01 / Policy scope and responsible entity
This policy applies to our dedicated website for StarsTech Information Technology, **https://sta.sa**, as well as customer, management, and employee portals and the digital services associated with them, including the virtual assistant “Mira,” when StarsTech Information Technology is responsible for determining the purposes and means of processing data.
When we process data on behalf of a client under a services agreement, the responsibilities of both parties may also be defined in the relevant contract or data processing agreement.
Contact entity: info@sta.sa
02 / Data we process
Depending on the nature of the service and the relationship with the user, the data we process may include:
Identification and contact data: name, email address, phone number, city and country, and organization name.
Account data: encrypted login information or authentication methods, permissions, and login records.
Project data: requirements, correspondence, tasks, attachments, and implementation stages.
Contractual and financial data: quotations, contracts, claims, invoices, payment statuses, and transfer confirmations.
Employment data: job applications, professional information, identification attachments, attendance and working-hours records, performance, and leave, according to permissions and the legitimate employment purpose.
Meeting data: titles, dates and times, participants, meeting links, and statuses.
Technical data: IP address, usage logs, errors, and information necessary for security and service operation.
The collection of personal data that is not necessary to achieve the specified purpose is not intended.
03 / Purposes and legal basis
Data is used, according to the applicable legal basis, for the following purposes:
- Providing technical services, implementing projects, and fulfilling contractual obligations.
- Communicating with clients and responding to requests and inquiries.
- Creating and managing quotations, contracts, and financial claims.
- Managing client and employee accounts and permissions.
- Organizing meetings, schedules, and notifications.
- Carrying out human resources procedures and managing attendance and tasks.
- Protecting accounts, preventing misuse, and detecting failures.
- Complying with regulatory and accounting requirements.
Marketing messages, when used, are subject to the applicable consent and withdrawal requirements.
04 / Google Calendar and Mira Meetings
StarsTech uses the virtual assistant “Mira Starstech” to support authorized operations within the platform, including organizing meetings, assisting with the preparation of messages and follow-ups, and responding to inquiries within the services and enabled permissions.
These services may require processing data related to the client, employee, project, or meeting to achieve the requested purpose.
Mira does not have independent permission to access all platform data; access to data and actions is subject to approved permissions and the applicable authorization mechanisms.
External technical services may be used to process text or generate audio when the related functions are enabled, in accordance with the relevant controls and agreements.
Google Calendar and Mira Meetings
StarsTech provides an optional connection to a Google account to manage meetings using Google Calendar and create Google Meet links when the service is available.
When the user grants consent to the connection, the application may, depending on the permissions it requests and the user grants, access the data necessary to perform meeting operations, such as:
Meeting title and description.
Meeting date, start and end time, and time zone.
Participants’ email addresses.
Calendar event ID and status.
Meeting link and the technical information necessary to update or cancel it.
The purpose of this access is limited to creating, scheduling, updating, and canceling meetings and managing the associated invitations.
We do not use Google Calendar data for advertising, sell it to data brokers, or use it to train general artificial intelligence models.
The processing of Google data is limited to the functions requested by the user, taking into account the actual scope of permissions displayed on the Google consent screen.
Users may revoke authorization from their Google Account settings and contact us to request deletion of data associated with the integration, subject to records that must be retained by law.
The use of information received from Google APIs complies with the Google API Services User Data Policy, including the applicable Limited Use requirements.
05 / Sharing and service providers
We may share or process the minimum data necessary through service providers required for platform functions, such as hosting, email, calendar, meetings, messaging, and artificial intelligence, according to the integrations actually enabled.
We do not sell personal data.
Data may be disclosed when there is a legal obligation or a regulatory request from a competent authority, or when disclosure is necessary to provide a service requested by the user in accordance with the applicable controls.
Data transfers outside the Kingdom, when they occur, are carried out in accordance with the relevant regulatory requirements and safeguards.
06 / Data retention, protection, and deletion
We work to protect data from unauthorized access, alteration, disclosure, or loss by using appropriate technical and organizational controls suited to the nature of the information, including permission management, communications protection, and system integrity monitoring.
However, no electronic system can be guaranteed to be completely free of risks.
07 / Your rights and data controls
Data is retained for the period necessary to fulfill the purpose for which it was collected, comply with contractual, accounting, and regulatory obligations, or address legitimate claims and disputes.
Retention periods vary depending on the data category and the nature of the service. When the purpose no longer exists and there is no legal reason to retain the data, it is deleted or anonymized in accordance with approved procedures.
A request to delete or destroy data may be submitted by email, subject to verifying the identity of the requester and applicable legal exceptions.
08 / Data retention and deletion
Data shall be retained for the period necessary to fulfill the purpose for which it was collected, satisfy contractual, accounting, and regulatory obligations, or address legitimate claims and disputes.
Retention periods vary depending on the category of data and the nature of the service. When the purpose no longer exists and there is no legal reason to retain the data, it shall be deleted or anonymized in accordance with the approved procedures.
A request to delete or destroy data may be submitted by email, subject to verifying the identity of the requester and applicable legal exceptions.
Data Subjects’ Rights
Under the Saudi Personal Data Protection Law and other applicable laws and regulations, the rights that may be exercised, as applicable, include:
Being informed of the purposes for collecting data and the legal basis for its processing.
Requesting access to data and obtaining a copy thereof in accordance with the applicable controls.
Requesting the correction or updating of data.
Requesting the destruction of data when the relevant conditions are met.
Withdrawing consent when it is the legal basis for processing.
Requests may be submitted to info@sta.sa, and we may request verification of the requester’s identity before carrying out the procedure.
Cookies
The website may use cookies necessary for login, session security, saving language preferences, and operating the services.
When using non-essential cookies or optional analytics tools, disclosure and consent requirements shall be observed wherever applicable.
Communications and Meetings Privacy
Project correspondence, meetings, and claims may contain confidential, commercial, or personal information.
Their use is limited to the authorized professional purpose and within the permissions of the relevant users.
Scheduling a meeting does not constitute consent to audio or video recording or content transcription. Any recording or transcription, when this feature is enabled, must be subject to the required notices and consents in accordance with the applicable laws and regulations.
Updates and Communication
The Privacy Policy may be updated when services are developed, data processing methods or regulatory requirements change.
The updated version shall be published on the website, indicating the date of the latest update.
For privacy-related inquiries or to submit requests:
Najoom Information Technology – StarsTech
Website: https://sta.sa
Email: info@sta.sa
