Privacy Policy

Introduction

This privacy notice explains how Setup.sa collects and uses personal data, and describes the rights you have with respect to your personal data.

In this notice, “Setup,” “our”, “we” or “us” refers to Tasees & Daam Commercial Est.

Setup processes personal data for a variety of purposes. We collect this personal data directly from you, for example, if you engage us if you visit setup.sa (our Site), if you submit your contact details to receive marketing communications from us, if you submit event-related data to attend Setup events, or submit a job application via Setup careers form. Alternatively, we process your personal data in the context of providing professional services to your employer or service provider, for example, performing company incorporation for the company you work for. Finally, we obtain your personal data via publicly available sources, such as LinkedIn or other social media platforms. This privacy notice is intended to cover all of the above-mentioned scenarios.

If you have any questions regarding the processing of your personal data or wish to contact a data protection officer at Setup, please contact Setup team via [email protected] who will direct your query to the appropriate person or team within the organization.

What data is covered?

In this privacy notice, “personal data” means any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier. Personal data also refers to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of an individual.

It also includes special categories of personal data (special category data) from which we can determine or infer an individual’s

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Membership of a trade union
Genetic data
Biometric data
Physical or mental health or condition
Sex life or sexual orientation

As well as personal data relating to criminal convictions and offenses

Your rights in relation to personal data

You have the following rights in relation to your personal data:

To access the personal data held by Setup about you
To have your personal data corrected, for example, if it is incomplete or incorrect
To opt out of receiving marketing communications at any time
To restrict or object to the processing of personal data or request erasing personal data (in certain circumstances and subject to applicable law)
To receive a copy of the personal data which you have provided to Setup, in a structured, commonly used (in certain circumstances and subject to applicable law)
Where you have provided personal data voluntarily, or otherwise consented to its use, the right to withdraw your consent
The right to complain to a data protection authority (see section “Complaints ”)

If you have a query or wish to exercise your rights, please speak to the person you usually deal with at Setup or contact Setup team via [email protected]

Complaints

If you are concerned about an alleged breach of privacy law or any other regulation by Setup, you can contact the person you usually deal with at Setup or a Setup team leader, Office at 2915 Musa Ibn Nusair, Olaya, Riyadh, 12241, Saudi Arabia. A Setup team leader will investigate your complaint and give you information about how it will be handled.

You also have the right to complain to the data protection authority in your country, or refer the matter to a court of competent jurisdiction or as specified in any applicable engagement agreement with Setup.

Purposes for which we process personal data

Visitors to Setup.sa

Personal data that we collect about you when you visit our site falls into several categories.

Information that you provide voluntarily

We collect personal data that you provide voluntarily through our site, for example, when completing online forms to contact us, subscribing to a newsletter, using one of our online benchmark tools, subscribing to receive marketing communications from us, participating in surveys or registering for events that we are organizing. The information we collect about you include the following:

Name
Job title, job level or job function, role
Education
Company or organization
Company data
Contact information, including primary email, email address and telephone numbers
Demographic information, such as industry, country, postcode, preferences and interests
Other information relevant to client surveys or similar research
Information relating to events captured through event-related forms, such as dietary restrictions, hotel and flight information, registration/participation status, media interview attendance, previous event experience and gender
Information pertinent to fulfilling our services to you
Any other personal data that you voluntarily choose to provide to us

We do not intentionally collect sensitive category data, unless you provide us with such data. While there may be free text boxes on the site where you are able to enter any information, we do not intend to process sensitive information. You are not required to provide, and should not disclose, sensitive personal information in the free text boxes. If you choose to provide any sensitive personal information in this manner, you acknowledge your consent to the collection and processing of this sensitive information.

If you register on our site, your personal data will be stored in our CRM system . Data of registrants is deleted after an individual has not actively engaged with Setup for 36 months, or sooner if required by law.

If you have opted out of receiving Setup publications, your basic contact details will remain on our opt-out list.

