Personal Data Protection Law (PDPL) & SDAIA Requirements
Saudi Arabia
1. Scope of the Saudi PDPL
The PDPL regulates the processing of personal data and applies to processing carried out in the Kingdom. It can also apply to the processing of personal data relating to individuals residing in the Kingdom where processing is carried out by an entity outside the Kingdom.
Lizzie Fluke provides performance, coaching, testing, rehabilitation, digital and applied services across Saudi Arabia, MENA, Europe and internationally. The applicability of the PDPL will therefore be assessed according to the nature of the processing, the individual concerned, the location of the processing and the circumstances of the service.
2. Privacy Policy and Transparency
SDAIA's privacy-policy guidance provides that a controller's privacy policy should give Data Subjects clear information about the collection and processing of their personal data.
Accordingly, Lizzie Fluke's privacy information explains, as applicable:
• what personal data Lizzie Fluke collects;
• how personal data is collected;
• the purposes for which it is collected;
• how personal data is processed;
• how personal data is stored;
• how long personal data may be retained;
• when personal data may be disclosed;
• when personal data may be transferred outside the Kingdom;
• applicable Data Subject rights;
• how individuals can exercise those rights.
Lizzie Fluke will seek to provide privacy information in a clear and accessible form before or at the point personal data is collected, as required by applicable law.
3. Personal Data Collected
Depending on the service or relationship, personal data processed in connection with Saudi-based services may include:
• name and contact information;
• professional information;
• organisation, club or federation information;
• account and membership information;
• purchase and transaction information;
• booking information;
• athlete and performance information;
• testing information;
• training information;
• injury and rehabilitation information;
• health information where necessary for the relevant service;
• photographs and video;
• communications and correspondence;
• technical information relating to use of relevant websites, platforms and services.
Lizzie Fluke will seek to collect only the personal data necessary for the specified and legitimate purpose.
4. Purposes of Processing
Personal data may be processed for purposes including:
• delivering contracted performance services;
• providing individual athlete services;
• providing team services;
• delivering testing;
• delivering rehabilitation services;
• administering programmes;
• providing coaching and applied performance support;
• providing digital products and resources;
• administering the Lizzie Fluke Members Area;
• processing payments;
• managing bookings and subscriptions;
• communicating with athletes, clients and organisations;
• maintaining service records;
• meeting legal or regulatory requirements;
• protecting systems and accounts;
• preventing misuse or fraud;
• establishing, exercising or defending legal claims;
• other purposes permitted by applicable law.
Personal data will not be processed for purposes incompatible with the purpose for which it was collected unless permitted by the PDPL or another applicable legal basis.
5. Consent and Other Lawful Processing
Where consent is required under the PDPL, Lizzie Fluke will seek consent in accordance with the PDPL and Implementing Regulations.
Where another lawful basis permits processing without consent, Lizzie Fluke may process the relevant personal data on that basis instead.
Consent will not be treated as a blanket authorisation for unrelated processing.
Where consent is relied upon, the relevant purpose will be communicated clearly and consent will be documented where required.
Where processing involves Sensitive Data, the additional requirements applicable to Sensitive Data under the PDPL and Implementing Regulations will apply.
6. Sensitive Data and Health Data
Some Lizzie Fluke services involve athlete injury, rehabilitation, health, physical condition or other information that may constitute Sensitive Data or Health Data under Saudi law.
Where this information is processed, Lizzie Fluke will apply the additional protections required by the PDPL and Implementing Regulations.
Health and rehabilitation information will only be accessed by individuals who require access for the relevant service or lawful purpose.
The amount of health information collected and processed will be limited to what is necessary for the relevant purpose.
Lizzie Fluke will not use health or rehabilitation information for unrelated marketing or promotional purposes.
7. Disclosure of Personal Data
Lizzie Fluke does not sell personal data.
Personal data may be disclosed where permitted or required by the PDPL, including where necessary for:
• provision of the relevant service;
• contractual performance;
• payment processing;
• website, hosting or technology services;
• authorised professional support;
• relevant coaches, clubs, teams or federations;
• medical or rehabilitation professionals where appropriate and lawful;
• compliance with a legal obligation;
• compliance with a competent authority;
• protection of an individual's life or health;
• protection of public health or safety;
• another purpose permitted under applicable Saudi law.
Disclosure will be limited to the information reasonably necessary for the relevant purpose.
8. Data Security
Lizzie Fluke will implement appropriate technical, organisational and administrative measures to protect personal data against risks including:
• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration;
• damage;
• unauthorised disclosure.
The nature of the safeguards applied will take account of the type of personal data, the purpose of processing and the risks associated with the processing.
Additional safeguards will be applied to Sensitive Data and Health Data where required.
