Privacy Policy

NovaLexi is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://novalexi.com/ (the "Website"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Website.

Who is responsible for your data. The controller of your personal data is NovaLexi Company, a one-person limited liability company registered in the Kingdom of Saudi Arabia (CR No. 7053584103), with its registered office in Riyadh, Kingdom of Saudi Arabia. Processing is governed primarily by the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, supervised by the Saudi Data & Artificial Intelligence Authority (SDAIA). If you visit us from the European Economic Area or the United Kingdom, we also honour the rights granted by the EU/UK General Data Protection Regulation (GDPR) where it applies, as described in Section 6.2.

Where the NovaLexi platform processes data on behalf of a customer organization, that organization is the controller and NovaLexi acts as a processor under the applicable customer agreement; requests should be routed through your organization's administrator.

1.1 Personal Data

We may collect personal data that you provide directly to us when you use our Website, including but not limited to:

• Contact Information: Name, email address, phone number, and mailing address.
• Account Information: Username, password, and other details necessary for creating an account.
• Transactional Information: Records of services purchased, requested, or otherwise obtained through our Website.
• Communications: Any communication or information you send to us, including customer support inquiries, feedback, and other messages.

1.2 Automatically Collected Data

When you visit our Website, we may automatically collect information about your device and usage, such as:

• Device Information: IP address, browser type, operating system, device type, and device identifiers.
• Usage Data: Information about how you use our Website, including pages viewed, links clicked, and the time and duration of your visits.

1.3 Cookies & Similar Technologies

We use cookies and similar technologies as follows:

• Strictly necessary cookies that make the Website work (e.g., security and session cookies). These do not require consent.
• Analytics and preference cookies that help us understand usage and improve the Website. We use these only with your consent, which you can give or withdraw through the cookie notice on the Website or your browser settings.

We do not use cookies for third-party advertising.

We use your personal data to:

2.1 Provide and Manage Our Services

• To create and manage your account.
• To process transactions and deliver the services you request.
• To communicate with you, including responding to your inquiries and providing customer support.

2.2 Improve and Personalize Your Experience

• To understand how you use our Website and services, allowing us to improve the user experience.
• To tailor the content and resources we offer to match your preferences.

Where AI-assisted features are involved, our AI Policy describes how they work and the safeguards that apply.

2.3 Marketing and Promotional Communications

We send promotional materials and updates about our services only with your prior consent. You can opt out at any time by following the unsubscribe instructions in the message or contacting us directly, and we will honor your request promptly.

2.4 Legal and Regulatory Compliance

• To comply with applicable laws, regulations, and legal processes, including responding to lawful requests by public and judicial authorities.
• To enforce our terms and conditions and protect our rights, privacy, safety, or property, as well as that of our users and others.

Under the PDPL, we process personal data on the basis of your consent unless another lawful basis applies, including: processing necessary to perform an agreement to which you are a party; compliance with a legal obligation; protection of vital or public interests; or our legitimate interests, where permitted for non-sensitive data and not outweighed by your rights.

Where the GDPR applies, we rely on: contractual necessity; our legitimate interests (unless overridden by your interests or fundamental rights); your consent; and compliance with legal obligations.

We do not sell or rent your personal data to third parties. We may share your personal data in the following circumstances:

4.1 Service Providers

We may share your personal data with third-party service providers who perform services on our behalf — such as cloud hosting and AI infrastructure (Google Cloud's Dammam, Saudi Arabia region, contracted through CNTXT), analytics, email delivery, and customer support — under contracts that restrict their use of your data to the services they provide to us.

Specifically, information you submit through the contact and demo-request forms on this Website is transmitted to and stored in Google Workspace (Google Sheets and Google Apps Script) so that our team can receive and respond to your inquiry. This service may process and store data on Google infrastructure located outside the Kingdom of Saudi Arabia; where that is the case, we rely on the international-transfer safeguards described in Section 5 (including the standard contractual clauses and transfer risk assessments required by the PDPL). We also use reCAPTCHA to protect these forms from spam and abuse, as noted on the form itself.

4.2 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity, subject to the protections of this Policy and applicable law.

4.3 Legal Obligations and Protection of Rights

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency). We may also disclose your information when we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a lawful government request.

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy or as required by law. When your personal data is no longer necessary, we will securely destroy, delete, or anonymize it in accordance with the PDPL and other applicable requirements.

6.1 If you are in Saudi Arabia (PDPL)

You have the right to:

1. Be informed — to know how and why we process your personal data.

2. Access your personal data held by us.

3. Obtain a copy of your personal data in a readable and clear format.

4. Request correction, completion, or updating of your personal data.

5. Request destruction of personal data that is no longer needed, subject to legal retention requirements.

6. Withdraw your consent at any time, where processing is based on consent.

We respond to requests within the periods set by the PDPL's implementing regulations (as a rule, within thirty days). You also have the right to lodge a complaint with the competent authority (SDAIA).

6.2 If you are in the European Economic Area or the UK (GDPR)

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)), each under the conditions set out in the GDPR, and the right to complain to your supervisory authority.

To exercise any of these rights, contact us at info@novalexi.com. We verify identity before fulfilling a request.

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction — including encryption in transit and at rest, role-based access control, multi-factor authentication, and audit logging, aligned with the Saudi National Cybersecurity Authority's Essential Cybersecurity Controls. However, no method of transmission over the internet or method of electronic storage is 100% secure; while we strive to protect your personal data, we cannot guarantee its absolute security.

Our platform and customer data are hosted primarily within the Kingdom of Saudi Arabia (Google Cloud, Dammam region, contracted through CNTXT).

Where personal data subject to the PDPL is transferred outside Saudi Arabia (for example, to a service provider in another country), we do so only as permitted by the PDPL and its Personal Data Transfer Regulations — including appropriate safeguards such as standard contractual clauses adopted by the competent authority and transfer risk assessments — and only to the extent necessary.

Where the GDPR applies to a transfer outside the EEA/UK, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

If a breach of personal data occurs that harms or is likely to harm your data or interests, we will notify the competent authority within the legally required period (under the PDPL, SDAIA within 72 hours of becoming aware) and will inform affected individuals without undue delay where required.

Our Website is not intended for use by children under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, please do not provide any personal data to us. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information from our records.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make changes, we will update the effective date at the top of this Privacy Policy and, for material changes, provide notice on the Website. We encourage you to review this Privacy Policy periodically.

This Privacy Policy is published in Arabic and English. In case of any conflict or discrepancy between the two versions, the Arabic version prevails.

Questions about this Policy, or want to exercise a right? Contact us at info@novalexi.com.

NovaLexi Company — CR No. 7053584103 — 6809 Safwan Ibn Saleem Street, Al Arid District, Riyadh 13342 (Additional No. 3456), Kingdom of Saudi Arabia