Information that we collect automatically

When you visit our site, we collect certain personal data automatically from your device. Specifically, the data we collect automatically include information, such as your IP address, pixel ID, device type, unique device identification number, browser type, operating system, broad geographic location (e.g., country or city-level location) and other technical information. We also collect information about how your device has interacted with our site, including the pages accessed, current URL, time you visited the site and links clicked. Collecting this information enables us to better understand the visitors who come to our site, where they come from and what content on our site is of interest to them.

We use this information for our internal analytics purposes, and to improve the quality and relevance of our site to our visitors. Information will be collected using cookies and similar tracking technology. Note that if the Do Not Track setting or Global Privacy Control signal in your browser is enabled, Marketing/Targeting cookies will be disabled by default.

Our site uses Zoho CRM (“Zoho”) in order to provide reporting, visualizations and analysis of data. Zoho processes the following types of personal data: your IP address (to populate geosegmentation reports and to identify internal Setup and external users accessing our site) and user IDs, email addresses, names and passwords to the extent provided directly by visitors of the site. Your personal data will be processed by Zoho for the following purposes: (i) to capture web metrics about the journey of users within our site (e.g. pages viewed and links clicked); (ii) to analyze and understand overall site traffic information; (iii) to allow us to make informed decisions about our site; and (iv) to authenticate users and permit them to access our site.

Our site also uses various social media plugins.

Purposes for which we process your personal data as a visitor to our site are:

To administer and manage our site, including to confirm and authenticate your identity, and prevent unauthorized access to restricted areas of our site
To personalize and enrich your browsing experience by displaying content (including targeted advertising) that is more likely to be relevant and of interest to you
To analyze the data of visitors to our site and site traffic information
To capture webmetrics about the journey of users within our site
To determine the company, organization, institution or agency that you work for or with which you are otherwise associated
To develop our business and services
To provide you with marketing communications, materials and online benchmarking tools
To conduct benchmarking and data analysis (for example, regarding usage of our site and demographic analyses of visitors of our site)
To understand how visitors use the features and functions of our site
To monitor and enforce compliance with applicable terms of use and laws
To conduct quality and risk management reviews
To enable the better management of Setup events
To enable teams managing events to coordinate their email campaigns and event notifications more effectively
To allow for event and webinar sign-up
To allow for content download and lead capturing
To allow services and information to be delivered effectively to you
Any other purpose for which you provided information to Setup

Legal grounds for processing personal data of visitors of our site are:

Our legitimate interest in the effective delivery of information and services to you, and the effective and lawful operation of our businesses
Our legitimate interest in developing and improving our site, and your user experience
Explicit consent of the visitor

Clients

When you engage us to provide you with professional services, we collect and use personal data when we have a valid business reason to do so in connection with those services. For an overview of our services, click here.

In the context of providing professional services to clients, Setup also processes personal data of individuals who are not directly our clients (for example, employees, customers or suppliers of our clients). See the section “Individuals whose personal data we obtain in connection with providing services to our clients ” for additional information.

The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from third-party sources at the request of) our clients. Because of this, if you are a client of Setup, then it will generally be obvious to you what personal data we collect and use. This information can include:

Basic information, such as your name, the company you work for, your position and your relationship to a person
Contact information, such as your postal address, email address and telephone numbers
Financial information, such as payment-related information
Any other personal data relating to you or other third parties which you provide to us for the purpose of receiving our services

We use this information:

To provide services to you
To administer our relationship and maintain contractual relations
For accounting and tax purposes
For marketing and business development
To comply with our legal and regulatory obligations
To establish, exercise or defend legal rights
For historical and statistical purposes

Given the diversity of the services we provide, we process many categories of personal data. Please see below (non-exhaustive) examples of personal data categories for our four main service lines:

Advisory

In providing advisory services, Setup processes a wide variety of information, including potentially all types of personal data. The scope depends on the service and the sector in which Setup’s client is active.

