Xeplans — Privacy Policy

1. Who we are and how to reach us

This site, and every service that links to this policy, is operated by Azam Hashmi ("Xeplans", "we", "us"), an individual in Jeddah, Saudi Arabia, who uses the name "Xeplans". Xeplans is not a registered company. Postal address: Al-Safa 1, Jeddah 24381, Saudi Arabia. Google Play shows the account holder's full legal name. We do not operate a telephone line; email is the way to reach us.

We are the controller of the personal data described here: we decide why and how it is processed.

Write PRIVACY in the subject line of any request under section 9 so it reaches the right desk without delay. Where a law requires us to appoint a data protection officer or a representative in a territory, the appointment and its contact details are published in this section.

2. What this policy covers, and what it does not

This policy covers the public website at xeplans.com and its subdomains, the project brief form, the mailboxes above, and any Xeplans product or service that links here.

It does not cover our mobile applications, each of which publishes its own privacy policy inside the application and on this site, and it does not cover third-party sites we link to, which are governed by their own policies. Where a separate privacy policy applies to a product, that policy governs that product and this one governs the website.

We process the personal data of individuals wherever they are. Sections 10 to 13 add the rights and duties a particular territory imposes, and those sections prevail over the general text for the people that territory protects.

3. Data minimisation: what we collect, and why

We collect the least data that achieves the purpose, we do not collect data in case it is useful later, and we do not sell personal data or share it for cross-context behavioural advertising. The site sets no cookies of its own, shows no advertising, and does not track you across other sites.

Collected automatically when you read a page

A rate rule counts requests to the brief endpoint per network address and per data centre over ten seconds, to stop floods. That count serves no other purpose.

Collected when you choose to give it

We do not knowingly collect special categories of data — health, religion, politics, biometrics, trade union membership, sexual life — or financial account data through this website. Do not send them to us. If you do, we delete them once the matter is closed.

4. Lawful basis for each purpose

We process personal data only where a lawful basis applies. The basis differs by territory, so both are given.

Where we rely on legitimate interests we are documenting a written assessment that weighs them against your rights. You may object at any time under section 9. Where we rely on consent you may withdraw it at any time; withdrawal does not affect processing already carried out.

5. Storage limitation: how long we keep it

We keep personal data only as long as the purpose requires, then delete it or irreversibly anonymise it.

Where a request to delete conflicts with a retention duty, we keep only what the duty requires, restrict it from every other use, and delete it when the duty ends.

6. Who we share it with

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we disclose it to no one except as set out here.

We require every processor to act only on our documented instructions. Written processing agreements carrying the duties the law sets — confidentiality, security, control of sub-processors, audit and deletion — are being put in place with each processor; this section will give the date each one is signed. No processor is authorised to use your data for its own purposes. We publish a material change to this list before it takes effect.

7. International transfers and data sovereignty

The site is served from data centres around the world, and the providers in section 6 process data in Ireland, the European Union and the United States. Personal data may therefore be transferred outside your country, including outside the Kingdom of Saudi Arabia, the EEA and the United Kingdom.

We transfer personal data out of a territory only where one of these applies:

• the destination has an adequacy decision or an equivalent recognition from the competent authority;
• the transfer is covered by Standard Contractual Clauses approved by the European Commission, by the UK International Data Transfer Agreement or its Addendum, or by the clauses the competent Saudi authority prescribes — in each case with a transfer impact assessment and any supplementary technical measure that assessment requires;
• the transfer meets a condition the applicable law allows for a specific and limited case, including your explicit informed consent, the performance of a contract you asked for, or the establishment or defence of a legal claim.

Saudi data sovereignty. Where the PDPL, its Implementing Regulations or the Regulation on Personal Data Transfer outside the Kingdom require personal data of individuals in the Kingdom to be processed inside the Kingdom, or require a risk assessment, a prescribed contractual safeguard or the competent authority's approval before a transfer, we are completing that requirement — a written transfer risk assessment and the safeguard the transfer rules prescribe — and until it is complete we limit what leaves the Kingdom to what the service needs. We do not transfer personal data out of the Kingdom where the transfer would prejudice national security or the Kingdom's vital interests.

You may ask us for a copy of the safeguard relied on for a transfer that affects you, at privacy@xeplans.com.

8. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit for every page and every form, a static site with no public database behind it, access to mailboxes and provider consoles limited to the people who need it and protected by multi-factor authentication, bot protection and rate limiting on the form endpoint, and security headers on every page.

No method of transmission or storage is perfectly secure, and email is not a confidential channel. Do not send us passwords, payment card numbers, government identity numbers or other sensitive material by email. If you must send something sensitive, ask us first and we will agree a protected channel.

9. Your rights, and how to use them

Wherever you are, you may ask us to:

• know what personal data we hold about you and how we use it;
• access it and receive a copy;
• correct it where it is inaccurate, out of date or incomplete;
• delete or destroy it where we no longer need it, where you withdraw the consent it rested on, or where it was processed unlawfully;
• restrict or object to processing, including processing based on legitimate interests;
• receive it in a portable form and have it sent to another controller where that is technically feasible;
• withdraw consent you gave, at any time;
• not be subject to a decision with legal or similarly significant effects taken solely by automated means. We take no such decisions.

Send the request to privacy@xeplans.com with PRIVACY in the subject line. We acknowledge within 5 working days and answer within 30 days, or within the shorter period your territory's law sets. We may extend once, by up to 30 further days, where a request is complex, and we tell you inside the first period if we do. We may ask for information that lets us confirm the request is yours; we ask for no more than that and use it for nothing else. Requests are free unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, and we explain why. An authorised agent may act for you if you give them written authority we can verify.

We will never treat you differently for exercising a right. We do not deny service, charge a different price, or give a lesser quality of service because you asked.

