Privacy Policy — Cerebra

1. Introduction and Purpose

Cerebra ("Company," "we," "us," or "our") is committed to protecting the personal data of individuals in our client organizations. This Privacy Policy explains how we collect, use, and safeguard personal data in compliance with Saudi Arabia's Personal Data Protection Law (PDPL) and National Cybersecurity Authority (NCA) standards. It covers all Cerebra products and services (cloud/SaaS or on-premises) and any related websites or apps.

The policy applies to employees of our client companies whose personal data we process on their employer's behalf. We collect only non-sensitive personal information (such as name, business email, job title, and work phone) and we do not collect data from minors or other protected categories. All personal data is hosted and processed exclusively in Saudi Arabia to meet national data sovereignty and security requirements.

2. What Personal Data We Collect

Cerebra only collects basic professional contact information. The categories of personal data we collect include:

Identity information: Full name and job title or designation.
Contact details: Work email address and business phone number.

We do not collect sensitive personal data (such as health, financial, racial or ethnic information). We do not collect personal data from minors or other vulnerable individuals. Any additional information needed to provide or improve our services (such as employee ID or department, if provided by your employer) is treated with the same care and is limited to what is necessary for the service.

3. How We Collect It

Cerebra collects personal data in the following ways:

Direct collection: Your employer (the client organization) may provide your personal data to us to create and manage your account on our system. You may also provide personal data directly when you use our software or websites.
Indirect collection: When you visit our websites or use our apps, we may use cookies and similar technologies to collect technical and usage information (such as your IP address, device type, browser settings, and pages accessed).
Automated data: In the normal operation of our software, we automatically log certain information for security and troubleshooting purposes (such as login times, system errors, or audit logs).

4. Why We Use It (Purposes and Legal Bases)

We use the personal data we collect for legitimate business purposes related to our products and services. These purposes include:

Service delivery and account management: To provide and maintain our software services.
Communication: To send you important service-related messages such as account notices, product updates, security alerts, and technical communications.
Customer support and troubleshooting: To respond to your inquiries or support requests.
Security and fraud prevention: To detect and prevent unauthorized access, security incidents, or improper activity.
Service improvement and analytics: To analyze how our services are used, diagnose technical issues, and develop new features.
Legal compliance: To comply with applicable laws, regulations, and lawful requests.

5. Data Sharing and Disclosure (Domestic Only)

Cerebra does not sell, rent, or trade your personal data. We share personal data only in limited ways, always within Saudi Arabia:

With our service providers: Trusted third-party vendors based in Saudi Arabia who perform services on our behalf.
Within Cerebra: Authorized employees or affiliates in Saudi Arabia who need access to perform their duties.
With your employer (the data controller): As part of service management or reporting.
Legal and regulatory requests: Saudi government authorities or regulators if required by law.

No personal data is transferred outside Saudi Arabia. All processing and storage take place within the Kingdom.

6. Storage, Security, and Retention

All personal data collected by Cerebra is securely stored on servers located in Saudi Arabia. We protect your data with technical and organizational safeguards, including:

Encryption of data in transit (using HTTPS/TLS) and at rest.
Network security measures such as firewalls, intrusion detection systems, and secure access controls.
Regular security testing and vulnerability assessments.
Strict access controls and employee training on security best practices and PDPL requirements.
Incident response procedures aligned with NCA guidelines.

We retain personal data only for as long as necessary to fulfill the purposes outlined above or to comply with legal obligations.

7. Your Rights under the PDPL

Under the Saudi PDPL, you have the following rights regarding your personal data:

Access: Request a copy of the data we hold about you.
Correction: Ask us to correct or update any inaccurate or incomplete data.
Deletion: Request deletion when data is no longer needed.
Withdrawal of consent: Withdraw consent at any time.
Object or restrict processing: Object to processing based on legitimate interests.
Data portability: Request your data in a machine-readable format.
Right to complain: File a complaint with us or with SDAIA.

To exercise your rights, contact us at support@cerebra.sa. We will respond within 30 days.

8. How to Submit Complaints or Inquiries

If you have any questions, complaints, or inquiries about this privacy policy or our handling of personal data:

Contact Cerebra: Reach out to our Data Protection Officer at support@cerebra.sa.
Regulatory authorities: You have the right to file a complaint with SDAIA (Saudi Data & Artificial Intelligence Authority) or the NCA for cybersecurity incidents.

9. Policy Updates

This Privacy Policy may be updated from time to time to reflect changes in our practices, services, or legal requirements. Any significant changes will be communicated by posting the revised policy and updating the effective date.

Version 1.0 (May 2025): Initial release, aligning with PDPL and NCA standards.

10. Contact Information

If you have questions, requests, or concerns about this policy or our data practices:

Company: Cerebra
Email: support@cerebra.sa