Examples of personal data categories received or processed by Setup are:

Contact details, such as name, address, telephone numbers and email address
HR and supplier records of clients, which include personal details of employees or suppliers of the client, such as name, contact details, date of birth, race, government identification numbers, employment contracts and service contracts
Financial data, such as wage and salary information, pension and retirement benefits information, and bank account numbers
Health information about individuals receiving specific drugs or treatments
Personal data of employees potentially impacted by supply chain changes or outsourcing
Customer data, including race or gender during a customer experience engagement

It is important you provide us with all necessary information and documents as this affects our ability to provide services to you.

Legal grounds for processing personal data of our clients are:

Performance of a contract

Compliance with legal or regulatory obligations
Our legitimate interest in providing you with seamless, consistent, high-quality services and securing prompt payment of any fees, costs and debts in respect of our services
Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation
Our legitimate interest in safeguarding Setup against inadvertently dealing with the proceeds of criminal activities or assisting in any other unlawful or fraudulent activities (for example, terrorism)

Individuals whose personal data we obtain in connection with providing services to our clients

As part of the professional services Setup provides to clients, Setup processes personal data of individuals with whom we do not have a direct (contractual or other) relationship.

We seek confirmation from our clients that they have the authority to provide personal data to us in connection with the performance of the services and that any personal data they provide to us has been processed in accordance with applicable law.

Given the diversity of services we provide, we process many categories of personal data such as:

Personal details (such as name, age, date of birth, gender, marital status and country)
Contact details (such as phone numbers, email address and postal address)
Financial details (such as salary, payroll, income, investments, benefits and tax status)
Employment details (such as role, rank, experience, performance data and employment numbers)

For certain services, we also process special category data. Such data is collected intentionally and will be used only where necessary in connection with the provision of the service for which the data was collected.

Legal grounds for processing personal data of individuals whose personal data we obtain in connection with providing services to our clients are:

Compliance with a legal or regulatory obligation
Our legitimate interest in making sure our clients are provided with seamless, consistent and high-quality services worldwide

Contacts in our customer relationship management (CRM) systems

We process personal data about contacts (former, existing and potential clients and individuals employed by, or associated with, such clients and other business contacts, such as alumni, consultants, regulators and journalists) in our CRM systems. These CRM systems support the marketing operations of Setup. Contacts in our CRM systems will be sent Setup materials, newsletters, marketing materials, learning opportunities, surveys and invitations to events.

In our CRM systems, we process the following categories of personal data:

Name, job title, address, email address, phone and fax numbers
Name of employer or organization the individual is associated with
Marketing and user preferences including whether the individual has opted in to marketing communications
Invitation responses, reading activity and event attendance confirmations via the use of cookies and similar technologies to tailor our communications

Data of business contacts in our marketing databases who have not been actively engaged with Setup will be periodically deleted in accordance with applicable regulatory requirements. If you have opted out of receiving future Setup publications, your basic contact details may remain on our opt-out list.

Legal grounds for processing personal data of business contacts are:

Explicit consent of the business contact
Our legitimate interest in managing the relationship with our business contacts and providing information about Setup, our services and events we organize

Participants in Setup meetings, conferences, events and learning sessions

We process personal data about participants in Setup meetings, conferences, events and learning sessions (events). We use various applications to manage event registration processes, which applications will contain their own privacy notices explaining why and how personal data is collected and processed by these applications. We encourage participants to refer to the privacy notices available on those applications.

As part of our event management processes, we process the following personal data (but only to the extent required for a specific event):

Name, age or date of birth
Client personnel information (home, office and business information)
Credit or debit card number
Customer information (home, office and business information)
Email address
Gender
Home or other physical address
Names of employers
Occupation (job title)
Passport number
Personal web URL (if you have a personal website that you would like to share)
Telephone or fax numbers
Event-related data such as: Dietary restrictions or special requirements, registration status, participant status/type, media interview attendance, previous event experience, arrival time/departure time, hotel check-in/check-out time, flight information (airline, arrival and departure dates)

We do not intentionally collect sensitive category data, unless you provide us with such data (for example, special dietary requirements which reveal your religious affiliation or any food allergies or other data relating to your health necessary to provide support to participants, if needed, for example, if a wheelchair will be required).