10. Saudi Arabia: the Personal Data Protection Law

If you are in the Kingdom of Saudi Arabia, the Personal Data Protection Law and its Implementing Regulations apply to our processing of your personal data, and this section prevails over anything inconsistent elsewhere in this policy.

• We collect the minimum data the declared purpose requires, and we do not process it for an incompatible purpose without a new basis.
• We tell you, at or before collection, who we are, the purpose, whether the data is mandatory, what follows if you do not provide it, and who receives it. This policy is that notice.
• You have the right to be informed, to access your data, to obtain a copy of it in a readable format, to request its correction or completion, and to request its destruction once it is no longer needed. We answer within 30 days.
• We do not use your personal data for marketing without your prior consent, and every marketing message carries a working way to stop it.
• We disclose your personal data only where the PDPL permits, and never where the disclosure would harm you or a public interest.
• We keep a record of our processing activities and carry out an impact assessment where a product or service is likely to create a high risk.
• A personal data breach that harms you, or that meets the threshold the Regulations set, is notified to the Saudi Data & Artificial Intelligence Authority (SDAIA) within 72 hours and to you without undue delay.
• Transfers outside the Kingdom follow section 7, except that your consent is not a ground for a transfer under the PDPL.

You may complain to SDAIA, which supervises the PDPL, at any time. You do not have to contact us first, though we welcome the chance to put things right.

11. EEA, United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR, the UK GDPR with the Data Protection Act, or the Swiss Federal Act on Data Protection applies, and this section prevails over anything inconsistent elsewhere in this policy.

• Our lawful bases are in section 4, and the legitimate interests relied on are named there.
• You have the rights in Articles 15 to 22: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a solely automated decision with legal or similarly significant effects. You may object at any time to processing based on legitimate interests, and absolutely to processing for direct marketing.
• We answer within one month, extendable by two further months for a complex request, and we tell you inside the first month if we extend.
• Transfers out of the EEA or the UK follow section 7 and rely on Standard Contractual Clauses, the UK Addendum or the International Data Transfer Agreement, with a transfer impact assessment.
• We have not appointed a representative in the EU or the UK; we will before we target users there.
• A personal data breach likely to risk your rights is reported to the competent supervisory authority within 72 hours of our becoming aware of it, and to you without undue delay where the risk is high.
• You may complain to your national supervisory authority, to the UK Information Commissioner's Office, or to the Swiss Federal Data Protection and Information Commissioner, and you may also go to court.

12. United States: California and the other states

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act applies, and this section prevails over anything inconsistent elsewhere in this policy.

Notice at collection. In the past 12 months we have collected the categories below through this website, for the business purposes in section 4, from the sources in section 3, and disclosed them only to the service providers in section 6.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months, including the personal information of consumers under 16. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.

Your California rights: to know, to access, to receive a portable copy, to correct, to delete, to opt out of sale or sharing (there is nothing to opt out of), to limit the use of sensitive personal information (none is collected), and not to be retaliated against for exercising any of them. We honour a Global Privacy Control signal sent by your browser as an opt-out request. Exercise a right at privacy@xeplans.com; we answer within 45 days and may extend once by a further 45 days.

The other states. If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, Tennessee, Indiana, Kentucky, Rhode Island, or any other state whose comprehensive consumer privacy law is in force, you have equivalent rights of access, correction, deletion, portability and opt-out, including the right to appeal a refusal. Use the same address. We answer within the period your state's law sets and, if we refuse, we tell you how to appeal and how to reach your Attorney General.

13. Other territories

Where your law gives you a right this policy does not name, you have that right and may exercise it at privacy@xeplans.com. Where your law sets a shorter response period, a mandatory local storage rule or a registration duty on us, we follow it.

14. Children

This website is a business site and is not directed to children. We do not knowingly collect personal data from a child through it. Our applications set their own minimum age, which their own policies state. If you believe a child has given us personal data, write to privacy@xeplans.com and we will delete it without undue delay. Where a law requires verifiable parental consent below a stated age, we do not process that person's data without it.

15. Automated decisions and artificial intelligence

We take no decision about you by solely automated means that produces a legal or similarly significant effect, and we do not profile you for advertising.

Where a Xeplans product uses artificial intelligence, that product's own documentation states what the system does, what data it uses and what human review applies. We do not use the contents of a project brief or of your correspondence to train a general-purpose model, and we do not permit our processors to do so.

16. Personal data breaches

We are extending our incident procedure — detection, containment, assessment, notification and review — to this website. If a breach affects your personal data we notify the competent authority within the period its law requires — 72 hours under the GDPR, the UK GDPR and the PDPL — and we notify you without undue delay where the breach could harm your data or conflict with your rights or interests, telling you what happened, what data was involved, what we have done and what you can do.

17. Cookies and similar technologies

The site sets no cookies of its own. Our Cookie Policy at xeplans.com/cookies states what would change that, what any future cookie would do, and how consent would be asked for and withdrawn. It forms part of this policy.

18. Changes to this policy

We may update this policy to reflect a change in the site, in a provider, or in the law. The version number and the date at the top always identify the current text. Where a change materially affects your rights or introduces a new purpose, we publish it in advance and, where the law requires, ask for your consent again. Continuing to use the site after a change takes effect means the updated policy governs that use.

19. Complaints

You may raise any concern with us at privacy@xeplans.com; in the Kingdom of Saudi Arabia you may also go to SDAIA directly. We answer every complaint. If you are not satisfied you may complain to your supervisory authority: SDAIA in the Kingdom of Saudi Arabia, your national supervisory authority in the EEA, the Information Commissioner's Office in the United Kingdom, your Attorney General in the United States, or the authority named in section 13. Nothing in this policy limits your right to a judicial remedy.