Privacy Policy PDPL Compliant
Effective Date: 1 January 2025 | Version: 1.0 | Last Updated: August 12, 2026
1. Data Controller Identity
The DTV (Digital Technology Ventures) Portal is operated by DTV Ventures ("we", "us", "our"). We are the data controller responsible for personal data processed through this portal in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
Data Protection Contact: privacy@dtv.sa
2. Categories of Personal Data Collected
| Category | Examples | Source |
|---|
| Identity Data | Full name, national ID number | Provided by you |
| Contact Data | Email address, phone/WhatsApp number | Provided by you |
| Business Data | Company name, CR number, business sector, pitch materials | Provided by you |
| Application Data | Programme application responses, documents, files | Provided by you |
| Technical Data | IP address, browser type, session tokens, login timestamps | Automatically collected |
| Communication Data | Messages, OTP delivery logs | Automatically generated |
3. Purpose of Processing
- Evaluating and managing applications to DTV programmes and cohorts
- Communicating application status, decisions, and programme updates
- Delivering OTP authentication codes for secure login
- Maintaining audit trails for regulatory compliance (NCA, SAMA, CITC)
- Analysing programme performance and reporting to stakeholders
- Complying with Saudi legal and regulatory obligations
4. Legal Basis for Processing
- Contractual necessity: Processing required to manage your programme application (PDPL Art. 6)
- Legitimate interests: Security monitoring, fraud prevention, and audit logging
- Legal obligation: Compliance with NCA ECC, SAMA CSF, and Saudi PDPL
- Consent: Where explicitly obtained (e.g. marketing communications)
5. Data Retention
| Data Type | Retention Period |
|---|
| Application records | 7 years from programme end |
| Session tokens | 24 hours (admin) / 7 days (portal) |
| Audit logs | 5 years (NCA ECC 3-4-1 requirement) |
| OTP codes | 10 minutes from issue, then purged |
| Consent records | 7 years from consent date |
| Uploaded documents | Duration of programme + 3 years |
6. Your Rights Under PDPL
As a data subject, you have the following rights under the Saudi Personal Data Protection Law:
- Right of Access (Art. 4): Request a copy of personal data we hold about you
- Right to Correction (Art. 4): Request correction of inaccurate or incomplete data
- Right to Erasure (Art. 9): Request deletion of your data, subject to legal retention requirements
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based
- Right to Object: Object to processing based on legitimate interests
To exercise any of these rights, submit a secure request via the Data Subject Request portal (email verification included), or contact: privacy@dtv.sa. We will respond within 10 business days.
7. Data Security Measures
We implement technical and organisational measures in compliance with NCA ECC-1:2018 and ISO 27001:2022, including:
- AES-256-GCM encryption for sensitive fields at rest
- PBKDF2-SHA256 (600,000 iterations) for password hashing
- TLS 1.2+ for all data in transit with HSTS preload
- Role-based access control (RBAC) with least-privilege enforcement
- Immutable audit logging for all privileged operations
- Account lockout after 5 consecutive failed login attempts
- HttpOnly, Secure, SameSite session cookies
8. Data Sharing and Third Parties
We do not sell your personal data. We may share data with:
- Cloudflare Inc.: Infrastructure and edge security (data processed in accordance with Cloudflare DPA)
- Brevo (Sendinblue): Transactional email and OTP delivery
- AI Providers: Anonymised or pseudonymised pitch data for AI ranking (no PII transmitted)
- Regulatory Authorities: When required by Saudi law
9. Cross-Border Data Transfers
Some service providers operate outside Saudi Arabia. All cross-border transfers comply with PDPL Chapter 6 and are subject to adequate data protection guarantees or contractual safeguards.
10. Cookies and Technical Tracking
This portal uses strictly necessary session cookies (dtv_portal_token) for authentication. No advertising or analytics cookies are set. Session cookies expire automatically after 7 days of inactivity.
11. Contact and Complaints
For privacy enquiries: privacy@dtv.sa
To file a complaint with the Saudi Data & AI Authority (SDAIA): sdaia.gov.sa
← Back to Portal