Governing law: Kingdom of Saudi Arabia law, including the Personal Data Protection Law (PDPL) and its regulations. Forum: the competent courts of Riyadh.
Board Arabia Privacy Notice
Effective date: 7 October 2026
1. Who we are
Board Arabia is the operator of the Platform, registered address: To be confirmed ("we", "us"). Board Arabia is the controller of the personal data described in this notice.
Privacy contact: contact@boardarabia.com.
Data protection officer: To be confirmed.
2. What this notice covers
This notice covers boardarabia.com, the members' platform, our emails, and our majlis and events (together, the "Platform").
It explains what personal data we collect, why, who receives it, where it is processed, how long we keep it, and your rights under the PDPL.
The Platform is for professionals aged 18 or over. We do not knowingly collect data about children.
3. What we collect
Account data. If you open an account to be considered: your name, work email, role, region, sign-in credentials, and the link that brought you to the site.
Application and member data: name, email, LinkedIn profile, title, company, turnover or assets under management band, optional phone, commercial registration number, sector tags, your statement, first-touch campaign values and referrer host. Staff notes on your application and our decision.
Directory profile. If you are admitted, your directory profile shows your name, title, company, sector tags and statement, and any other fields you choose to show. We do not show your email, phone or turnover or assets band in the directory.
Introductions and admin. Intro requests you send and receive, whether they are accepted or declined, and messages to and from "Ask admin".
Intro funnel and "Deal started". Staff can see how introductions progress, for example requested, accepted and met. Staff can record that a deal has started between members. This is an internal record.
Suggested introductions and nudges. When these features launch, we will use your profile, sector tags and activity to suggest members to meet and to remind you to meet. See section 13.
Mandates and deal rooms. Mandates you post or unlock, deal rooms you open or join, the files you share in them and who has access.
Majlis and events. Your RSVPs, attendance and any dietary or access needs you choose to tell us.
AI tools. Files you upload to AI tools, such as decks for AI due diligence, and the output produced. You confirm before upload that files contain no inside information.
Partners and payments. Partnership package, intro credits and other allowances used, invoices and payment records. We do not take card details on the public pages.
Communications. Emails we send you, whether they are delivered, and your replies.
Public totals. If you leave the public-totals box checked, a verified capacity figure can be added into a platform total after you are admitted. The public site shows the total only. It does not show your name, company or amount.
Site analytics. Pages viewed, engaged time, scroll depth, coarse location taken from an IP address that is not stored, campaign source and named events. See section 8.
Partner interest. We store the name, firm, category and note you send so our admin team can review it. We never ask for an email or phone. Only admin can read it.
Newsletter measurement. If you agree to receive our newsletter, we measure whether it is opened and which links are clicked, using a small image and tracked links in the email. We do this only with your consent and only to produce aggregate statistics, such as open and click rates. We do not show staff or other members who opened or clicked. Opens are approximate, because some mail apps download images automatically. You can stop measurement or the newsletter at any time in Your privacy. Unsubscribe clicks are not included in these statistics.
4. Why we use it and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Open and run your account, verify your email | Account data | Steps before a contract, at your request |
| Assess your application and decide on admission | Application data | Steps before a contract, at your request |
| Run membership: directory, introductions, admin, mandates, deal rooms, majlis | Member data, profile, intro, mandate, deal room and event data | Performance of our contract with you |
| Share contact details after an intro is accepted | Name, email, phone if given | Performance of our contract, at your request |
| Intro funnel and "Deal started" tagging to measure and improve the Platform | Intro and activity data | Legitimate interest in running and improving the Platform |
| Suggested introductions and nudges | Profile, sector tags, activity | Performance of our contract, or legitimate interest. You can opt out. |
| AI tools, including AI due diligence | Uploads and output | Performance of our contract, with your consent to the tool notice |
| Service emails and reminders, including the 90-day reminder | Contact and account data | Performance of our contract or steps before a contract |
| Fees, invoices, tax records | Partner and payment data | Performance of our contract and legal obligation |
| Public totals | Verified capacity figure, as a sum only | Consent (the public-totals box) |
| Analytics cookies and tracking after you choose Accept | Analytics data | Consent |
| Anonymous visit counts before you choose | Aggregate counts, no identifier | Legitimate interest |
| Security, fraud prevention and enforcing our Terms | Account and activity data | Legitimate interest |
| Meeting legal duties and requests from authorities | Any relevant data | Legal obligation |
We do not use sensitive data. Please do not send it to us.
We do not sell personal data.
5. Who receives it
Other members and partners. Signed-in members can see directory profiles. A partner sees a member's card only if that member chooses to show it. Contact details are shared only with the two parties, and only after an intro is accepted. Members you add to a deal room can see what is shared there. Members can see mandate details once unlocked.
Event hosts and attendees. Your name and company may be shared with the event host, which may be a partner. They may also be shared with other attendees where the event page says so.
Our staff, on a need-to-know basis.
Our processors, who act only on our instructions under a written data processing agreement:
- (a)Supabase, which hosts account, application and member data in Frankfurt, Germany (eu-central-1);
- (b)PostHog, through PostHog Cloud EU in Frankfurt, Germany, for site analytics;
- (c)To be confirmed, for AI tools; and
- (d)our email service provider, for sending emails.
A member who receives your contact details after an accepted intro handles them under their own responsibility and the PDPL.
Authorities, courts and advisers, where the law requires or to protect our legal rights.
A buyer or successor of the Platform, under the same protections, with notice to you.
6. Emails
We contact you by email about your account, application, membership, introductions and events, and to send reminders. These emails are part of the service.
Some reminders are sent from To be confirmed, an address we use to send service emails for Board Arabia. If you are unsure whether an email is from us, contact contact@boardarabia.com.
