Privacy Policy
Althoria Harbor – Certified Public Accountants and Auditors (AHCPA)
Last Updated: October 20, 2026
1. Introduction
Althoria Harbor– Certified Public Accountants and Auditors (AHCPA) is committed to protecting the privacy of visitors to its website and its clients, and to maintaining the confidentiality of their personal, professional, and financial data.
This policy explains how personal data is collected, used, processed, stored, protected, and shared, as well as retention periods and related rights, in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations.
Using the website or submitting data through it constitutes an acknowledgment of having reviewed this policy, and does not in itself constitute consent to any processing that requires independent consent.
2. Details of the Data Controller
Entity Name: Al-Thuraya Harbour – Certified Public Accountants and Auditors (AHCPA)
Commercial Registration No.: 7033290185
Professional License No.: 965
Location: Jeddah, Kingdom of Saudi Arabia
Website: www.a-hcpa.com
General Email: info@a-hcpa.com
Unified Number: 8002440287
Dedicated Privacy Email: [Add the company's approved official email]
Al-Thuraya Harbour is the controller responsible for processing the personal data it collects for its own purposes, according to the nature of the processing and the relationship with the data subject.
3. Personal Data We Collect
We may collect and process the following categories of data depending on the nature of the user's interaction with the website or services:
A. Identification and Contact Data
Full name.
Phone number.
Email address.
Job title.
Entity name and professional contact information.
B. Inquiries and Service Requests Data
Information submitted through contact forms.
Type of service requested.
Details of inquiries and correspondence.
Information necessary for preparing professional service proposals.
C. Professional and Financial Data
Data provided by clients within the professional relationship may include:
Financial statements and reports.
Accounting records and documents.
Zakat and tax data.
Financial and operational information relevant to the agreed services.
This information is subject to applicable professional confidentiality rules and statutory and contractual obligations.
D. Technical Data
May include:
Internet Protocol (IP) address.
Device type, operating system, and browser.
Pages visited.
Interaction data with the website.
Cookies and similar technologies, depending on the enabled tools.
4. Purposes of Processing Personal Data
Data is processed for the following purposes:
Responding to inquiries and contact requests.
Providing professional services in auditing, accounting, Zakat, tax, and advisory.
Managing contractual relationships with clients.
Preparing service proposals and following up on requests.
Fulfilling statutory, regulatory, and professional obligations.
Improving website performance and user experience.
Maintaining the security of the website and associated systems.
Measuring marketing campaign performance and analyzing engagement, upon enabling appropriate tools and meeting legal requirements.
Sending marketing materials and professional updates when a legal basis exists and obtaining consent whenever required.
5. Legal Basis for Data Processing
Personal data is processed in accordance with appropriate legal bases, which may include:
Consent of the data subject when required.
Performance of an agreement to which the data subject is a party.
Compliance with a legal obligation.
Pursuit of a legitimate interest in cases permitted by law, after taking into account the rights and interests of data subjects.
The appropriate basis is determined according to the type of data and the purpose of the processing.
6. Personal Data Retention Periods
Al-Thuraya Harbour retains personal data for the period necessary to achieve the purpose for which it was collected, or to fulfill statutory, professional, and contractual requirements.
Retention periods are determined by data category as follows, upon adoption of the company's official retention schedule:
Data Type Retention Period Contact form and inquiry data: a period of 12 months from the last contact. Client and contract data: a period of 12 months. Audit documents and professional files: a period of 12 months. Accounting, Zakat, and tax data: a period of 12 months. Analytics data and usage logs: a period of 12 months. Marketing consent data: a period of 12 months.
The retention period begins from the event specified for each category, such as the termination of the professional relationship, closing of the request, or expiration of the processing purpose, as the case may be.
Upon expiration of the period and in the absence of a legal justification for retaining the data, it is deleted, securely destroyed, or anonymized where appropriate.
Certain data may continue to be retained for a longer period in the presence of a statutory obligation, legal claim, or professional requirement that permits doing so.
Adoption Note: All fields above must be replaced with actual periods prior to publishing the policy. The examples provided are not periods approved by AHCPA.
7. Data Sharing and Third-Party Service Providers
Al-Thuraya Harbour may engage third-party service providers to operate the website and manage communications and technical systems, strictly within the scope of actual need and in compliance with applicable regulations.
Categories of service providers may include:
A. Website Hosting and Operation
Framer: The website design and hosting platform, in the event it continues to be used to host the published site.
B. Customer Relationship Management
Customer Relationship Management (CRM) System: The system used to receive, organize, and follow up on contact requests, including forms linked to the website.
Approved Provider Name: Firaq Software
C. Analytics and Advertising Services
May include website performance analytics tools and advertising campaign measurement tools, if enabled, such as:
Google Analytics.
Google Ads.
Meta Pixel.
Any other analytics or tracking tools actually used by the company.
Mentioning these tools does not imply that all of them are enabled on the website.
D. Communication Services
May include email services, WhatsApp, or systems used to manage correspondence, depending on the available communication channels.
Data Sharing Controls
The company ensures, according to the role of each party and the nature of the service, to:
Share the minimum necessary data.
Specify permitted processing purposes.
Implement appropriate measures to protect data confidentiality.