Attendees of Setup events hosted at external venues are required to bring a photo ID for identification purposes to safeguard our people, assets and information, and to prevent unauthorized people gaining access to off-site Setup events.

Setup is allowed to take photographs and make audio or video recordings during Setup events. We use such media in our marketing materials. Images and voices of attendees will be recorded. Recordings will be edited, copied, exhibited, published or distributed.

Legal grounds for processing personal data of participants are:

Explicit consent of the participant
Our legitimate interest in organizing events and managing the registration process for such events.
Our legitimate interest in protecting our people, assets and information, and to prevent unauthorized people gaining access to off-site Setup events.
Our legitimate interest in providing information about Setup, our services and events we organize

Individuals who use our applications

We provide external users access to various applications managed by us (such as Setup Client Portal). In instances where such applications process personal data that goes beyond basic contact information used for application authentication purposes, such applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our applications to refer to the privacy notices available on those applications.

Individuals who visit our social media sites

Setup uses various social media platforms, for example, for recruitment or marketing purposes. We use social media to provide you with easy access to relevant information regarding job opportunities at Setup and events we organize, and to promote our services and brand.

While Setup will be responsible for the content it publishes using social media platforms, Setup will not be responsible for managing the social media platforms (such as creating user statistics or placing cookies). When using these social media platforms, you are obliged to adhere to the legal and privacy terms imposed by the social media platform providers. Such providers collect personal data about you, including statistical and analytical data regarding your use of the social media platforms, such as an overview of pages you have accessed, “likes,” recent visits, posts you publish or find interesting. If you require access to such data or want to invoke one of your other rights (such as the right to object to the processing of your data), you should contact the social media platform provider. Some social media providers provide Setup with aggregate data relevant for our pages, such as the amount of “likes” triggered by our content or the amount of posts, visitors to our sites, photos that are downloaded or links that are clicked.

Individuals who correspond with Setup via email

Setup uses a variety of tools to maintain the security of our IT infrastructure, including our email facilities. Examples of such tools are:

Systems that scan incoming emails to Setup recipients for suspicious attachments and URLs, in order to prevent malware attacks
Tools that provide end-point threat detection to detect malicious attacks
Tools that block certain content or websites

If you correspond via email with a Setup recipient, your emails will be scanned by the tools Setup operates to maintain the security of its IT infrastructure, which could result in content being read by authorized Setup persons other than the intended recipient.

Legal grounds for processing personal data of individuals who correspond with Setup via email:

Our legitimate interest in protecting our IT infrastructure against unauthorized access or data leakage
Our legitimate interest in analyzing email traffic

Individuals who correspond with Setup via phone and voicemail services

Setup’s phone service is hosted internally at Setup. When you call Setup personnel, only your phone number will be stored on Setup servers along with any other personal data you intentionally share with Setup team during the call. No other personally identifiable information is collected but technical logs and reports may be stored for troubleshooting purposes.

Setups’s voicemail service is provided by Salam Mobile. When you call Setup personnel and leave a voicemail, this voicemail and any personal data contained within it will be stored on Salam/Zain servers.

Legal grounds for processing personal data of individuals who correspond with Setup via phone and voicemail services:

Our legitimate interest in maintaining communication networks

Job applicants

We collect information from and about candidates in connection with available employment opportunities at Setup. The information that we collect, the manner in which it is used, and the timing in which it is gathered varies depending on the country in which you apply. As a general matter, the data we collect regarding our job applicants includes resumes or CVs, identification documents, academic records, work history, employment information and references.

We use your personal data to match your skills, experience and education with specific roles offered by Setup. This information is passed to the relevant hiring managers and persons involved in the recruitment process to decide whether to invite you for an interview. Setup will collect further information if you are invited to the interview (or equivalent) stage and onward. Such information includes interview notes, assessment results, feedback and offer details.