We send marketing emails only where the law allows, and you can unsubscribe at any time.
7. Where your data is processed
Account, application and member data and site analytics are stored and processed in Frankfurt, Germany, in the European Union. AI uploads are processed by To be confirmed at its hosting location.
These are transfers outside the Kingdom. We make them only as the PDPL allows:
- (a)if the destination is on the adequacy list published by the Saudi Data and AI Authority (SDAIA), we rely on that; or
- (b)if it is not, we use SDAIA standard contractual clauses with each processor and keep a written transfer risk assessment.
We transfer only the data needed for the purpose. Analytics use an internal identifier only, not your name or email.
8. Cookies and analytics
Before you choose. We count visits without cookies, local storage or any identifier that could link one visit to the next. Your IP address is used only for a moment to work out a coarse location and is not stored.
If you choose Accept. We set analytics cookies through PostHog Cloud EU (Frankfurt) to measure pages viewed, engaged time, scroll depth, campaign source and named events. If you are signed in, analytics may be linked to your internal account identifier, not your name or email.
If you choose Reject. We keep counting anonymously as in 8.1 only.
Essential storage. We use cookies or local storage needed to sign you in, keep you secure and remember your consent choice. These do not need consent.
Changing your choice. You can change your choice at any time using the cookie link in the site footer. Reject is as easy as Accept. We log your choice with its time and banner version. When the banner version changes, we ask you again.
We keep analytics events for 13 months at most and then delete or aggregate them.
9. How long we keep it
We delete data automatically on a schedule. Where we anonymise instead, the data no longer identifies you.
| Data | How long we keep it |
|---|---|
| Sign-up that never confirms its email | Deleted after 7 days |
| Account opened for consideration that never submits a membership request | Deleted at 120 days. One reminder is sent at 90 days |
| Rejected, declined, withdrawn or closed applications, and legacy applications | Deleted 12 months after the decision |
| Member data, including profile, intros, "Deal started" tags, mandates and event records | The profile, directory listing, introductions, notifications and event replies are removed when you delete your account. Contact details already shared with another member through an accepted introduction cannot be recalled from that member. The sign-in is anonymised, not deleted. Consent logs are kept for up to 13 months from when they were recorded, with the user reference removed unless a legal hold applies (for example, a dispute, a regulator's request or a legal obligation). Deal room files you uploaded are not removed when you delete your account. They are removed on request to contact@boardarabia.com, and in any case within 24 months of exit. AI tool uploads and their stored files are not removed when you delete your account. They are removed on request to contact@boardarabia.com, and in any case within 24 months of exit. Deleted records are not kept in backup copies. Anything still held is removed on request to contact@boardarabia.com, and in any case within 24 months of exit, unless a legal hold applies. |
| AI tool uploads and their output | Deleted after 30 days. You can delete them earlier at any time |
| Deal room files | Retained while your account is active; you can delete at any time |
| Invoices and payment records | For the period Saudi law requires. |
| Analytics events | 13 months at most |
| Consent log | 13 months |
| Marketing stats cache | 24 hours |
| Newsletter open and click records | Removed on request to contact@boardarabia.com, and in any case within 13 months |
We may keep data longer if the law requires it, or for an actual or expected legal claim (a legal hold). We delete it when the hold ends.
From Your privacy, any member can delete their account, including a full membership, after confirming with a one-time code. This removes the profile, directory card, directory listing, introductions, notifications and event replies. Contact details already shared with another member through an accepted introduction cannot be recalled from that member. The member sign-in is anonymised, not deleted. Consent logs are kept for up to 13 months from when they were recorded, with the user reference removed, unless a legal hold applies (for example, a dispute, a regulator's request or a legal obligation). The application record is kept with personal details replaced and the user reference removed. Under a legal hold, the application record is kept unchanged until the hold ends. Deal room files you uploaded are not removed when you delete your account. They are removed on request to contact@boardarabia.com, and in any case within 24 months of exit. AI tool uploads and their stored files are not removed when you delete your account. They are removed on request to contact@boardarabia.com, and in any case within 24 months of exit. Invoices and payment records are kept for the period Saudi law requires. Deleted records are not kept in backup copies. An account that has not become a member still has its sign-in deleted.
10. Security
We protect personal data with technical and organisational measures, including access controls, encryption in transit and restricted staff access. Turnover and assets bands are restricted to staff who need them and are never sent to analytics.
No system is completely secure. If a data breach is likely to harm you, we will notify you and SDAIA as the PDPL requires.
11. Your rights
Under the PDPL you have the right to:
- (a)be informed about how we process your data;
- (b)access your data;
- (c)obtain a copy of your data in a readable format;
- (d)ask us to correct, complete or update it;
- (e)ask us to destroy data we no longer need; and
- (f)withdraw your consent at any time, without affecting processing already done.
To use these rights, write to contact@boardarabia.com or To be confirmed. We may ask you to confirm your identity. We will reply within the period the PDPL sets.
Some rights have limits, for example where we must keep data by law.
12. Complaints
Please contact us first so we can try to resolve your concern.
You can also complain to the Saudi Data and AI Authority (SDAIA).
13. Automated suggestions
Suggested introductions and nudges are produced automatically from your profile and activity. They are suggestions only. They do not make decisions about you that have legal or similar effects.
Admission decisions are always made by our staff.
You can turn off suggestions and nudges in your settings or by contacting us.
14. Anonymous and aggregate data
We may use anonymised or aggregate data, such as totals on the public site, that does not identify you.
15. Changes to this notice
When this notice changes, we update the effective date on this page. For material changes, we tell you by email or on the Platform.
If a change affects cookies, a new banner version asks you to choose again.
16. Language
This notice is published in English. The English version is authoritative.