Privacy and data

Privacy Notice

This notice covers website visits, the enquiry form, and contact initiated from the site through WhatsApp or email.

Version: 1.6 · Effective date and last updated: 2026-08-24

Who we are and scope

The controller is Mansour Alsikhan - Managment Advisory (Mansour Alsikhan), providing independent management advisory services to organisations on employee wellbeing, workplace mental health, psychosocial risk, governance and outcome measurement, as well as non-therapeutic individual administrative and career consulting for adults.

Location: Jeddah, Kingdom of Saudi Arabia.

This notice covers website visits, the enquiry form, and contact initiated from the site through WhatsApp or email. It does not govern external websites. This website supports organisational advisory work and offers non-therapeutic individual administrative and career consulting for adults. It is not a channel for clinical intake, diagnosis, treatment or clinical appointment booking.

Data we may process

For organisational services, you may voluntarily provide your name, organisation, approximate workforce size, message content, and the email address or phone number associated with the channel used.

For an individual consultation, you may voluntarily provide your name, contact details, and the career or workplace context you choose to share. We may also process appointment, invoice and payment information where applicable, together with correspondence and follow-up needed to deliver the service.

No particular field is mandatory, but enough information must be provided to create a meaningful enquiry that can be submitted.

Technical data may include IP address, browser, device, requested page and time, page-load and performance measurements, and security or operational cookie data.

Do not send health, psychological or clinical information, employee files, medical reports, passwords, detailed identity data, or confidential third-party material.

Enquiry form and sending channels

The website does not submit form content to a dedicated form database.

If you select WhatsApp, your browser constructs a link containing the message and opens the service. The text forms part of the URL, and the message is not delivered unless you complete the send action in WhatsApp.

If you select email, your device opens an email client through mailto: with a pre-composed message. We receive it only if you send it. Google Workspace is used for email.

The website does not currently integrate a booking, meeting or payment platform. If an external tool is added later, the transfer to that provider will be made clear, the provider's own notice will also apply, and this notice will be updated before the tool is enabled.

Purposes and legal bases

Purpose	Legal basis
Managing the enquiry initiated by the person, including responding, assessing service fit, following it up, and preparing a proposal when requested	The data subject’s consent when they choose to send the enquiry or complete the communication after this notice has been made available. Consent is documented through the sent correspondence, the sending time, and the channel used, to the extent available in that channel
Managing the relationship and delivering a service after an agreement exists	Performance of an existing agreement to which the data subject is a party, and applicable legal obligations
Managing a request for a non-therapeutic individual consultation, arranging the appointment, delivering the service, following up and invoicing where applicable	The data subject's consent when contact begins, followed by performance of an agreement when the data subject becomes a party to it, and applicable legal obligations
Operating and protecting the site and limiting automated or abusive traffic	Legitimate interest in network and information security, supported by a written assessment
Measuring page performance and traffic	Legitimate interest, supported by a separate written assessment
Handling complaints, claims and protection of rights	Applicable legal obligations and legitimate interest, without relying on that basis for sensitive data

Responding, assessing fit, following up and preparing a proposal are components of one purpose—managing the enquiry initiated by the person—rather than separate purposes requiring multiple consents.

Hosting, measurement and cookies

The website is hosted through OpenAI Sites and uses Cloudflare at the domain, network, delivery and security layer.

It uses Cloudflare Web Analytics through its RUM beacon running in the browser to measure page loading, performance and traffic. Measurement reports are not linked to enquiry content or used for direct marketing.

Sentry is used to monitor and diagnose technical runtime errors, with default identity information disabled. Error reports are not linked to enquiry content or used for marketing.

Cloudflare may set security or operational cookies, including:

__cf_bm for automated-traffic protection; the provider states that it expires after 30 minutes of continuous inactivity.
cf_clearance, which may appear following a security check; its duration and trigger depend on the settings and event.

These are not described as analytics cookies.

A cookie named __Host-appgarden-visitor was also observed previously. It has not been established that it forms part of the measurement reports we use, and we do not use it directly for marketing. Its setter, purpose and duration remain under investigation.

