Breach notification procedure

What this covers

A breach is any unauthorised access to, loss or disclosure of personal data we hold. This page sets out what we do when one happens.

1. Detection

We watch the platform’s errors and alerts every day. Anyone can tell us about a suspected breach through the contact form.

2. Containment

We stop the access at once: we revoke the keys and sessions involved, close the affected path, and keep the evidence.

3. Assessment

We establish what data was involved, whose it is, and the likely risk to the people affected.

4. Notification within 72 hours

Within 72 hours of becoming aware of a breach, we notify the competent authority and the people affected: what happened, what data was involved, what we have done, and what they can do.

[To be confirmed by legal review: the competent authority in the Kingdom and the statutory deadline under the Personal Data Protection Law; this procedure follows 72 hours until then.]

5. Record

We record every breach with its facts, its effects and the actions taken.

Contact

To report a suspected breach or ask about one, use the contact form on this site.

• The contact form
• The privacy policy