arrangements or approvals as appropriate.
13. Data security and incident reporting
We apply reasonable technical and organizational measures, such as restricting access according to need, using appropriate protection during transmission and storage where available, and monitoring technical indicators of misuse. No electronic method is absolutely secure, but we address potential incidents through appropriate procedures and assess reporting or notification when required by law or the seriousness of the situation.
14. Retention period
We retain data for as long as necessary for its collection purpose, as required by law, or to protect rights, resolve disputes, and prevent misuse. Once the purpose ends, we take reasonable steps to delete, securely destroy, or anonymize data unless longer retention is required by a legal obligation, an ongoing claim, or a legitimate investigation.
15. Sensitive data and minors
We do not request sensitive data through public forms, such as detailed health or financial data or official documents. If you provide such data voluntarily, we may limit its processing, delete it, or request use of a secure channel. If the user is a minor, any communication or request concerning them should be made by their guardian or legal representative in accordance with applicable law.
16. Rights and your choices
Within applicable law, your rights may include:
- Right to be informed: Knowing the basis and purpose of data collection and the entities to which data may be disclosed where appropriate.
- Right of access and copies: Requesting access to your data or a copy in a clear, readable format where applicable.
- Right to correction: Requesting correction or updating of inaccurate or incomplete data.
- Right to destruction: Requesting destruction of data that is no longer necessary, subject to exceptions and statutory retention periods.
- Withdrawal of consent: Withdrawing earlier consent where processing is based on it, without retroactive effect on prior lawful processing or processing based on another ground.
17. External links
The websites may contain links to external websites or platforms. We do not control their privacy practices or content, and your use is subject to their policies and terms. We recommend reviewing each external website’s privacy policy before providing your data.
18. Complaints, inquiries, and policy updates
You may submit a privacy request, inquiry, or complaint through the contact channel below. If we cannot adequately address your request, you may refer it to the competent authority in accordance with applicable law. This policy may be updated when processing practices, legal requirements, or protective measures change; updates take effect on publication. Arabic is authoritative in the event of differences in interpretation.
19. Privacy contact
For privacy requests or to report misuse of contact details, write to us at: Your acknowledgement and its time are recorded when you reveal the details. This does not send a message.
To help verify a request, we may ask for reasonable information to confirm identity and protect data subjects’ information.