PDPL Commitment

1. Why this exists

PDPL (Royal Decree M/19 of 9/2/1443H, as amended) sets the rules for how personal data of residents and citizens of the Kingdom of Saudi Arabia may be collected, stored, processed, and transferred. Basher is built for Saudi businesses, so PDPL isn't a checklist we satisfy — it's the regulatory baseline we design around.

This commitment page sits alongside our Privacy Notice and Terms of Service and is written for procurement teams, security reviewers, and DPOs.

2. Data residency

Customer call data — recordings, transcripts, associated metadata, and identifiers — is stored inside the Kingdom by default. We use Google Cloud's Dammam region (me-central2) for all data at rest.

Real-time call processing (speech recognition, voice synthesis, and language reasoning) currently uses vetted sub-processors outside the Kingdom, operating under data processing agreements. We say this plainly because a security review will find it anyway. In-Kingdom processing is on our roadmap; the current sub-processor list is available on request.

Enterprise customers can elect:

• Dedicated tenancy within the Dammam region.
• Private cloud or on-premise deployment, subject to commercial terms.
• Configurable retention windows below the platform default of 90 days.

3. Controller & processor

For call data processed via the Basher platform, the customer is the data controller and Basher is the data processor. We process personal data only on documented instructions from the customer, except where required by law.

For marketing, billing, account management, and website analytics, Basher is the controller. See the Privacy Notice for details.

4. Lawful basis

Under PDPL, personal data can be processed where there is a lawful basis. Basher supports customers in meeting the common bases:

• Consent — the platform can play a consent prompt at the start of recorded calls, capture caller response, and log it as part of the call record.
• Contract performance — where the call is necessary to deliver a product or service the caller has requested.
• Legal obligation — e.g. Know Your Customer (KYC) requirements for regulated industries.
• Legitimate interests — where balanced against the caller's rights and documented per PDPL requirements.

Determining the correct lawful basis is the controller's responsibility. We provide the tools to record and evidence it.

5. Cross-border transfers

PDPL restricts transfer of personal data outside the Kingdom. Customer call data at rest stays in KSA. During live calls, audio and conversation text transit vetted sub-processors outside the Kingdom (speech recognition, voice synthesis, and language reasoning) under data processing agreements and appropriate transfer safeguards. Where a customer configures an integration that would export personal data (for example a CRM hosted abroad), this is a transfer initiated by the customer under their controller responsibilities.

For corporate data (billing, support, website logs), limited transfers to the UK and EU occur for back-office processing. These transfers rely on SDAIA-approved transfer mechanisms and/or customer-specific data processing agreements.

6. Data subject rights

PDPL grants data subjects specific rights — including access, correction, deletion, restriction of processing, and withdrawal of consent. Basher provides customers with tooling to fulfil these requests:

• Search and export all data associated with a phone number or identifier within minutes.
• Redact, delete, or anonymise records individually or in bulk.
• Log every rights-exercise action with an auditable trail.

7. Data protection contacts

Basher has designated data protection contacts responsible for engaging with SDAIA and coordinating on compliance matters.

• Email: privacy@basherai.com
• Enterprise procurement: compliance@basherai.com

8. Breach notification

If we become aware of a personal data breach affecting customer data, we'll notify the affected customer without undue delay and in any event within 72 hours, providing:

• A description of the breach, the scope, and the categories of affected data.
• Information on likely consequences and steps we've taken to contain the incident.
• Support in meeting the customer's own notification obligations to SDAIA and data subjects.

9. Data Processing Agreement

A standard Data Processing Agreement (DPA) is available for all customers, covering the processor obligations under PDPL and referencing this page. Enterprise customers can negotiate customer-specific amendments as part of their order form.

To request a DPA or ask a compliance question, email compliance@basherai.com.