Samurai Systems is the controller of personal data processed under this Privacy Policy and is responsible for determining the purposes and means of processing in accordance with applicable personal data protection requirements in the Kingdom of Saudi Arabia.

• Legal name: Samurai Systems (An Affiliate of Neusol)
• Registered address: Office 304, Abdar Commercial Complex, Riyadh, Kingdom of Saudi Arabia
• Website: www.samurai.systems
• Contact number: +966 11 292 3918
• General email: connect@samurai.systems

The Company may be contacted using the following official contact details:

• Address: Office 304, Abdar Commercial Complex, Riyadh, Kingdom of Saudi Arabia
• Phone number: +966 11 292 3918
• Email: connect@samurai.systems

For the purposes of this Privacy Policy, the terms "personal data," "sensitive personal data," "controller," "processor," and "data subject" shall have the meanings assigned to them under the applicable personal data protection framework in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its implementing regulations.

• "Chat Wizard" refers to the interactive inquiry tool embedded on the Company's website that collects user information and service preferences to facilitate service inquiries and requests.
• "CRM" or "Zoho CRM" refers to the Customer Relationship Management platform used by the Company to manage, track, and follow up on leads, inquiries, and client interactions.
• "Processing consent" refers to the mandatory consent provided by users before submitting a request through the Chat Wizard, authorizing the Company to collect and process their personal data for the purpose of responding to the inquiry or service request.
• "Marketing consent" refers to the optional, separately captured consent authorizing the Company to send updates, insights, and commercial communications to the user.

The Company may collect and process the following categories of personal data, depending on the nature of the user's interaction with the website or digital service:

• Identification data, such as full name.
• Contact data, such as email address, telephone number, and correspondence details.
• Professional or business data, such as employer, company name, sector, job title, and organization size.
• Service interest and inquiry data, such as the service category, nature of request, project details, and briefing preferences submitted through the Chat Wizard or contact forms.
• Communication data, such as messages, requests, inquiries, feedback, and attachments submitted through forms, email, or the Chat Wizard.
• Technical and usage data, such as IP address, browser type, device information, operating system, internet service provider, time and date of access, referring and exit pages, visited pages, and clickstream data.
• Cookie and similar technology data.
• Event or registration data, where a user registers for a meeting, briefing, program, initiative, or event.
• Consent records, including the type of consent granted (processing consent and/or marketing consent), the timestamp of consent, and the channel through which consent was captured.
• Any personal data obtained lawfully from other parties or public sources where permitted and relevant.

The Company does not intentionally collect sensitive personal data through the website unless such collection is necessary, lawfully permitted, and supported by an appropriate legal basis and additional safeguards. Where personal data is collected directly through the Company's forms and digital services, fields required to complete a request, subscription, or registration are indicated as mandatory at the point of collection; all other fields are optional. Strictly necessary and technical cookie data is automatically collected to ensure the operation, security, and functionality of the website. Preference, analytics, and marketing cookies are non-essential and are only used where the user has given prior consent, which may be withdrawn at any time.

Personal data may be collected directly from the data subject through:

• The Chat Wizard inquiry tool embedded on the Company's website.
• Online contact forms and briefing or assessment request forms.
• Subscription and newsletter sign-up tools.
• Event and program registration forms.
• Email correspondence.
• Other fields completed by the user on the Company's digital channels.

Personal data may also be collected indirectly through cookies, analytics technologies, server logs, website analytics tools, security monitoring solutions, or from other lawful sources where permitted.

The Company collects and processes personal data for purposes directly related to its activities and digital services, including:

• Operating, administering, and maintaining the website and related digital services.
• Processing and responding to service inquiries, briefing requests, assessment requests, and communications submitted through the Chat Wizard or other channels.
• Managing the Company's CRM (Zoho CRM) to track, follow up on, and manage leads and client relationships.
• Managing subscriptions, events, stakeholder engagement, and service-related interactions.
• Improving website functionality, content relevance, user experience, and service quality.
• Understanding website usage and visitor engagement.
• Protecting systems, preventing misuse, fraud, and unauthorized access, and supporting cybersecurity monitoring.
• Complying with legal, regulatory, judicial, and contractual obligations.
• Sending newsletters, service updates, invitations, insights, or promotional communications where marketing consent is obtained or another lawful basis applies.

The Company operates a structured consent management mechanism through its Chat Wizard, which captures and records consent before any lead data is submitted and transferred to the Company's CRM (Zoho CRM).

The Company may rely on one or more lawful bases for collection and processing, depending on the nature of the activity and the specific purpose involved. These lawful bases may include:

• The explicit consent of the data subject, including processing consent and marketing consent captured through the Chat Wizard.
• Performance of an agreement or steps connected to a service requested by the data subject.
• Compliance with a legal or regulatory obligation.
• Legitimate interests pursued by the Company, provided such interests do not override the rights of the data subject.
• Protecting vital interests, serving the public interest, ensuring security, or meeting judicial requirements, where applicable under the legal framework.

Where processing is based on consent, the data subject may withdraw consent at any time through the contact channels identified in this Policy, without affecting processing carried out before withdrawal on a valid legal basis.

The Company uses personal data in a manner consistent with the stated purposes of collection and may process data across the relevant stages of the data life cycle, including collection, recording, organization, storage, retrieval, consultation, use, sharing where permitted, and deletion or destruction.

• Recording and managing service inquiries, briefing requests, and communications.
• Administering the Company's CRM (Zoho CRM) to manage leads, client relationships, and follow-up activities.
• Administering digital forms, Chat Wizard submissions, registrations, subscriptions, and stakeholder interactions.
• Maintaining service continuity, website administration, and technical support.
• Conducting internal analytics and trend analysis to improve content and services.
• Supporting information security, fraud prevention, incident detection, and risk management.
• Maintaining internal records required for governance, legal, audit, or compliance purposes.

Personal data shall not be processed for purposes inconsistent with the original stated purposes unless permitted by law and supported by an appropriate lawful basis.

The Company uses cookies, log files, and similar technologies to enable technical website operations, maintain security, remember user preferences, analyze traffic, and improve functionality and user experience. Cookies or similar tools may include:

• Strictly necessary cookies, which are essential for the website to function and cannot be disabled.
• Preference cookies, which enable the website to remember user settings and improve personalization.
• Analytics cookies, which collect information about how users interact with the website to help the Company improve it.
• Marketing cookies, which may track users across websites to display relevant content or advertisements, where applicable.

Strictly necessary and technical cookies are automatically deployed to ensure the operation, security, and functionality of the website. Preference, analytics, and marketing cookies are non-essential and are only used where the user has given prior consent, which may be withdrawn at any time through the cookie consent settings on the website or by contacting the Company.

The Company does not sell personal data and does not disclose personal data to third parties for their independent direct marketing purposes.

The Company may disclose personal data to service providers or processors that support website hosting, IT operations, CRM management (including Zoho CRM), analytics, communications, event administration, or other authorized business functions, provided such disclosure is limited to what is necessary and subject to contractual confidentiality and data protection obligations.

The Company may also disclose personal data where required by law, regulation, judicial order, competent authority request, or where necessary to protect rights, security, safety, or legal claims.

The Company operates across Saudi Arabia, the UAE, Pakistan, Canada, and Australia. The Company stores personal data within the Kingdom of Saudi Arabia where feasible and appropriate.

Where personal data is processed or made accessible by team members or systems outside the Kingdom — including the Company's engineering or delivery offices in the UAE, Pakistan, Canada, and Australia — such access or transfer shall take place only in accordance with applicable legal requirements and after implementation of the required safeguards and approvals, where applicable.

The Company notes that Zoho CRM, used for lead and CRM management, is a cloud-based platform whose data residency may be subject to Zoho's infrastructure policies. The Company takes reasonable steps to ensure that any such transfer or access is consistent with applicable PDPL requirements.

The Company retains personal data only for as long as necessary to fulfill the purpose for which it was collected, subject to applicable legal, regulatory, contractual, audit, and dispute-related requirements. Personal data is stored on secure infrastructure in accordance with the policies of the National Cybersecurity Authority (NCA) of the Kingdom of Saudi Arabia, consistent with the Company's own cybersecurity services practice.

At the end of the applicable retention period, personal data will be securely deleted, destroyed, or anonymized using approved methods that prevent restoration or unauthorized retrieval.

The Company is committed to implementing technical and organizational measures to protect data from unauthorized access or use, consistent with applicable NCA frameworks including the Essential Cybersecurity Controls (ECC) and related cybersecurity governance requirements.

Subject to applicable legal limitations, these rights include:

• The right to be informed about the collection, legal basis, purpose, processing, storage, destruction, and disclosure of personal data.
• The right to access personal data held by the Company.
• The right to request access to personal data in a readable and clear format, where technically feasible.
• The right to request correction, completion, or updating of inaccurate or incomplete personal data.
• The right to request destruction of personal data where it is no longer necessary and where legal grounds allow.
• The right to withdraw consent for processing based on consent, unless another legal basis applies.
• The right to submit a complaint to the competent authority.

To exercise these rights, a data subject may contact the Company through the contact details stated in this Policy. The Company may request information necessary to verify identity before fulfilling a request.

The Company has designated the following contact for personal data protection matters:

• Department or title: Data Protection Officer – Samurai Systems
• Address: Office 304, Abdar Commercial Complex, Riyadh, Kingdom of Saudi Arabia
• Email: connect@samurai.systems

Users may submit privacy-related inquiries, requests, complaints, or objections using the contact details published in this Policy. The Company will acknowledge complaints within 7 working days and resolve them within the legally applicable or internally committed timeframe.

If a data subject is dissatisfied with the Company's response, or if the Company fails to respond within the stated period, the data subject may escalate the complaint to the competent authority in the Kingdom of Saudi Arabia, namely the Saudi Data & AI Authority (SDAIA), through the channels identified by the authority.

The website may contain links to external websites or platforms operated by third parties, including technology partners, regulatory authorities, or other organizations. The Company is not responsible for the privacy practices, content, or security of such third-party sites, and users should review the privacy notices of those sites before providing personal data.

The Company is committed to making this Privacy Policy available in a clear, accessible, and easy-to-understand format. This Privacy Policy will be made available to individuals before, or at the time, their personal data is collected through the website, Chat Wizard, electronic forms, email communications, or other appropriate channels.

The Company will use clear and appropriate language to help individuals understand how their personal data is collected, used, and protected. The Company may also provide supplementary links together with this Privacy Policy, including links to the Terms of Use, Cookie Policy, and other relevant legal notices, where applicable.

This Privacy Policy was last updated on 30 August 2026. The Company reviews this Privacy Policy periodically, and in any event whenever there is a material change in law, regulatory guidance, business practices, technologies, services, or website functionality.

Where material changes are made, the Company will take reasonable steps to notify users through the website or by other appropriate means.