Privacy notice
How OraBlink collects, uses, keeps and protects personal data, and the rights you have under the Saudi Personal Data Protection Law (PDPL).
Who we are
OraBlink is a sustainability reporting service for businesses, operated by OraBlink Company, Commercial Registration 7054814541, registered address Dammam, Kingdom of Saudi Arabia.
Privacy contact, for any question or request about personal data, for notices under the data processing terms and to report a personal data breach: privacy@orablink.com.
Two kinds of data
Your account. The data about you as a user of OraBlink (name, work email, sign in details). OraBlink decides why and how this is processed.
Your company's records. The sustainability data your company enters (bills, sites, suppliers, emissions, evidence, reports). Your company decides what goes in and why; OraBlink processes it to provide the service your company signed up for. Where this data names a person (for example a supplier contact or a person in an uploaded document), your company is responsible for informing that person.
So: for the report and company data your company enters, your company is the controller and OraBlink Company is its processor (see the data processing terms). For the account and sign in data of users, and for OraBlink's own website and messages, OraBlink Company is the controller.
What we collect and why
| Data | Purpose | Required? |
|---|---|---|
| First and last name, your company e-mail address, company name; job title, phone, country and city if you add them | Create and run your account, show who entered or approved a record | Name, email and company are required to open an account; the rest is optional |
| Password (kept only as a one way bcrypt hash), authenticator secret and backup codes if you turn on two step sign in, passkeys if you add one | Sign you in securely | A password is required |
| Sessions: the browser (user agent) and IP address of each sign in | Security: show and end your active sessions, detect misuse | Required while you are signed in |
| Audit log: who did what and when (records entered, changed, approved, signed in) | Your company's control and assurance trail | Required; it cannot be switched off |
| Whether you agreed to product update emails, and when you accepted these terms | Send updates only if you asked; prove acceptance | Updates are optional |
If required data is not given, an account cannot be opened or used. We do not use your personal data for any other purpose than those listed, and we do not sell it. No decision about you is made by automated processing alone.
Legal basis
Account and security data: processing needed to perform the agreement you or your company entered into with OraBlink (PDPL Article 6(2)). Session and audit records: also OraBlink's legitimate interest in keeping the service secure, with no sensitive data processed (Article 6(4)). Product update emails: your consent (Article 5), which you can withdraw at any time.
Who receives it
Inside OraBlink, only the people who run the service. Inside your company, the colleagues your company has given access, according to their role. Outside OraBlink:
- Hosting: LightNode (lightnode.com), Riyadh II data centre, Kingdom of Saudi Arabia. Customer data is stored and processed in the Kingdom.
- E-mail delivery: Google (smtp-relay.gmail.com) relays the e-mails OraBlink sends (sign in codes, invitations, password resets, security notices, daily reminders). It receives the recipient's name and e-mail address and the text of the message, only to deliver it.
- An authority, when a law requires it.
Transfers outside the Kingdom: only the e-mail relay (Google). They are made as the PDPL allows (Article 29 and the Regulation on Personal Data Transfer outside the Kingdom).
How long we keep it
- Sign in session: 7 days, 12 hours for owners, administrators and approvers.
- Your company's data: for the subscription term and 90 days after it ends, then deleted.
- Audit log: write once, so that your company's records can be assured; kept for the subscription term.
- Backups: a nightly copy, the newest 14 kept, so deleted data leaves the backups within 14 days.
- Longer only where a law requires a minimum period.
You can ask for your personal data to be deleted (PDPL Articles 4 and 18) by writing to privacy@orablink.com.
When data is no longer needed it is destroyed, or kept only in a form that cannot identify you (PDPL Article 18).
How we protect it
Passwords are stored only as a one way hash. Two step sign in is required for approving, locking, publishing and managing the team; passkeys can be added. The sign in cookie cannot be read by scripts and is sent only over an encrypted connection. Every change is written to a tamper evident audit log. Your company's records are never kept in your browser: they stay in the page's memory and are cleared when you sign out or switch company.
Your rights
Under PDPL Article 4 you have the right to:
- be informed of the legal basis and purpose of the collection (this notice);
- access your personal data;
- obtain a copy of it in a readable, clear format;
- ask for it to be corrected, completed or updated;
- ask for it to be destroyed when it is no longer needed, unless a law requires it to be kept (Article 18);
- withdraw your consent at any time where processing is based on consent (Article 5); this does not affect processing done before.
You can change your profile in Settings, and an administrator can download your company's data from Settings. For any other request write to privacy@orablink.com. We confirm who you are before acting, and answer within 30 days; if a request needs disproportionate effort we may extend this once by up to 30 days and tell you why beforehand (Implementing Regulations Article 3).
You may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) within 90 days of the event or of when you became aware of it (PDPL Article 34, Implementing Regulations Article 37).
Changes
If this notice changes, the new version is published here with its date. If we want to use personal data for a new purpose, we tell you before doing so (Implementing Regulations Article 4(6)).
Go to OraBlink