Privacy Policy

This Policy applies to visitors and users of Surely, including individual clients, business representatives, lawyers, and administrative users.

"Personal data" means any data that identifies an individual or by which an individual can be identified, directly or in combination with other data, as defined under the PDPL.

"Processing" means any operation performed on personal data by any means, automated or otherwise, including collection, recording, storage, sharing, and destruction.

Identity and account data: name, KSA mobile number, email, user type, verification status, language preference, session identifiers.

Verification data: pseudonymous national-identity/Iqama verification references through approved providers; identity-document images are not retained except where strictly required and only for the minimum necessary period.

Lawyer professional data: Saudi Bar licence number, specializations, qualifications, experience, professional disclosures.

Transaction data: requests, proposals, engagements, invoices, payments, statuses, refund and settlement records.

Content and communication data: case descriptions, messages, dispute evidence, support tickets, and where enabled, session recordings/transcripts.

Technical and operational data: IP address, device/browser data, security logs, audit logs, fraud-prevention logs.

Sensitive data (PDPL Art. 1): financial, judicial, or health data may be processed to the extent necessary to deliver the requested legal service, subject to additional safeguards and a lawful basis.

Directly from you on registration, form submissions, support contact, or platform use.

From official or approved verification providers for identity and licence checks, only to the extent required by law and compliance controls.

Automatically through essential cookies, performance telemetry, security and anti-fraud logs needed to operate and secure the service.

Performance of the contract (PDPL Art. 6/2): account operations, request/proposal/engagement lifecycle, payments, and VAT-compliant invoicing.

Legal obligation: identity verification, E-Commerce Law obligations, tax and accounting record-keeping, response to lawful authority requests.

Legitimate interests: fraud and abuse prevention, security hardening, audit/forensics, and incident response, where these do not override your fundamental rights.

Explicit consent: where required by law, including session recording and selected public-review scenarios; you may withdraw consent at any time without affecting prior lawful processing.

Vital interests or public interest, in the limited cases recognized by law.

The services are intended for users who are at least eighteen (18) years of age and have full legal capacity. We do not knowingly collect personal data from minors.

If we become aware that minor data has been collected without a lawful basis, we will take prompt steps to delete or anonymize it.

We share personal data with contracted processors (cloud infrastructure providers, SAMA-licensed payment providers, communication providers, anti-fraud tools) under data-processing agreements that impose equivalent protection standards.

We disclose data to competent judicial, regulatory, and security authorities in KSA when bound by law or an enforceable order, including SDAIA, the Saudi Central Bank (SAMA), and the National Cybersecurity Authority.

Engagement-specific data may be shared with the lawyer you select, only to the extent required to deliver the requested legal service.

We do not sell personal data, do not share it with unrelated third parties for independent marketing, and do not perform off-platform targeted advertising outside the scope of consent.

Our primary storage and processing posture is in-region within the Kingdom of Saudi Arabia.

In limited operational scenarios (such as certain communication, support, or fraud-prevention services) data may be processed outside the Kingdom within the conditions permitted by PDPL (Art. 29 et seq.), subject to contractual and technical safeguards.

We apply strict data-minimization to any cross-border transfer.

Surely uses matching and ranking algorithms to suggest lawyers based on request scope, specialization, and availability. We do not take legally binding decisions about you on a purely automated basis without human review where the law requires it.

You may request a reasonable explanation of any decision with material effect and a human review through our support team.

We apply appropriate technical and organizational measures, including encryption in transit (TLS) and at rest, least-privilege access controls, environment segregation, and tamper-evident audit trails for sensitive operations.

Sensitive administrative actions require reason-logging and may require dual-control approvals.

In the event of a personal-data breach materially affecting data-subject rights, the Company will notify SDAIA within seventy-two (72) hours of becoming aware of it, and notify affected data subjects where required by law.

Payments are processed exclusively through payment providers licensed by the Saudi Central Bank (SAMA). We do not store full card data; we use secure tokens and the minimum invoice data required.

Financial records are retained in accordance with KSA tax requirements, including VAT (15%) and ZATCA regulations.

Where session recording is enabled, recording does not start unless required dual consent is satisfied; recording can be stopped if consent is withdrawn where applicable.

Users must not submit unnecessary sensitive credentials (card numbers, passwords, OTP codes) in free-text fields or chat; automated masking may apply.

Essential cookies: required for login/session continuity, language preference, and security; disabling them disables the service.

Performance cookies: used minimally to maintain stability and improve service quality in a compliant manner.

We do not use third-party advertising cookies for cross-site tracking.

We may revise this Policy from time to time to reflect service or regulatory changes. The latest version is published on this page with its effective date.

Material changes affecting data-subject rights will be additionally notified through appropriate in-platform notices a reasonable period before they take effect.