Privacy Policy & Sovereign Data Governance

This Privacy Policy governs the processing of personal and corporate data collected by Persici Agency, including its subsidiaries, regional branches, and affiliate entities ("Persici", "we", "us", or "our").

Persici operates multi-disciplinary engineering, commerce acceleration, and brand consulting practices with registered regional entities in Dubai (United Arab Emirates), Riyadh (Kingdom of Saudi Arabia), and Amman (Jordan).

Whether you are visiting our website, engaging our professional services, applying for open careers, or utilizing our proprietary technology platforms, your data is handled with rigorous cryptographic safeguards and sovereign legal accountability.

Persici aligns its data architecture with premier international privacy standards while strictly observing the sovereign statutory laws of each country in which our regional branches reside:

Under applicable data protection statutes, Persici acts in dual capacities depending on the context of the engagement:

1. As a Data Controller: Persici acts as controller when determining the purposes and means of processing personal data regarding visitors to persiciagency.com, corporate clients contracting directly with our agency, and career applicants submitting resumes.

2. As a Data Processor / Service Provider: When engineering custom software, eCommerce pipelines, or analytics integrations on behalf of our enterprise clients, Persici acts strictly as a data processor. In such capacities, we process end-user telemetry strictly in accordance with client instructions and executed Data Processing Agreements (DPAs).

We collect only the minimum personal data strictly necessary to fulfill our legitimate commercial, engineering, and contractual obligations:

• Corporate & Communication Data: Full name, business email, phone number, company title, and enterprise project requirements submitted via inquiry and appointment forms.

• Careers & Recruitment Data: Curriculum vitae (CV), portfolio links, employment history, and contact coordinates transmitted via our careers portal.

• Technical & Telemetry Data: Anonymized IP addresses, browser specifications, language preferences, operating systems, and interaction telemetry collected via privacy-conscious analytics.

• Client Engagement Artifacts: Invoicing credentials, VAT registration identifiers, and administrative communications necessary for contract execution.

Persici never processes personal data arbitrarily. Each processing activity is anchored to a recognized statutory justification:

• Performance of a Contract: Processing necessary to deliver engineering deliverables, project statements of work, and ongoing technical support.

• Explicit Consent: Where you have affirmatively opted into newsletters, discovery sessions, or candidate recruitment pipelines.

• Compliance with Legal Obligations: Fulfilling corporate registry, anti-money laundering (AML), and tax audit mandates in the UAE, Saudi Arabia, and Jordan.

• Legitimate Business Interests: Maintaining platform security, preventing distributed denial-of-service (DDoS) incidents, and optimizing website delivery.

Data residency and digital sovereignty are central pillars of Persici's architectural methodology.

• Regional Cloud Regions: For enterprise and governmental clients in Saudi Arabia and the UAE, infrastructure is deployed within local sovereign cloud datacenters (e.g., AWS me-central-1 UAE, Google Cloud Dammam KSA, or Oracle Cloud Riyadh/Jeddah) in full accordance with SDAIA and TDRA localization mandates.

• International Transfers: Where data is transmitted across borders for distributed team collaboration or global cloud infrastructure (e.g., Cloudflare R2, MongoDB Atlas), transfers are protected by Standard Contractual Clauses (SCCs), cryptographic encryption in transit (TLS 1.3), and zero-knowledge storage models.

Regardless of your geographic location, Persici provides comprehensive mechanisms to exercise your statutory rights:

• Right to Access & Portability: Request a structured, machine-readable copy of your personal data held in our systems.

• Right to Rectification: Correct inaccurate, incomplete, or outdated personal details.

• Right to Erasure / Destruction: Request the irrevocable deletion of personal information where retention is no longer mandated by law (GDPR Art. 17, Saudi PDPL Art. 24, UAE PDPL Art. 16, Jordan Law No. 24/2023 Art. 9).

• Right to Restrict or Object: Cease processing for direct marketing or automated algorithmic profiling.

• Right to Lodge Complaints: Contact relevant supervisory authorities, including the UAE Data Office, SDAIA in Saudi Arabia, or the Personal Data Protection Board in Jordan.

Persici implements institutional-grade technical and organizational defenses designed to safeguard data integrity and confidentiality:

• Encryption Standards: Advanced Encryption Standard (AES-256) for all databases and file storage at rest; Transport Layer Security (TLS 1.3) with perfect forward secrecy for all data in transit.

• Access Controls: Zero-Trust network architecture, mandatory Multi-Factor Authentication (MFA), and Least Privilege role-based access controls (RBAC).

• Audit Logs & Monitoring: Immutable, cryptographically verified system audit logs monitoring administrative access, configuration updates, and query telemetry.

• Incident Response: A formally tested Computer Security Incident Response Plan (CSIRP) guaranteeing notification to regulatory bodies and affected parties within 72 hours of a confirmed breach.

Our platform employs minimal cookies to guarantee stability, security, and responsive language delivery:

• Strictly Necessary Cookies: Essential for secure navigation, CSRF protection, session management, and language routing (Arabic / English).

• Performance & Analytical Telemetry: Aggregated, IP-anonymized metrics that assist us in detecting broken routes and optimizing page render speeds.

• No Invasive Third-Party Trackers: Persici does not sell, rent, or trade user tracking data to third-party data brokers or behavioral advertising exchanges.

To submit inquiries regarding our privacy practices, execute data subject access requests, or report potential vulnerabilities, contact our Data Governance Officer:

• Central Privacy & Legal Email: info@persiciagency.com

• Escalation Response Window: All verified statutory requests are acknowledged within 48 hours and fulfilled within 30 calendar days (or statutory timelines under Saudi PDPL, UAE PDPL, or GDPR).