Privacy Policy

1. Introduction

Saad Ali Algarny Company ("Company," "we," "us," or "our"), trading as komake, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website komake.io and use our Unified Creative Collaboration Platform (the "Platform").

We operate from the Kingdom of Saudi Arabia and comply with the Personal Data Protection Law (PDPL). Given our global user base, we also align our practices with the General Data Protection Regulation (GDPR) for European users and applicable US state privacy laws (such as the CCPA/CPRA).

2. Information We Collect

Information You Provide to Us

We collect personal data that you voluntarily provide when creating an account or using our services:

• Account Data: Full name, email address, phone number, password, and professional role (Brand, Creator, Advertiser).
• Identity Verification (KYC): Government-issued ID (e.g., passport, national ID), date of birth, and tax residency forms (e.g., W-9, W-8BEN). This is strictly required for Anti-Money Laundering (AML) and financial compliance. We note that Identity Verification (KYC) documents, including Government-issued IDs, may be categorized as Sensitive Data under the KSA PDPL, and we apply the highest security and procedural controls (including mandatory risk assessments) required by law for its handling.
• Financial Data: Bank account details (IBAN) and VAT/Tax ID numbers.
• Profile Content: Portfolios, work history, skills, rates, project briefs, and any files uploaded to the Platform.

3. Lawful Basis for Processing

We process your personal data only where we have a lawful basis under the KSA PDPL and GDPR:

4. Automated Decision Making & Quality Scores

Our Platform uses algorithms to generate a "Quality Score" for Creators based on objective performance metrics (e.g., responsiveness, deadline adherence, client ratings).

Your Rights: Under Article 22 of the GDPR and the KSA PDPL, you have the right to object to decisions made solely by automated means that have legal or significant effects on you. If you believe your Quality Score is inaccurate, you may request a Human Review. Furthermore, if you object to the underlying processing of data used to calculate your Quality Score (as this processing is based on our Legitimate Interest), you may exercise your Right to Object as detailed in the 'Your Rights' section.

5. International Data Transfers

Our headquarters and primary servers are located in the Kingdom of Saudi Arabia. However, as a global platform, your data may be transferred to and processed in other countries, including the United States and countries within the European Economic Area (EEA).

For Transfers out of KSA:

• We ensure that any transfer of personal data outside the Kingdom complies with the PDPL and its Implementing Regulations on Personal Data Transfer.
• Before initiating any transfer, we perform a Risk Assessment of the transfer outside the Kingdom, taking into account the type of data, the destination country's laws, and the potential impact on your rights, in line with the PDPL Transfer Regulations.
• We utilize Standard Contractual Clauses (SCCs) issued by the Saudi Data & Artificial Intelligence Authority (SDAIA) and ensure the transfer does not prejudice the national security or vital interests of the Kingdom, a key mandate of the PDPL.

For Transfers out of the EEA/UK:

When we transfer data to countries not deemed "adequate" by the European Commission, we rely on the EU Standard Contractual Clauses (EU SCCs) and implement supplementary measures to safeguard your rights.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

• Active Accounts: Retained for the duration of your account's existence.
• Financial Records: Retained for 10 years to comply with ZATCA (Zakat, Tax and Customs Authority) regulations and tax audits.
• Deleted Accounts: Upon request, we delete your profile and contact information.

Right to Erasure Exception: While you possess the Right to Erasure, we must retain transactional records (invoices, payment history) in a secure, archived format for a period of 10 years as this is a statutory legal obligation to comply with KSA ZATCA (Zakat, Tax and Customs Authority) regulations. This legal requirement supersedes the Right to Erasure for this specific data category.

7. Your Rights

Depending on your jurisdiction (KSA, EU, USA), you possess the following rights:

• Right to Access
• Right to Correction
• Right to Erasure ("Right to be Forgotten")
• Right to Restrict Processing
• Right to Object
• Right to Data Portability

How to Exercise Your Rights:

To exercise any of these rights, please email us at contact@komake.io. We will respond to your request within 30 days (or strictly within the timeframe required by local law).

8. Children's Privacy

Our Platform is strictly intended for users who are 18 years of age or older. We do not knowingly collect or solicit personal data from anyone under the age of 18.

9. Security of Your Data

We use administrative, technical, and physical security measures to help protect your personal information. These measures include encryption (SSL/TLS), access controls, and regular security audits.

10. Contact Us

If you have questions or comments about this Privacy Policy, please contact our Privacy Team: