Who we are
The Saudi Developers Community (the "Community", "we") is a non-profit technology community in the Kingdom of Saudi Arabia. We run this platform (sdcsa.org) and are responsible for the personal data collected here.
This notice follows the Kingdom's Personal Data Protection Law (Royal Decree M/19 dated 9/2/1443 AH, as amended) and its implementing regulations, and it also respects the principles of the General Data Protection Regulation (GDPR) for visitors from Europe and the United Kingdom.
What we collect
- Your account: e-mail address, name and password. The password is stored encrypted by the authentication provider; none of us can read it.
- Event registration: name, e-mail address and phone number, optionally your university or workplace, and answers to the organizers' questions if there are any.
- Membership application: your name in Arabic and English, e-mail, phone, gender and year of study (for community statistics), university, major and track, preferred committee, bio and links, answers to the cycle's questions, and when you accepted which version of this notice.
- Member profile: what you add yourself: photo, headline, bio, skills, projects, links and interests, plus your membership number, its dates and your digital card token.
- Attendance and certificates: your check-ins to event sessions (how and when), your attendance percentage and the certificate issued to you (created on request and e-mailed to you; no copy is stored).
- Messages: a log of the messages sent to you (type, time and delivery status).
- Security: your network address (IP) turned into an irreversible hash, used to stop abuse and deleted within a day; and an audit log of administrative actions, kept for accountability.
- Browsing: aggregate statistics about visits and page performance, without cookies and without building a profile of any individual.
We do not ask for national ID numbers, health, religious or financial data, and we do not collect sensitive data as the law defines it.
Why we use it, and on what basis
- With your consent: processing your membership application, showing your profile in the public directory (hidden until you choose), your photo and any field you decide to show. You can withdraw consent at any time.
- To provide what you asked for: running events, sending confirmations, reminders and certificates, and issuing your membership card.
- For the Community's legitimate interest: protecting the platform from abuse and fraud, producing aggregate statistics that do not identify people, and improving the service.
- To meet legal obligations: when a competent authority makes a lawful request.
We do not sell your data, we do not use it for advertising, and we make no automated decisions that affect you: people review every membership application.
Who can see your data
- You, through your account or the links sent to you.
- Event organizers, reviewers and Community leadership, only within their permissions; every administrative access is logged.
- The public: your e-mail and phone are never shown to anyone. Your profile appears in the public directory only if you choose, field by field. The membership card verification page shows only the name, membership number and status, to someone who holds the card's code.
- Technical service providers (hosting, database and e-mail delivery) that process data for us under contract and are bound to protect it.
- Authorities, when the law requires it.
How we protect it
Encrypted connections (HTTPS) at all times; permissions based on role and committee enforced in the database itself; limits on sign-in and sending attempts to stop guessing and abuse; an audit log of administrative actions; and secrets kept separate from the platform's data. If a breach puts your data at risk, we will tell the competent authority and you within the time the law sets.
How long we keep it
- Rejected or withdrawn membership applications: two years, then the personal data is anonymized.
- Event registrations: three years after the event, then anonymized; the statistical counts remain.
- Message log: one year.
- Abuse-prevention hashes: one day.
- Members: we keep your membership data while you are a member; afterwards we keep the minimum (name, membership number and dates) so we can confirm past membership, unless you ask us to delete it.
- Audit log: an unalterable record of administrative actions, kept for accountability and security and reviewed periodically.
When you ask for deletion we replace everything that identifies you with anonymous values wherever we hold it; aggregate statistics remain, and we answer within 30 days.
Your rights
Under the law you may be informed about how your data is processed, access it, obtain a copy, have it corrected, have it destroyed (deleted), and withdraw your consent. Under the GDPR you may also object to processing, restrict it and port your data.
- Members: in My data in your account you download your data and request account deletion; in My profile you edit your data and decide what the public sees.
- Everyone else: write to the address below from the e-mail you registered with.
If you believe your rights were not respected you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), or to the supervisory authority in your country if you are in Europe or the United Kingdom.
Cookies and local storage
We use only what is necessary: a cookie for your sign-in session, your language preference, and your light or dark theme preference in your browser. We use no advertising cookies and nothing that follows you across sites, so we show no cookie banner.
Children and minors
The platform is meant for adults. If you are under 18, your guardian's consent is required; if a minor's data was collected without it, write to us and we will delete it.
Changes to this notice
The top of the page shows its version and date. If we make a material change we will tell you on the site or by e-mail, and ask for your consent again where needed.
Contact
Write to us at: info@sdcsa.org
For any question or request about your personal data, use this address and we will reply within 30 days.