Privacy Policy

1. Introduction

Welcome to Pyxos, Inc. ("Pyxos," "we," "our," or "us"). Protecting your privacy is our top priority. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal data in compliance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (KSA).

This Policy applies to any personal data collected from visitors, customers, employees, business partners, and other stakeholders interacting with Pyxos, whether online or offline. It also describes how individuals can enforce their rights under PDPL and how we address compliance concerns.

We encourage you to read this Policy carefully. If you have any questions, please contact our Data Protection Officer (DPO) at privacy@pyxos.ai.

2. Scope and Applicability

This Policy applies to personal data processed by Pyxos in the following contexts:

• Websites, Applications, and Online Services: Includes corporate websites, customer portals, and digital platforms owned or operated by Pyxos.
• Offline Interactions: Covers meetings, conferences, trade shows, and other direct engagements.
• Employee and Contractor Data: Covers personal data collected for recruitment, payroll, benefits, and internal HR management.
• Customer and Vendor Relationships: Personal data processed for business transactions, partnerships, and service engagements.
• Third-Party Data Processing: Personal data received from business partners, affiliates, or public sources under legally permissible conditions.

3. Types of Personal Data We Collect

We may collect the following categories of personal data:

4. How We Use Your Personal Data

We process personal data for the following purposes:

• Service Provision: To deliver our AI-powered data privacy compliance solutions
• Customer Support: To respond to inquiries and provide technical assistance
• Business Operations: To manage contracts, billing, and administrative functions
• Legal Compliance: To comply with applicable laws and regulations
• Security: To protect our systems and prevent fraud
• Improvement: To enhance our services and develop new features

5. Legal Basis for Processing

Under PDPL, we process personal data based on the following legal grounds:

• Consent: Where you have given explicit consent for specific processing activities
• Contract Performance: Where processing is necessary to fulfill our contractual obligations
• Legal Obligation: Where processing is required by applicable laws
• Legitimate Interest: Where processing is necessary for our legitimate business interests, balanced against your privacy rights

6. Data Sharing and Disclosure

We may share your personal data with:

• Service Providers: Third-party vendors who assist with our operations under strict confidentiality agreements
• Legal Authorities: When required by law or to protect our legal rights
• Business Partners: With your consent, for joint ventures or collaborative services
• Affiliates: Within the Pyxos corporate group for legitimate business purposes

We do not sell, rent, or trade personal data to third parties for marketing purposes.

7. Your Rights Under PDPL

You have the following rights regarding your personal data:

• Right to Access: Request information about how your data is processed
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Object: Object to processing based on legitimate interests
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for specific processing activities

To exercise these rights, contact us at privacy@pyxos.ai.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and audits
• Employee training on data protection
• Incident response procedures

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data and the purpose of processing.

10. International Data Transfers

When transferring personal data outside of Saudi Arabia, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses, or other approved transfer mechanisms under PDPL.

11. Contact Information

For any privacy-related questions or to exercise your rights, please contact:

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. We will notify you of material changes through our website or direct communication. The effective date at the top of this Policy indicates when it was last updated.