About this notice
This notice explains, in plain language, what personal data GH The Green Hubs® Company (“GH”, “we”) holds, why, on what legal basis, who we share it with, where it is kept, how long we keep it, how we protect it, and the rights you have under the Saudi Personal Data Protection Law (PDPL). It is GH’s privacy policy under PDPL Article 12.
1. Who we are
GH The Green Hubs® Company is a sustainability intelligence company based in Al-Khobar, Kingdom of Saudi Arabia. We run SIP™, the Sustainability Intelligence Platform. SIP™ is still being built, and we plan to run it on a server in the Kingdom before clients use it.
Contact for anything in this notice: info@the-green-hubs.com. Our Data Protection Lead is the Founder & CEO.
2. Our role: controller or processor
GH is the controller (the party that decides why and how data is used) for SIP™ user accounts, sign-in and security records, the audit trail, our business contacts, enquiries and staff records.
When a client organisation puts its own documents and data into SIP™ (evidence, activity and emissions data, project data), the client decides what goes in and why. For that data the client is the controller and GH is the processor: we use it only on the client’s written instructions and under our contract with the client. If you are named in a client’s data, the client’s own privacy notice also applies, and we pass your request to the client and help them answer it.
3. What personal data we hold
| SIP™ account | Name, work email, organisation, role, account status and last sign-in time. Passwords are stored only as a salted one-way hash. The secret for two-step sign-in is stored if you turn it on. |
|---|---|
| Security and audit records | Who did what in SIP™ and when (for example uploads, approvals, sign-offs and changes to records), session records, and failed sign-in attempts (the email used and the reason). |
| Evidence documents | Files a client uploads as evidence (for example reports, invoices and certificates). They may contain names, job titles, signatures or contact details of people named in them. |
| Activity and emissions data | Energy, fuel, materials, travel and similar records, emission factors and results. This is mostly about sites and assets; it is personal data when it can be linked to a named person. |
| Project data | Project records, schedules, risks, actions and gates, with the names and roles of the people responsible. |
| Business contacts and enquiries | Name, organisation, work email, phone if you give it, and what you choose and write to us, including through this website’s Build your engagement form. |
| Staff, interns and applicants | Identity and contact details, role, contract, work records and what employment law requires. |
We do not ask for sensitive personal data, such as health, genetic, biometric or credit data, data on religious, intellectual or political belief, racial or tribal origin, or criminal and security records. SIP™ is not designed to hold it.
4. Why we use it and our legal basis
| Run your SIP™ account and let you sign in | Legitimate interest in providing a secure service, and the contract where you are a party to it (Article 6) |
|---|---|
| Keep SIP™ secure and keep a tamper-evident audit trail | Legitimate interest in security and accountability, and legal obligation where the law requires records (Article 6) |
| Process client data to deliver the service | The client’s instructions under our contract (GH is the processor) |
| Answer enquiries, including requests sent through this website | Your consent, given on the form, and steps you ask for before a contract |
| Meet legal duties | Legal obligation |
Automated decisions. SIP™ does not make decisions about people. Its AI features draft answers only from verified evidence and cite their sources, and a person reviews and approves them.
5. Who we share it with
- People inside GH who need it for their work.
- Your organisation’s SIP™ administrators and reviewers, for their own organisation only.
- Service providers that host, store or back up data for us, on our instructions and under written terms.
- Professional advisers, under a duty of confidentiality.
- Government bodies and courts, when the law requires it.
We do not sell personal data, and we do not use client data for advertising.
6. Where your data is kept
SIP™ is designed to keep data in the Kingdom. Once it is set up to serve clients, it refuses to start unless its hosting region is in the Kingdom, and every client organisation is set to “Kingdom only” by default.
We transfer personal data outside the Kingdom only as PDPL Article 29 and the Regulation on Personal Data Transfer outside the Kingdom allow, and only the minimum needed.
7. How long we keep it
| SIP™ account | While the account is active; removed or anonymised within 12 months after it is closed, except entries in the audit trail. |
|---|---|
| Audit trail and security records | For the life of the client contract plus 5 years. These records are append-only. |
| Client data | For the contract; then returned on request and deleted within 90 days, unless the law requires us to keep it. |
| Business contacts and enquiries | 3 years after our last contact; 12 months for enquiries that lead nowhere. |
| Backups | Encrypted daily; the last 30 copies are kept. |
8. How we protect it
- Named accounts with roles; the person who approves an item is not the person who created it.
- Each organisation’s data is kept separate on every query.
- Passwords of at least 12 characters stored only as salted hashes, two-step sign-in, and sessions that end after 8 hours.
- A tamper-evident, append-only audit trail and alerts on repeated failed sign-ins.
- Encrypted backups with the key kept apart, and secure, encrypted web connections on the server version of SIP™.
If a personal data breach could harm you, we will notify SDAIA within 72 hours of becoming aware of it and tell you without undue delay.
9. Your rights
- To be informed, through this notice.
- To access the personal data we hold about you.
- To get a copy of it in a clear, readable format.
- To ask us to correct it.
- To ask us to destroy data we no longer need.
- To withdraw your consent where we rely on it.
- To complain to us and to SDAIA.
Email info@the-green-hubs.com with the subject “Personal data request”. We reply within 30 days, extendable by up to 30 more days with notice. There is no charge.
10. Complaints
Please contact us first at info@the-green-hubs.com. You also have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform, https://dgp.sdaia.gov.sa, within 90 days of the event.
11. Changes to this notice
We review this notice at least once a year, and whenever our services or the law change. Each version has a number and an effective date.