Privacy Policy & Personal Data Protection Regulatory Framework
TayfConnect Communications and Information Technology is strictly committed to full regulatory compliance with Saudi statutory frameworks, notably the Personal Data Protection Law (PDPL) governed by SDAIA, alongside CST telecommunications regulatory standards.
Record of Processing Activities (RoPA) & Personal Data Classification
We enforce strict data minimization, restricting collection solely to order fulfillment, physical drop box survey feasibility, and CST regulatory subscriber verification.
Identity & Verification Data
Full legal name, National ID or Iqama number, and date of birth for statutory subscriber identity verification under CST rules.
National Address & Drop Box Plate
Short National Address, city, district, and building metallic drop box plate ID for optical survey feasibility and installation.
Contact Channels & Telemetry
Mobile number for OTP challenges and dispatch SMS notifications, plus IP address and connection logs for fraud prevention.
Zero Financial & Card Data Storage Safeguard
All electronic payments are routed via SAMA-licensed PCI-DSS Level 1 payment gateways; credit card numbers never touch or reside on our servers.
Lawful Processing Bases & Purpose Limitation
We process personal data strictly under explicit statutory grounds defined in Saudi PDPL, enforcing strict operational separation between contract performance and marketing opt-ins.
Order Fulfillment & Service Provisioning
Processing identity and address data to execute broadband subscriptions and dispatch field technicians for installation.
CST Regulatory Compliance & Identity Verification
Mandatory verification of subscriber identity via national access gateways and OTPs as stipulated by Saudi telecom statutes.
Platform Security & Fraud Defense
Session logs and technical telemetry to prevent automated bot attacks, fraudulent orders, and safeguard system integrity.
Direct Marketing & Promotional Communications
Promotional communications require explicit subscriber opt-in and may be revoked anytime without affecting active services.
Operational Demarcation & Data Responsibility Boundary (TAYF vs Unconfigured Provider)
We maintain clear, transparent demarcation between TayfConnect as an independent distribution platform and Carrier Telecom as the licensed infrastructure carrier.
TayfConnect
- Pre-order intake, plan advisory, and eligibility consultation.
- Preliminary address validation and drop box survey verification.
- Controlling inquiry data and protecting visitor privacy under PDPL.
Carrier Telecom
- Owning and operating fiber networks, 5G towers, and drop boxes.
- Field technician dispatch, physical optical wiring, and modem setup.
- Controlling active subscriber records, network provisioning, and billing.
Saudi PDPL Data Subject Rights (DSR) & Verification Workflow
The Saudi Personal Data Protection Law guarantees explicit, enforceable rights for all individuals, backed by our dedicated self-service verification desk.
Right to be Informed
Knowing the lawful basis, purpose of collection, and third-party recipients prior to data processing.
Right of Access
Reviewing your personal data stored on the platform and verifying its accuracy and currency.
Right to Obtain a Copy
Receiving a readable, clear electronic copy of your personal records in a secure format.
Right to Rectification
Requesting correction or completion of inaccurate, incomplete, or outdated personal information.
Right to Erasure / Destruction
Requesting erasure of personal data when no longer needed, subject to statutory retention rules.
Right to Withdraw Consent
Revoking consent for direct marketing without penalty or impairment to core subscriptions.
All data subject requests are securely authenticated via mobile SMS OTP challenge to prevent identity spoofing.
Subprocessor Governance, Saudi Data Sovereignty & Foreign Transfers
All customer databases and system telemetry reside exclusively on certified Saudi cloud infrastructure, enforcing strict compliance with SDAIA cross-border data transfer regulations.
In-Kingdom Hosting (Riyadh & Jeddah)
Primary cloud databases are physically hosted in certified Tier-III/IV Saudi data centers in Riyadh and Jeddah.
Vetted Subprocessor DPA Standards
Authorized SMS gateways and infrastructure partners operate under binding DPAs prohibiting independent data utilization.
Zero Unauthorized Foreign Transfers
Cross-border data transfers are strictly restricted pursuant to Saudi PDPL regulations and official regulatory approvals.
Data Retention Schedules, Cryptographic Erasure & Statutory Legal Holds
We retain personal records only as long as necessary for fulfillment or to satisfy statutory retention mandates, executing cryptographic zeroization once terms expire.
| Data Category | Retention Period | Statutory Basis | Destruction Method |
|---|---|---|---|
| Uncompleted Lead Inquiries | 90 Calendar Days | Purpose Expiration | Automated Digital Shredding |
| Tax Invoices & Financial Records | 5 Years | ZATCA Tax Statutes | Locked Archive then Permanent Purge |
| Telecom Audit & Compliance Logs | Per CST Directives | CST Regulatory Framework | Irreversible Cryptographic Erasure |
Uncompleted Lead Inquiries
90 Calendar DaysTax Invoices & Financial Records
5 YearsTelecom Audit & Compliance Logs
Per CST DirectivesStatutory Legal Holds Protocol
If an active dispute or complaint is pending before CST or a judicial authority, automated destruction is suspended under a formal Legal Hold until case closure.
Commercial Terms of Service, Strict Cashless Policy & Order Governance
We enforce absolute transparency before order confirmation: VAT-inclusive pricing, zero cash transactions for consumer protection, and free order cancellation prior to dispatch.
Strict Zero-Cash Field Technician Policy
All payments are handled exclusively via verified digital payment gateways; field installation technicians are strictly barred from collecting cash under any pretext.
All Published Prices Include 15% VAT
All displayed package tariffs explicitly incorporate 15% Saudi VAT and disclose ongoing renewal rates following promotional discount periods.
Free Order Cancellation Before Field Dispatch
Subscribers may cancel their order free of charge at any point prior to physical technician dispatch, receiving full refunds through banking channels.
Service Dependent on Physical Drop Box Survey
Final activation remains contingent upon successful physical survey of the building drop box plate and available optical fiber ports.
Regulatory Complaints Escalation to CST & Data Protection Officer Contact
We distinguish between frontline support and formal complaints, ensuring immutable tracking tokens, a 5-business-day resolution window, and direct CST regulatory escalation.
Stage 1: Support Triage
Rapid resolution for scheduling inquiries and connectivity troubleshooting via direct phone or WhatsApp.
Stage 2: Formal Complaint Portal
Submitting a formal complaint to receive an immutable tracking reference and mandatory 5-day resolution target.
Stage 3: CST Escalation (19966)
If unresolved within 5 business days or dissatisfied with outcome, escalate directly to CST via 19966 or portal.
Direct Inquiries to the Data Protection Officer
For statutory inquiries or concerns regarding personal data processing and PDPL governance.