9. Personal-Data Breaches
Where Lizzie Fluke becomes aware of a personal-data breach affecting information subject to the Saudi PDPL, the incident will be assessed and managed in accordance with the PDPL, Implementing Regulations and applicable SDAIA requirements.
Where notification to SDAIA or another competent authority is required, the notification will be made within the applicable statutory timeframe.
Where notification to affected Data Subjects is required, the relevant notification will also be made in accordance with applicable requirements.
10. Data Subject Rights under the Saudi PDPL
Subject to the conditions and exemptions established by Saudi law, Data Subjects may have rights concerning their personal data, including rights relating to:
• access to personal data;
• obtaining information about how personal data is processed;
• requesting correction;
• requesting completion or updating of personal data;
• requesting destruction of personal data in circumstances provided by law;
• withdrawing consent where consent is the basis for processing.
The exercise of a right may be subject to applicable legal conditions, exemptions or limitations.
Lizzie Fluke will respond to requests in accordance with the applicable PDPL and Implementing Regulations.
11. Exercising Saudi Data Subject Rights
A Data Subject may make a request concerning their personal data by contacting:
Hello@lizziefluke.com
Requests should provide sufficient information to identify the individual and the nature of the request.
Lizzie Fluke may request reasonable information necessary to verify identity before releasing or changing personal data.
Requests will be handled within the applicable statutory timeframe.
12. Storage and Retention
Personal data will be stored using appropriate technical and organisational safeguards.
Personal data will not be retained for longer than necessary to achieve the purpose for which it was collected, except where retention is required or permitted by applicable law.
Retention periods may be affected by:
• contractual requirements;
• legal obligations;
• financial and accounting requirements;
• insurance requirements;
• dispute resolution;
• safeguarding requirements;
• establishment, exercise or defence of legal claims;
• other applicable regulatory requirements.
When personal data is no longer required, it will be securely destroyed, deleted or anonymised where appropriate and permitted.
13. Transfers of Personal Data Outside the Kingdom
Lizzie Fluke operates internationally and may use service providers located outside Saudi Arabia.
Where personal data subject to the Saudi PDPL is transferred outside the Kingdom, Lizzie Fluke will comply with the Regulation on Personal Data Transfer Outside the Kingdom, together with the PDPL, Implementing Regulations and applicable SDAIA requirements.
International transfers will be assessed according to:
• the purpose of the transfer;
• the type and sensitivity of personal data;
• the extent and frequency of the transfer;
• the level of protection available;
• the rights of the Data Subject;
• the risks associated with the transfer;
• the applicable legal mechanism and safeguards.
Where required, appropriate safeguards may include applicable contractual mechanisms, binding rules, approved certification mechanisms or another mechanism permitted under Saudi law.
Transfers will be limited to what is necessary for the relevant purpose.
Where a transfer involves Sensitive Data, additional requirements and risk considerations applicable under Saudi transfer regulations will be taken into account.
14. Data Processors and Third-Party Service Providers
Where another organisation processes personal data on behalf of Lizzie Fluke, appropriate contractual and security arrangements will be used where required.
This may include providers supporting:
• website hosting;
• payment processing;
• Members Area functionality;
• email and communications;
• digital content delivery;
• data storage;
• analytics;
• cybersecurity;
• other technical or operational services.
Lizzie Fluke will take appropriate steps to ensure that processors handle personal data in accordance with applicable legal requirements.
15. SDAIA Guidance and Regulatory Requirements
Lizzie Fluke will monitor applicable requirements and guidance issued by SDAIA in relation to the PDPL and will update its privacy and data-processing practices where necessary.
This includes applicable SDAIA material concerning:
• privacy policies;
• personal-data processing;
• Data Subject rights;
• Sensitive Data;
• data security;
• personal-data breaches;
• international transfers;
• other matters relevant to the processing undertaken by Lizzie Fluke.
Where applicable law or regulation changes, this page may be updated accordingly.
16. UK and Saudi Data-Protection Requirements Together
Lizzie Fluke provides services across the UK, Saudi Arabia, MENA and Europe.
Where the same processing activity is subject to both UK data-protection law and Saudi PDPL requirements, Lizzie Fluke will assess the applicable requirements for that activity rather than assuming that compliance with one jurisdiction automatically satisfies the requirements of the other.
This is particularly relevant to:
• athlete health information;
• rehabilitation information;
• performance data;
• team and federation data;
• digital membership information;
• international cloud services;
• payment processing;
• email communications;
• transfers of personal data between the UK, Saudi Arabia, MENA and Europe.
Where requirements differ, the processing will be managed according to the applicable legal requirements, the nature of the data and the circumstances of the processing.