Privacy Policy

The Sultan page is a presentation page: it has no accounts, no payments and no tracking of individuals, and no server of its own receives what you type. This policy explains the little of your data that passes through when you visit it or write to us from it.

Last updated: 13 November 2026

1. Data controller

The processing of personal data is governed by the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations.

2. Scope

This policy applies to the Sultan page on www.mrf103.com, in Arabic and English. The Dar section shown under www.mrf103.com/dar has its own policy at dar.mrf103.com/privacy.

3. What we collect

The page asks for no sign-up, no account and no payment. Something reaches us from you in two cases only:

• If you write to us: the “Request a demo” button is an email link that opens your own mail program addressed to the company; the page sends nothing by itself. We receive what you choose to send: your name, your email address and your message, through the company mailbox on Google Workspace. We use it only to reply to and follow up on your request.
• Hosting logs: the hosting provider keeps standard technical connection logs to run and protect the service, as described in section 5.

The page counts its visits with Cloudflare Web Analytics, an aggregate measurement: it sets no cookies, writes nothing to your browser and does not tell one visitor from another. It sends Cloudflare the page address, the page you came from, the browser and device type, and load times. The page loads no other tracking or advertising tool.

We do not ask for national IDs or sensitive data, and ask that you do not include them in your message.

4. Legal basis and purpose

Your correspondence is processed on the basis of your consent, since you choose to send it, and its purpose is to reply to you and arrange a demo if you ask for one. Hosting logs serve to run and protect the site, and no profile of anyone is built from them.

5. Who processes data on our behalf

• Vercel: hosts the site and, like any host, keeps standard technical connection logs (connection address, time of request, page requested) to run and protect the service, under its own policy.
• Google Workspace: carries the company mailbox your correspondence reaches.
• Cloudflare: passes and protects the domain’s connection, and counts visits in aggregate as in section 3.

We do not sell, rent or share personal data with any other party, except as required by law or by an order of a competent authority.

6. Transfers outside the Kingdom

These providers operate global networks, so connection logs and correspondence may be processed outside the Kingdom of Saudi Arabia. We handle this under the Law’s and its regulations’ requirements for transferring personal data outside the Kingdom.

7. Retention

We keep your correspondence for as long as needed to answer and follow it up, and no longer than twelve months after our last exchange, after which we destroy it. If it leads to a contract, the contract data is kept as the contract and applicable regulations require. Hosting logs are kept under the provider’s own policy.

8. Cookies and browser storage

The page sets no cookies, neither essential nor non-essential, and loads no tracking or advertising tool; the visit counter in section 3 sets no cookies, which is why it shows no consent banner. The only thing it keeps in your browser’s local storage is the display language you chose, Arabic or English; it never leaves your device and never reaches us, and you can clear it at any time from your browser settings. Nothing is loaded from a third party except that visit counter.

9. Security

The site reaches your browser over an encrypted connection, and its security policy blocks loading any code from outside its domain and the Cloudflare counter. Only the people who handle your correspondence see it. If a breach affects your data, we will notify the competent authority and you within the periods the Law sets.

10. Your rights

Under Article 4 of the Law you may:

• Be informed of the purpose of collecting your data and its legal basis.
• Access your data and obtain a readable copy of it.
• Request that it be corrected, completed or updated.
• Request its destruction once it is no longer needed.

You may also withdraw your consent at any time; withdrawal does not affect processing carried out before it. To exercise any of these rights, write to [email protected] stating what you request; we may ask for proof of identity before responding. We reply within thirty days of receiving the request.

11. Complaints

If you believe the processing of your data breached the Law, please write to us first so we can resolve it. You may at any time lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), the authority that supervises the Law.

12. Data Protection Officer

A Personal Data Protection Officer will be appointed when SDAIA’s appointment rules apply to the company; their duties include receiving data-related requests and liaising with SDAIA. Until then, all requests go to [email protected].

13. Changes to this policy

We may update this policy; each version is published on this page with its update date. Last updated: 13 November 2026.