Govern the relationship with data processors in accordance with regulatory requirements.
Prohibit the use of data for unauthorized purposes.
The company does not sell personal data.
The final list of actual service providers must be approved before publishing this policy.
8. Cookies and Consent Mechanism
The website may use cookies and similar technologies to run essential functions, enhance user experience, and analyze website performance.
Types of Cookies
Strictly Necessary Cookies: Used to operate the website and core functions, and do not require consent when they are necessary and legally permissible.
Analytical Cookies: Help understand how visitors use the website and improve its performance.
Marketing Cookies: May be used to measure advertising campaign results or customize advertisements, if enabled.
Consent Acquisition Mechanism
When using non-essential cookies that require consent, the website provides a clear notice allowing the visitor to:
Accept optional cookies.
Reject non-essential cookies.
Customize their preferences according to cookie categories.
Modify or withdraw their consent later through available privacy settings.
Non-essential cookies requiring consent are not activated prior to obtaining the appropriate consent.
Consent must be voluntary and explicit, without considering continued browsing alone as explicit consent where the law requires otherwise.
Managing Consent
Visitors can manage their choices through the cookie management tool, whenever available on the website, or via browser settings.
Operational Alert: The consent tool must be activated and actually linked to analytics and marketing tools before publishing text stating that it is available.
9. Data Protection and Information Security
The company takes appropriate technical and organizational measures to protect personal data and professional and financial information from unauthorized access, loss, alteration, or unlawful disclosure.
These measures may include:
Access control management.
Using appropriate technical safeguards.
Applying professional confidentiality standards.
Restricting access to sensitive documents.
Reviewing information security procedures.
Handling security incidents in accordance with regulatory requirements.
No electronic system can be guaranteed to be entirely free of all security risks.
10. Rights of Personal Data Subjects
In accordance with the Personal Data Protection Law in the Kingdom of Saudi Arabia, and subject to statutory controls and exceptions, the data subject enjoys the following rights:
Right to be Informed: To know the legal basis and purpose of collecting and processing their data.
Right of Access: To request access to their personal data.
Right to Obtain a Copy: To request a copy of their data in accordance with regulatory controls.
Right to Rectification: To request the correction of inaccurate data, or the completion or updating of incomplete data.
Right to Destruction: To request the destruction of personal data in cases permitted by law.
Right to Withdraw Consent: To withdraw consent to processing based thereon, in accordance with regulatory controls.
How to Exercise Your Rights
A request relating to personal data may be submitted via:
Dedicated Privacy Email: [Approved Email]
The company may request the necessary information to verify the applicant's identity prior to responding, subject to statutory requirements regarding response timeframes.
11. Complaints Regarding Personal Data Protection
Al-Thuraya Harbour is committed to receiving complaints and inquiries related to privacy and handling them in accordance with approved procedures.
First: Filing a Complaint with the Company
The data subject may file a complaint regarding the collection, use, sharing, or retention of their data via:
Dedicated Privacy Email: info@a-hcpa.com
Phone: 8002440287
The company reviews the complaint, verifies its details, and responds in accordance with regulatory requirements and approved procedures.
Second: Filing a Complaint with the Competent Authority
The data subject has the right, in accordance with statutory controls and procedures, to file a complaint with the competent authority for personal data protection in the Kingdom of Saudi Arabia.
Competent Authority: Saudi Data and Artificial Intelligence Authority (SDAIA), according to its applicable regulatory jurisdictions.
Website: https://sdaia.gov.sa
Please refer to the official channels of the competent authority to view the procedures for submitting complaints, deadlines, and applicable requirements.
12. Transfer of Personal Data Outside the Kingdom
Certain technical services may require processing or storing data outside the Kingdom of Saudi Arabia.
In such cases, the company complies with statutory requirements relating to the transfer of personal data outside the Kingdom, including implementing the necessary safeguards and procedures to protect it.
Determining data processing locations and recipient entities depends on the services and systems actually utilized.
13. Confidentiality of Professional and Financial Information
Given the nature of the services provided by Al-Thuraya Harbour in auditing, accounting, and advisory, the company attaches special importance to protecting clients' financial and professional information.
This information is handled in accordance with professional agreements, contractual obligations, and applicable standards and regulations.
It is not disclosed except in authorized cases or as required by law.
14. External Links
The website may contain links to third-party websites or services, such as social media platforms and electronic communication services.
These websites are subject to their own privacy policies, and we recommend that users review them prior to submitting any personal data.
15. Amendments to the Privacy Policy
The company may update the privacy policy when needed to reflect changes in regulations, services, or data processing practices.
The updated version will be published on the website with an indication of the last update date, and additional notification measures will be taken whenever required by law.
16. Contact and Inquiries
For inquiries regarding the privacy policy or to exercise rights related to personal data, you may contact:
Al-Thuraya Harbour – Certified Public Accountants and Auditors (AHCPA)
Location: Jeddah, Kingdom of Saudi Arabia
Commercial Registration: 7033290185
Professional License: 965
Phone: 8002440287
General Email: info@a-hcpa.com
Privacy Email: info@a-hcpa.com
Website: www.a-hcpa.com
© 2026 Al-Thuraya Harbour – Certified Public Accountants and Auditors. All rights reserved.
