1. Data Controller
KDepresso is operated as a private introduction service registered in the Kingdom of Saudi Arabia. For all matters relating to your personal data, you may contact us at:
Email: khatabadepresso@gmail.com
Address: Riyadh, Kingdom of Saudi Arabia
2. Data We Collect
We collect personal data that you voluntarily provide when submitting an application to our service. This includes:
- Identity information: Full name, gender, age, and photograph
- Contact information: Email address and WhatsApp number
- Personal background: Nationality, country and city of residence, education level, and occupation
- Family information: Marriage history, children situation, and family contact preferences
- Religious and cultural information: Sect, religiosity level, tribal affiliation, and regional origin — collected as sensitive personal data under the PDPL
- Lifestyle information: Smoking status, hobbies, habits, and personal traits
- Preference information: Characteristics, values, and qualities you are seeking in a spouse
- Free-text responses: Personal statements, motivations, and non-negotiable requirements
- Payment information: Processed securely through HyperPay. We do not store card numbers or payment credentials on our systems.
- Communications: Messages exchanged between you and KDepresso through the member portal
Sensitive Data Notice: Information relating to religion, tribal affiliation, and family matters is classified as sensitive personal data under Article 6 of the Saudi PDPL. We collect this data only with your explicit consent, as indicated by your signed application agreement, and it is encrypted at rest using AES-256 encryption.
3. Legal Basis for Processing
We process your personal data on the following legal bases under the PDPL:
- Explicit consent: You provide explicit consent at the point of application for all personal and sensitive data collected
- Contractual necessity: Processing is necessary to deliver the introduction service you have contracted for
- Legal obligation: We may process data where required by Saudi law or regulatory authority
- Legitimate interest: Service improvement, fraud prevention, and platform security, balanced against your rights
4. How We Use Your Data
Your personal data is used exclusively for the following purposes:
- Reviewing and evaluating your application for membership
- Identifying and presenting potential introductions that match your stated criteria
- Sharing a limited profile with a potential match, only after both parties have confirmed mutual interest
- Communicating with you about your introductions and account status
- Processing your subscription payment through our payment provider
- Complying with applicable Saudi laws and regulatory requirements
- Improving our service and matching methodology in aggregate, non-identifiable form
We do not use your data for advertising, profiling for commercial purposes, or any purpose not directly related to delivering the introduction service.
5. Data Sharing and Disclosure
We do not sell, rent, or trade your personal data to any third party. Your data may be shared only in the following limited circumstances:
- Potential matches: A carefully selected subset of your profile is shared with a potential match when we present an introduction, before either person has responded, so that each can make an informed decision. This subset includes: first name, age, height, occupation, education level, city and country of residence, marriage history, children status, smoking status, hobbies, self-described character traits and ambitions, sect, religiosity level, niqab status, tribal affiliation, your personal statement, and your photo. Your full name and contact details are never included. Your photo is shown once, for a limited time, and cannot be saved or re-viewed through the platform; we cannot prevent someone from capturing their own screen, so this is a courtesy protection rather than a guarantee. Some of these details (sect, religiosity, and tribal affiliation) are sensitive personal data under the PDPL, shared only with applicants who have consented to this.
- Payment processor: HyperPay processes payments on our behalf and is subject to their own privacy policy and PCI-DSS compliance obligations.
- Legal requirements: We may disclose data if required by a Saudi court order, governmental authority, or applicable law.
- Email delivery: We use SendGrid solely as a notification delivery service. SendGrid receives only your email address and the text of system notifications — such as application status updates and payment links. No personal profile data, sensitive information, or introduction details are ever transmitted to or through SendGrid. All substantive communications about introductions occur exclusively within our secure member portal.
6. Data Retention
We retain your personal data for the following periods:
- Active members: For the duration of your membership and for a period of two (2) years following the end of your membership, unless you request earlier deletion
- Unsuccessful applicants: For a period of six (6) months following the rejection of your application, after which all data is permanently deleted
- Payment records: As required by Saudi financial regulations, typically five (5) years
- Communications: For the duration of your membership
You may request deletion of your personal data at any time by contacting us (see Section 8). Upon receipt of a valid deletion request, we will permanently delete all personal data within thirty (30) days.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- AES-256 encryption for sensitive personal fields (religion, tribe, regional origin) stored in our database
- TLS/HTTPS encryption for all data transmitted between your device and our servers
- Access controls limiting data access to authorized personnel only
- Regular backups stored securely on the same infrastructure
- Session-based authentication for portal access via time-limited magic links
In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) and, where required, affected individuals, within the timeframes required by the PDPL.
8. Your Rights Under the PDPL
As a data subject under the Saudi Personal Data Protection Law, you have the following rights:
- Right to access: You may request a copy of all personal data we hold about you
- Right to rectification: You may correct inaccurate or incomplete personal data through your member portal or by contacting us
- Right to erasure: You may request permanent deletion of your personal data, subject to our legal retention obligations
- Right to restrict processing: You may request that we limit how we use your data in certain circumstances
- Right to data portability: You may request a copy of your data in a structured, machine-readable format
- Right to withdraw consent: You may withdraw consent at any time, which will result in the termination of your membership
- Right to lodge a complaint: You may lodge a complaint with SDAIA at www.sdaia.gov.sa
To exercise any of these rights, please contact us at khatabadepresso@gmail.com. We will respond within thirty (30) days of receiving your request.
9. Cross-Border Data Transfers
Your personal data is stored on servers physically located in Riyadh, Kingdom of Saudi Arabia, operated through Alibaba Cloud infrastructure. All data processing and access controls are managed by KDepresso. Data residency within the Kingdom of Saudi Arabia means your personal data does not leave the country under normal operating conditions.
Our email notification service (SendGrid) receives only your email address and system-generated notification text for the purpose of delivering transactional emails. No personal profile data, sensitive information, or introduction details are transmitted to SendGrid. The content of these notifications is limited to status updates (e.g. application approved) and payment links, none of which contain personal data beyond what you already know about yourself. We have ensured that SendGrid provides adequate data protection guarantees consistent with PDPL requirements.
10. Children's Privacy
Our service is intended exclusively for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected data from a minor, we will delete it immediately.
11. Cookies and Tracking
Our public website does not use cookies for advertising or tracking purposes. Our member portal uses session tokens stored in your browser's local storage solely to maintain your authenticated session. These are deleted when you log out or when your session expires.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify active members of material changes via email. The date of the most recent revision is displayed at the top of this page. Continued use of the service after notification of changes constitutes acceptance of the updated policy.
13. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
KDepresso
Email: khatabadepresso@gmail.com
Riyadh, Kingdom of Saudi Arabia