Privacy Policy & Data Protection (Saudi PDPL Aligned)

1. Data Controller Identity & Corporate Governance

Nexus AI & IoT is a technology product of International Business Front (IBF). International Business Front (IBF) ("we", "us", or "our") acts as the operating commercial entity and data controller for personal data processed through our website (nexusaiiot.com) and associated digital twin portals in compliance with the Saudi Personal Data Protection Law (PDPL). Official corporate registration and verified business details are as follows:

• Operating Legal Entity: International Business Front (IBF), Saudi Arabia
• Unified National Number / Corporate Identifier: 7023268134
• VAT Registration Number: 310921625400003
• Headquarters / Registered City: Jeddah, Kingdom of Saudi Arabia
• Data Protection & Privacy Inquiries: ms@nexusaiiot.com
• Official Corporate Email: ms@ibf.com.sa
• Corporate Operations Phone: +966 55 757 1816
• Customer Sales & WhatsApp Contact: +966 59 616 5253

2. Scope & Regulatory Applicability

This Privacy Policy governs the collection, processing, storage, transfer, and protection of personal data belonging to website visitors, commercial clients, engineering partners, and prospective customers in the Kingdom of Saudi Arabia, in compliance with the Saudi Personal Data Protection Law (PDPL, Royal Decree No. M/19, as amended by Royal Decree No. M/148) and its Implementing Regulations issued by the Saudi Data & AI Authority (SDAIA).

3. Personal Data Collected

We collect personal data directly when you interact with our commercial contact, quote, and demonstration forms, as well as technical session metadata:

• Commercial Inquiries & RFQs: Full name, job title, corporate entity name, professional work email, and contact phone number.
• Technical Asset Context: Substation voltage rating, asset counts, sensor configurations, and project deployment timelines.
• Session Metadata: IP address, coarse geographic location, browser user-agent, preferred locale (en/ar), and digital twin interactions.

4. Lawful Bases for Processing (Articles 5 & 6 PDPL)

Under Articles 5 and 6 of the Saudi PDPL, personal data is processed strictly under legitimate statutory grounds: (a) Performance of pre-contractual steps (evaluating RFQs, preparing proposals, and arranging engineering demonstrations); (b) Explicit affirmative consent (for non-essential analytical or advertising cookies, with the full right of withdrawal at any time); (c) Legitimate interests (ensuring cybersecurity of infrastructure and optimizing WebGL simulation reliability); and (d) Statutory legal compliance under applicable Saudi Arabian laws.

5. Digital Twin Demonstrations & Synthetic Telemetry

All 13 interactive digital twins accessible on nexusaiiot.com operate entirely on simulated, synthetic mathematical telemetry. Nexus does not ingest, stream, or connect to private live operational technology (OT) networks or customer SCADA systems through public website browsers.

6. Prior Consent for Cookies & Advertising Pixels

In compliance with the Saudi PDPL, analytics and advertising technologies (including Google Ads and LinkedIn Insight Tags) remain disabled by default. They are only loaded after explicit affirmative opt-in via our Cookie Preference Center. You maintain the absolute right to reject non-essential cookies or withdraw your consent at any time using the link in the footer.

7. Third-Party Processors & Infrastructure

We process personal data using reputable technical infrastructure providers bound by contractual data protection standards: Cloudflare, Inc. (secure edge CDN and Worker execution); Resend API (encrypted internal notification dispatch for sales engineers); and WhatsApp/Meta (only when you initiate a conversation via our official WhatsApp gateway). We never sell or lease personal data to commercial data brokers.

8. Data Retention & Cross-Border Sovereign Transfers

Commercial RFQ inquiries are retained for up to three (3) years from last active business communication, or as required by Saudi commercial accounting and tax regulations. Prioritizing sovereign local data hosting, any international edge routing conforms to the PDPL Regulations on Personal Data Transfer Outside the Kingdom with recognized adequacy safeguards.

9. Data Subject Rights under the Saudi PDPL

Under Chapter 3 of the Saudi PDPL, you have the statutory right to: (1) Right to Know the purpose and legal basis of data collection; (2) Right to Access a copy of your personal data; (3) Right to Correction and Rectification; (4) Right to Erasure / Destruction when data is no longer necessary; and (5) Right to Withdraw Consent freely at any time.

10. Exercising Rights & Regulatory Complaints to SDAIA

To exercise any of your statutory rights, submit a formal request to ms@nexusaiiot.com. We respond to verified requests within thirty (30) days without undue delay. If you believe your rights under the PDPL have been infringed, you have the statutory right to lodge a formal complaint with the Saudi Data & AI Authority (SDAIA) via their official portal at sdaia.gov.sa.