Privacy and Data
Protection Policy
We adhere to the highest standards of personal data protection. This policy transparently explains how we collect your data, why we use it, and when we delete it — without complex legal jargon.
Core Commitment to Your Privacy
This policy is a legally binding document that defines how 01010 Digital collects, processes, stores, shares, protects, and deletes personal data in the context of operating its website and providing its specialized services in financial digital transformation.
We are fully committed to the provisions of the General Data Protection Regulation (GDPR) and the Saudi Personal Data Protection Law (PDPL), and all relevant laws and legislations applicable in our clients’ countries.
Who We Are — Data Controller
The entity responsible for processing your personal data (“Data Controller” under GDPR and PDPL) is:
| Trade Name | 01010 Digital |
| Founder & Manager | Abdalla Ghallab — Finance Transformation Manager |
| Country of Registration | Kingdom of Saudi Arabia |
| info@internalauditsheets.com | |
| Service Scope | Arab Region — Remote and On-site service |
Data We Collect and Sources
We collect data from three main sources, and we do not collect any data outside the scope of the purposes specified below:
Why We Use Your Data
We use your data exclusively for the following purposes — we do not process data for any unlisted purpose without notifying you and obtaining your consent:
- Providing Contractual Services: Managing your requests, bookings, and executing agreed digital transformation projects.
- Operational Communication: Responding to your inquiries, sending appointment confirmations, reminders, and project-related updates.
- Analysis and Service Improvement: Understanding how our site is used to improve your experience — using anonymized data.
- Direct Marketing (With Consent): Sending newsletters and specialized content — you can unsubscribe at any time.
- Security and Fraud Prevention: Detecting suspicious activities and protecting the integrity of our systems and platforms.
- Legal Compliance: Fulfilling accounting, tax, and regulatory obligations imposed on us by law.
Legal Basis for Processing Data
Under GDPR and local regulations, personal data may not be processed without a clear legal basis. We rely on the following bases depending on the nature of the processing:
| Purpose | Legal Basis | Revocability? |
|---|---|---|
| Executing contractual services | Contract Execution | No — Essential for service |
| Responding to pre-contract inquiries | Contract Execution | No |
| Sending newsletters and marketing | Yes — Unsubscribe anytime | |
| Site performance analysis & improvement | Legitimate Interest | Yes — Via Right to Object |
| Tax and accounting compliance | Legal Obligation | No — Mandated by law |
| Security and fraud prevention | Legitimate Interest | No — Core security |
With Whom Do We Share Your Data?
We may share limited and conditional data only with the following parties:
How Long We Keep Your Data
We retain data for the minimum necessary period to fulfill its purpose. After this period, everything that can be deleted is deleted, and we only keep what the law requires us to retain:
How We Technically Protect Your Data
We apply a multi-layered approach to data security (“Defense in Depth”) including technical and organizational controls:
- Encryption in Transit: TLS 1.3 protocol for all data transmitted via the site and APIs.
- Encryption at Rest: AES-256 for all personal data stored in databases.
- Multi-Factor Authentication: MFA is mandatory on all internal access accounts.
- Access Control: “Principle of Least Privilege” — no employee accesses more data than needed.
- Backups: Encrypted daily backups with regular restoration testing.
- Strict internal data protection policies reviewed annually.
- Regular training for all team members on data protection.
- Semi-annual Penetration Testing.
- Security audits for all external service providers prior to contracting.
Cookies and Tracking Technologies
Our website uses cookies and similar technologies. You can control your preferences from your browser settings or our Cookie Preferences panel:
Your Full Legal Rights
Under GDPR and the Saudi PDPL, you have the following rights regarding your personal data. You can exercise any of them by contacting us at: info@internalauditsheets.com
Data Transfer Outside the Region
Some of your data may be processed outside your country or the Arab region due to the use of international cloud services (e.g., Google Analytics, hosting servers). In these cases we ensure:
- Data is transferred only to countries or services with an adequate level of protection under GDPR.
- Standard Contractual Clauses (SCCs) are implemented with all service providers outside the EEA.
- Transfer Impact Assessments (TIA) are conducted for every international transfer.
- You are immediately notified of any change in the geographic locations of your data processing.
Updates to This Policy
We review this policy periodically to ensure compliance with legislative and technical changes, and our business practices. When any material change is made:
- We send an email notice to all current clients and newsletter subscribers 30 days before the change takes effect.
- We display a prominent notice on the homepage for at least 14 days.
- We maintain a publicly accessible archive of all previous versions of the policy.
- We update the “Last Updated” date displayed at the top of the page.
How to Contact Us About Your Privacy
For any inquiry or request related to this policy or your personal data, you can contact our Data Protection Officer via:
| DPO Email | info@internalauditsheets.com Subject line: “Privacy Request — [Request Type]” |
| Response Time | Within a maximum of 30 days from request receipt |
| Appealing Our Decision | You have the right to lodge a complaint with your local data protection supervisory authority |
| Identity Verification | We may request proof of identity to protect your data from unauthorized access |