Privacy policy

Who we are

This website is run by Hills and Field Company Limited ("Hills & Field", "we"), an environmental consultancy registered in Saudi Arabia, at PO Box 14, Al Khobar 31952, Saudi Arabia. We are the controller of the personal data described here, as the term is used in the Personal Data Protection Law.^{1Personal Data Protection Law, issued by Royal Decree No. M/19 dated 9/2/1443H (16 September 2021), amended by Royal Decree No. M/148 dated 5/9/1444H (27 March 2023). In force from 14 September 2023.}

What we collect

When you contact us

When you send a request through our form, we receive your name, email address and project location, the service you choose and your message. Your company name and phone number are optional. If you email, call or message us on WhatsApp, we receive what you choose to send.

When you browse the site

The site remembers two choices in your browser: your cookie choice and whether you prefer the light or dark theme. If you accept advertising cookies, Google collects information about how you reached and used the site. See Cookies and browser storage.

Our website host keeps standard server logs, such as IP addresses and the pages requested, to run and protect the site.

Our host, Manus, also measures how the site is used. On every page it records the page address and title, the page you came from, your screen size and browser language, and which pages you view and click. It does not set cookies. We use these figures only to see which pages are useful and to improve the site.

We do not ask for sensitive data, and we ask you not to include it in your message.

How we use it

• To reply to your request and prepare a proposal.
• To deliver the services you engage us for, under a separate agreement.
• To keep business and accounting records the law requires.
• To measure whether our advertising works, only if you accept advertising cookies.
• To understand how the site is used, through page-view statistics from our host.

We use your data only for these purposes. We do not sell personal data, we do not use it for marketing emails unless you ask us to, and we make no automated decisions about you.

Why we are allowed to use it

The Personal Data Protection Law allows us to use personal data in these cases:

• To reply to your request and prepare a proposal, because you asked us to and it is a step towards an agreement with you or your company.
• To deliver our services, because it is needed for the agreement you or your company are party to.
• To keep business, tax and accounting records, because the law requires it.
• To measure our advertising. Advertising cookies are used only with your consent, which you can withdraw at any time. Without consent, only the limited, cookie-free signal described under Cookies is sent.
• To measure how the site is used, because running and improving our website is a legitimate interest of ours, and the statistics do not affect your rights.

Who we share it with

We use a small number of service providers, who handle data only to provide their service to us:

• Formspree receives what you send through the contact form and passes it to our email.
• Google provides advertising measurement, only after you accept advertising cookies.
• Manus, our website host, stores and delivers the site, keeps server logs and provides the page-view statistics described above.
• Our email provider stores and delivers our email.

We may also disclose data where the law requires it, for example to a regulator or a court.

Transfers outside the Kingdom

Formspree, Google and Manus may process data on servers outside Saudi Arabia. Where that happens we limit the data to what is needed for the purpose, and rely on the conditions for transfer set out under the Personal Data Protection Law and its transfer regulation.^{2Regulation on Personal Data Transfer outside the Kingdom, issued under the Personal Data Protection Law.}

How long we keep it

• Enquiries that do not lead to a project are deleted within two years of our last contact with you.
• Client and project records are kept for as long as the engagement and Saudi commercial, tax and environmental record-keeping rules require.
• Server logs and page-view statistics are kept only as long as our website host needs them to run, protect and measure the site.

When we no longer need personal data, we delete it or make it anonymous so it can no longer identify you.

Your rights

Under the Personal Data Protection Law you have the right to:^{3Personal Data Protection Law, data subject rights, with the Implementing Regulation (response within 30 days).}

• Be told how your personal data is collected and used, which is what this policy does.
• Access your personal data and get a copy of it in a clear, readable format.
• Ask us to correct data that is wrong, incomplete or out of date.
• Ask us to delete data we no longer need.
• Withdraw your consent at any time, for example to advertising cookies.

To use any of these rights, email info@hillsnfield.com with "Privacy request" in the subject. We may ask you to confirm your identity before we act on the request. We will reply within 30 days. If you are not satisfied with our reply, you can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), the authority that oversees the law.

Cookies and browser storage

Essential storage keeps the site working and needs no consent. Google Ads cookies are set only if you choose Accept all. If you choose Essential only, or make no choice, Google still receives a limited signal when a page is viewed, a form is sent or a phone or WhatsApp link is clicked. That signal uses no cookies and no advertising identifiers, and it lets us count, in total, how many enquiries come from our ads.

You can change your choice at any time with Cookie settings, also at the foot of every page, or by clearing site data in your browser.

Security and data breaches

The site is served over an encrypted connection, and access to enquiries is limited to the staff who need them. No system is completely secure, so please do not send passwords or financial details through the form.

If a breach affects personal data we hold, we will notify SDAIA and, where it could harm you, tell you what happened and what you can do, as the law requires.

Children

This website is meant for businesses and professionals. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

We will update this page when our practices or the law change, and show the date of the latest version at the top.

Contact us

Hills and Field Company Limited, PO Box 14, Al Khobar 31952, Saudi Arabia. info@hillsnfield.com, +966 56 088 7422.