Privacy Policy – Kingdom of Saudi Arabia

Effective Date: 9 October 2026

Introduction

Welcome to the Global Mentors Group, headquartered in the United Kingdom and represented in the Kingdom of Saudi Arabia through Global Mentors Group Limited, a company registered with Unified Number 7037844748 at the Commercial Register Office of the Ministry of Commerce in Riyadh (“Global Mentors KSA”). Global Mentors KSA trades in Saudi Arabia under the name of CMi Merryck.

Global Mentors KSA is the primary data controller under the Saudi Personal Data Protection Law and its implementing regulations (“PDPL”) responsible for personal data processed in connection with our mentoring services in Saudi Arabia. Global Mentors KSA processes personal data where necessary for contracting, invoicing, regulatory compliance and local service delivery.

At Global Mentors KSA we value the privacy of our mentees and are committed to protecting their personal data in accordance with the PDPL and all other applicable laws and regulations.

Our contact details

Data protection officer
Global Mentors Group Limited
Building No. 6299
Saif Al Doloah Al Hamadani
3296 Al Zahra Dist.
Riyadh 12815
Kingdom of Saudi Arabia

Email: [email protected]

Telephone: +966 50 998 9880

Scope of this privacy notice

This privacy notice relates to the personal data we collect and process as part of our mentoring services about mentees who are nationals or residents of Saudi Arabia.

The type of personal information we collect

We may collect and process the following categories of personal information:

• Personal identifiers and contact details (for example, name, email address, phone number);
• Employment details (for example, employer, role);
• The objectives of the mentoring (for example, areas of focus for the mentoring services);
• Notes of mentoring sessions held (for example, major matters discussed);
• With your explicit consent only, sensitive personal data, such as information about your health, family circumstances, religious or political beliefs or financial position.

In all cases we only collect and process personal information which is appropriate and limited to the minimum amount necessary to achieve the purpose of the collection (namely, to provide mentoring services).

How we get the personal information and why we have it

Most of the personal information we process is provided directly by you to allow us to establish and deliver the mentoring services.

We may also receive personal information:

• From your employer or sponsoring organisation, to initiate the mentoring services;
• From public sources, to provide appropriate background information to mentors and ensure effective service delivery.

We use this information to:

• Initiate the mentoring services with you and your employer;
• Deliver the mentoring services; and
• Invoice your employer or sponsor for the services.

Under the PDPL, the lawful basis we rely on for processing this information is that processing is necessary for the performance of a contract (namely, the provision of mentoring services).

Sharing and disclosure of personal information

We may share this information with affiliates, mentors, consultants, and agents who support the delivery of mentoring services. We do so because it is necessary to provide our services or for legitimate purposes. When we do share personal information we ensure that appropriate safeguards required under the PDPL are in place to protect your privacy. We will only share sensitive personal information with your explicit consent.

How we store your personal information

Your information is securely stored:

• On our email systems and the email systems used by our mentors, subject to the security requirements and safeguards we place on them;
• On our internal systems.

We use appropriate technical and organisational measures to protect your personal information against unauthorized access, alteration, disclosure or destruction (including access controls, encryption and staff training).

We retain personal data only for as long as necessary to deliver the services or for so long as required by applicable law (for example, tax and accounting records). Once no longer required, data is securely and permanently deleted or anonymised.

Your data protection rights

Under the PDPL, we may only process your personal information with your prior consent, expressly and freely given. You may withdraw your consent at any time by emailing [email protected]. Your withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. If you withdraw your consent we may not be able to continue providing the mentoring services to you.

Further, under the PDPL, you have the following rights:

• Right to be informed – to be told how and why we use your data;
• Right of access – to request access to your data and a copy of it in clear and readable format;
• Right to rectification – to request correction of inaccurate or incomplete data;
• Right to destruction – to request destruction of your data when it is no longer needed;
• Right to restriction of processing – to request restricted use of your data;
• Right to object – to object to certain processing activities;
• Right to data portability – to request transfer of your data to another organisation or to you.

There is no charge for exercising these rights. We have 30 days to respond to requests. We may ask you to verify your identity before we respond.

Requests should be submitted to [email protected].

Transfer of data outside Saudi Arabia

As our mentoring services are often delivered by our mentors from outside Saudi Arabia personal data may be transferred, stored and processed outside Saudi Arabia.

We may only transfer your personal information outside Saudi Arabia in accordance with the PDPL, which permits the transfer of personal data outside Saudi Arabia if certain conditions and safeguards are met.

Data breaches

If a personal data breach occurs we will, where we are required to do so under the PDPL, notify the Saudi Data & AI Authority (SDAIA) (the regulator under the PDPL) within 72 hours of becoming aware of the breach. We will inform you without undue delay if the breach may cause you harm.

Marketing

We will only send you information about our services or events with your consent. You can opt out at any time by emailing [email protected] or using the unsubscribe link in any message.

How to complain

If you have any concern or complaint regarding our processing of your personal data or the exercise of your rights under the PDPL, you may email us at [email protected]. We will investigate your complaint and aim to respond as soon as practicable and, in any event, within 30 days.

If you are dissatisfied with our response or otherwise wish to make a complaint concerning the processing of your personal data, you have the right to submit a complaint to SDAIA. A complaint to SDAIA should generally be submitted within 90 days from the date of the relevant incident or the date on which you became aware of it.

The contact details of SDAIA are:

Saudi Data & AI Authority (SDAIA)
SDAIA Main Building (RD02)
An Nakheel District – Digital City
Building Code: 1003-B001
Riyadh 12382
Kingdom of Saudi Arabia

Unified Call Centre: 800 122 1111

National Data Governance Platform email: [email protected]

Changes to this notice

We may update this notice from time to time. We will publish the updated version on our website and, where the changes are significant, we will inform you by email.

Language

This notice is available in Arabic and English. If there is any conflict between the two versions the Arabic version shall prevail.