In connection with our recruitment activities including applications and onboarding, we also collect special category data from candidates where we have an employment law obligation to do so. This information is relevant to their future working environment at Setup or the future provision of employment benefits, or with the individual’s explicit consent, where collecting such information is permitted by law. For example, where allowed under applicable law, we will collect information about an individual’s disabilities in order to analyze the diversity of our workforce. Once onboarded, an individual’s provision of information regarding disabilities will also be used to provide a suitable working environment. We will also might need to conduct criminal background checks for certain candidates to assess their eligibility to work at Setup or for Setup clients. However, where a candidate does not voluntarily provide such information, we could be required by law to make our own assessment of such criteria.

Our recruitment tools and websites contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites.

Legal grounds for processing personal data of our job applicants are:

Explicit consent of the candidate
Our legitimate interest in attracting, identifying and sourcing talent
Our legitimate interest to process and manage applications for roles at Setup, including the screening and selecting of candidates
Our legitimate interest to hire and onboard candidates by making an offer to successful candidates, and carrying out pre-employment screening checks
Our legitimate interest to manage our career websites (including conducting statistical analyses)
Compliance with a legal or regulatory obligation (when carrying out background checks to warrant a candidate is eligible to work)

Visitors to Setup offices

When you visit a Setup office, we process your personal data in order to provide you with certain facilities (such as access to our buildings and conference rooms), to protect our offices, personnel, goods and confidential information (for example, by using CCTV).

The personal data we collect is generally limited to your name, contact information, location, and the time you enter and leave our office.

Legal grounds for processing personal data of visitors to EY offices are:

Our legitimate interest in protecting our offices, personnel, goods and confidential information
Our legitimate interest in preventing and detecting crime, and establishing, exercising and defending legal claims

Other Disclosures

Setup discloses your personal data:

Where this is appropriate for the purposes described in the section “Purposes for which we process personal data,” including within Setup organization itself
If required, by applicable law
In connection with a reorganization or combination of our organization with another organization
If we believe that such disclosure is appropriate to enforce or apply terms of engagement, and other agreements or otherwise protect and defend Setup rights, property or safety
In order to comply with a judicial proceeding, court order or other legal obligation, or a regulatory or government inquiry
To Setup partners and consultants for additional service provision if needed
With government authorities when required in the case of completing governmental processes on your behalf

With your consent

We would like to draw particular attention to the fact that in certain jurisdictions, Setup has a legal obligation to report suspicious transactions and other activity to relevant regulatory authorities under anti-money laundering, terrorist financing, insider dealing or related legislation. Setup also reports suspected criminal activity to the police and other law enforcement bodies. We are not always permitted by the law to inform you about this in advance of the disclosure, or at all.

Third-party recipients of personal data include:

Professional advisors, such as law firms
Insurers
Regulatory and other professional bodies
Public registries of company directors and shareholdings
Providers of identity verification services
The courts, police and law enforcement agencies
Government departments and agencies
Service providers
Support providers
Consultants (full-time, part-time and freelancers)

Security

Setup protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure.

Keeping your personal data up-to-date

We maintain the accuracy and completeness of the personal data we hold. It is important that you inform us of any updates to your contact details or other personal data so that we have the most up-to-date information about you. Please contact the person you usually deal with at Setup. You can also contact [email protected]

Retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Purposes for which we process personal data.” Note that retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights, and for archiving and historical purposes we need to retain information for significant periods of time.

Changes to the privacy notice

We will occasionally update this privacy notice to reflect changes in our practices and services. When we post changes to this privacy notice, we will revise the “last updated” date at the top of this privacy notice. If we make any material changes in the way we collect, use, and share personal data, we will notify you by prominently posting notice of the changes on the website. We recommend that you check this page from time to time to inform yourself of any changes in this privacy notice.

Setup360

Setup Connect