You can block or delete cookies in your browser. Blocking protection cookies may cause repeated checks or prevent access.

WhatsApp, email and use

If you select WhatsApp, you move to a service operated by Meta and subject to its own terms and notices. The data may include your WhatsApp number and message, and the text forms part of the service URL when opened.

WhatsApp and general email are not suitable for health, clinical, employee-file or confidential information.

We do not use enquiry data for unsolicited direct marketing, sell or rent it, or share it for advertising. Use is limited to responding and following up, managing the resulting relationship, delivering requested services, meeting legal obligations, and handling related complaints or claims.

Processing outside the Kingdom

Some data may be processed outside Saudi Arabia through OpenAI Sites, Cloudflare, Sentry, Google Workspace and WhatsApp/Meta, depending on the channel.

Transfer arrangements, risks, safeguards and contracts are being assessed. We do not claim that an appropriate protection level has been verified, that a country or organisation appears on an official list identifying those whose level of protection has been assessed as appropriate, or that standard contractual clauses or a completed transfer-risk assessment are currently in place.

Retention and destruction

We do not retain notes about the content of an individual consultation session.
An enquiry that does not become an engagement is kept only as needed to respond, complete requested follow-up, close the enquiry, protect rights or handle a potential complaint or dispute, and is deleted when that need ends.
Engagement correspondence is kept during the relationship and afterwards only for contractual, accounting and legal duties or claims and disputes.
Provider-side records outside our control follow provider terms and practices, and we may not be able to delete every provider copy.

Where destruction is required, we remove data from channels and systems under our control to the extent possible, subject to legal-retention duties.

Security and unintentionally received sensitive data

Verified technical controls include HTTPS and HSTS, server-level protection headers, and a Cloudflare network and security layer. No internet communication can be guaranteed completely secure.

If health, clinical or other sensitive content is received unintentionally, it is not analysed or transferred into organisational- or individual-advisory outputs. The sender is told the channel is unsuitable and redirected where possible, after which the content is deleted from channels under our control to the extent possible, subject to legal or professional duties. A minimal incident record may be kept without copying the sensitive content. We cannot guarantee deletion of provider-held records.

Your rights

Subject to legal limits and exceptions, rights include being informed of the legal basis and purpose, access, a clear copy, correction or completion, destruction when no longer needed subject to retention duties, and withdrawal of consent where consent is the basis without retroactive effect on lawful prior processing or processing based on another basis.

Send requests to privacy@alsikhan.com. Identity is verified by matching the original correspondence, such as the same email address or WhatsApp number, or enough detail to locate it. Official identity documents are not requested by default.

You may withdraw consent through privacy@alsikhan.com or through the same channel used for the communication. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing based on another lawful basis.

Requests are handled without delay and within 30 days. The period may be extended once by up to a further 30 days where implementation requires unexpected or unusual additional effort, or multiple requests have been received, provided that the requester is notified in advance of the extension and its reasons.

No fee is charged unless an applicable statutory provision permits otherwise.

Complaints

Contact privacy@alsikhan.com first.

We handle internal objections and complaints within 30 days of receipt. Where a complaint also includes a request to exercise a data-subject right, the requirements and time limits in the Your Rights section also apply.

A complaint may be filed with the Saudi Data & AI Authority (SDAIA) within 90 days of the incident or becoming aware of it, subject to acceptance of a later complaint where real reasons prevented timely filing.

If you are not satisfied with how your complaint has been handled, you may submit a complaint to the Saudi Data & AI Authority (SDAIA) in accordance with the Saudi Personal Data Protection Law through the National Data Governance Platform:
https://dgp.sdaia.gov.sa

Children and updates

The website is intended for organisations and their professional representatives, and for adults seeking an individual career or management consultation. It is not directed at children and does not ask children to provide personal data.

The notice may be updated when channels, providers or regulatory requirements change. Its version and last-updated date appear above, and the update record is maintained internally.