Section 1 — Introduction 

Change: Added identification of Safe365 Global (UK) Limited as the Controller for KSA users, and noted that employers may also act as Controllers for data submitted through the platform. 

Section 5 — Collection of Personal Information 

Change: Added clarification distinguishing mandatory fields from optional free-text fields, and defined the split between Safe365 as Controller (account/platform data) and the employer as Controller (workplace-submitted content such as incident reports and hazard observations).

Section 7 — Use of Personal Information 

Change: Added the four lawful bases for processing personal data under the PDPL for KSA users: consent, contractual necessity, legal obligation, and legitimate interests (excluding sensitive data). 

Section 8 — Data Hosting / Sharing Information Overseas

Change: Added that KSA user data is hosted on Microsoft Azure infrastructure in the UAE (Abu Dhabi region), and that cross-border transfers are made using SDAIA-approved contractual safeguards. Noted that affiliated entities in NZ and Australia may access data on a need-to-know basis. 

Section 11 — Protecting Personal Information 

Change: Added acknowledgement that workplace H&S submissions may constitute Sensitive Personal Data under the PDPL (e.g. injuries, health observations), and listed the additional safeguards applied: encryption in transit and at rest, role-based access controls, audit logging, and processor contractual restrictions. Confirmed Sensitive Personal Data is not used for marketing. 

Section 12 — Your Rights 

Change: Added the full set of KSA data subject rights: right to be informed, right of access, right to a copy (in readable format, typically CSV), right to correction, right to deletion, and right to withdraw consent. Added the process for exercising those rights (email to support@safe365global.com) and the 30-day response commitment. Added the consent withdrawal mechanism and non-retroactivity statement.

Section 16 — Complaints 

Change: Added SDAIA as the KSA supervisory authority with complaints contact at sdaia.gov.sa. Added reference to the Data Protection Officer as a contact point for KSA users.