Privacy Policy

Hills & Field Environmental Consultancy ("Hills & Field", "we", "us", or "our") is an NCEC-approved environmental and sustainability consultancy firm headquartered in Al Khobar, Kingdom of Saudi Arabia. We are committed to protecting the privacy and personal data of all individuals who interact with our website at www.hillsnfield.com ("Site") and our professional services.

This Privacy Policy explains what personal information we collect, how we use and protect it, and your rights in relation to it. By using our Site or engaging our services, you agree to the practices described in this policy.

2.1 Information You Provide Directly

When you contact us, request a consultation, or engage our services, we may collect:

• Full name and job title
• Company or organisation name
• Business email address and telephone number
• Project details, site location, and scope of work
• Any other information you include in enquiry forms or correspondence

2.2 Information Collected Automatically

When you visit our Site, we and our technology partners may automatically collect:

• IP address and approximate geographic location
• Browser type, version, and device information
• Pages visited, time spent on pages, and navigation paths
• Referring website or search query
• Cookies and similar tracking technologies (see Section 7)

2.3 Information from Third Parties

We may receive information about you from publicly available sources, referral partners, or professional directories in connection with potential business engagements.

We process your personal data for the following purposes and on the following legal bases:

• To respond to your consultation requests and provide our environmental and sustainability services (performance of a contract / pre-contractual steps)
• To comply with our legal and regulatory obligations, including NCEC and Saudi Arabian environmental law requirements
• To improve our Site, services, and marketing communications through analytics
• To manage our business operations, including invoicing, record-keeping, and risk management
• To detect and prevent fraud, security incidents, or misuse of our services

Hills & Field does not sell, rent, or trade your personal information. We may share it with:

• Service providers and subcontractors who assist us in delivering our services, bound by confidentiality obligations
• Regulatory and government bodies where required by applicable law or project permitting requirements
• Professional advisers such as lawyers, auditors, and insurers in connection with our business operations
• Prospective buyers or investors in the event of a merger, acquisition, or business transfer, subject to appropriate confidentiality protections

We require all third parties to handle your data securely and in accordance with applicable privacy law.

Our operations are primarily based in the Kingdom of Saudi Arabia. Where we transfer data to service providers located outside Saudi Arabia, we take appropriate measures to ensure adequate levels of data protection consistent with applicable law and industry best practice.

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or regulatory reporting requirements. In general:

• Client and project data is retained for a minimum of seven (7) years following project completion
• Marketing contact data is held until you withdraw consent or request deletion
• Website analytics data is retained in aggregated or anonymised form

Our Site uses cookies and similar technologies to enhance user experience and gather analytics. Categories of cookies we use include:

• Essential cookies: Required for the Site to function correctly
• Analytics cookies: Help us understand how visitors interact with the Site (e.g., page views, traffic sources)
• Preference cookies: Remember your settings and choices

You may control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Site. We will request your consent for non-essential cookies upon your first visit, in accordance with applicable law.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include secure servers, access controls, and staff training on data handling obligations.

No transmission of data over the internet is entirely secure. While we take all reasonable precautions, we cannot guarantee the absolute security of information transmitted to our Site.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data where we no longer have a lawful basis to retain it
• Object to or restrict our processing of your data in certain circumstances
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us using the details in Section 11 below. We will respond to your request within a reasonable timeframe.

Our Site may contain links to third-party websites, including those of clients, regulators, and industry bodies. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us:

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be posted on this page with a revised effective date. We encourage you to review this policy periodically.