Privacy & Legal

What We Collect

When you interact with Code Defence — whether through our website, our contact form, a consultation, or an active engagement — we may collect the following categories of personal data:

• Contact and identity information such as your name, business email address, phone number, job title, and the name of your organisation.
• Engagement information including the nature of the services you are enquiring about, your business's security situation, and any details you share during consultations or active client work.
• Technical information collected automatically when you visit our website, including your IP address, browser type, pages visited, time spent on pages, and the source of your visit. This information is used in aggregate form to understand how our website is used and to improve it.
• Communication records including emails, WhatsApp messages, and other correspondence you have with our team.

We do not collect sensitive categories of personal data — such as health information, financial account details, or political views — unless you specifically and knowingly provide them in the context of an engagement where they are relevant, and we never request them through our website or contact forms.

How We Use Your Information

We use the personal data we collect for the following purposes:

Legal Basis for Processing

Under Saudi Arabia's Personal Data Protection Law, the UAE Federal Data Protection Law, and the GDPR where applicable, we are required to have a lawful basis for each way we process your personal data. Our legal bases are:

• Contract — for processing necessary to deliver services to active clients under our engagement agreement.
• Legitimate interests — for responding to enquiries, improving our website, and sending relevant communications to people who have demonstrated an interest in our services. We balance our legitimate interest against your rights and interests when relying on this basis.
• Consent — for newsletter subscriptions and optional marketing communications, where we ask for your clear agreement before adding you to any list.
• Legal obligation — for retaining records required by law.

Who We Share Your Information With

We do not sell your personal data. We never have and never will.

We share your information only in the following limited circumstances:

• Service providers who process data on our behalf — such as our email platform, cloud storage provider, and video conferencing tool. These providers are contractually required to handle your data only as instructed by us and to maintain appropriate security standards.
• Professional advisors such as lawyers or accountants, where disclosure is necessary for us to obtain professional advice in a specific situation.
• Regulatory authorities if we are legally required to disclose information in response to a valid legal process, court order, or regulatory request.

How Long We Keep Your Information

We retain personal data only for as long as necessary for the purpose for which it was collected, subject to any legal minimum retention periods that apply.

• Enquiry and consultation records are retained for up to 24 months in case you return with a follow-up question or decide to proceed with an engagement.
• Active client engagement records are retained for 7 years from the end of the engagement, in line with standard commercial and legal record-keeping requirements in the GCC.
• Newsletter subscriber data is retained until you unsubscribe. Unsubscribing removes you from our mailing list promptly and permanently.
• Website analytics data is retained in aggregated, anonymised form indefinitely for website improvement purposes.

Your Rights

Depending on which data protection law applies to your situation, you may have some or all of the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to correction — to ask us to correct inaccurate or incomplete information.
• Right to deletion — to ask us to delete your personal data where we no longer have a lawful reason to hold it.
• Right to restriction — to ask us to stop processing your data in certain circumstances while a dispute is resolved.
• Right to data portability — to receive your data in a structured, machine-readable format where the processing is based on consent or contract.
• Right to object — to object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, please contact us at [email protected]. We will respond to all valid requests within 30 days.

How We Protect Your Information

We are a cybersecurity company. The technical and organisational security measures we apply to our own data are the same measures we recommend to our clients — which means they are enterprise-grade and actively maintained rather than set-and-forgotten.

These measures include encrypted storage and transmission of all personal data, access controls that limit who within our team can access different categories of data, regular review of our security practices, and prompt procedures for identifying and responding to any data security incidents.

No system is completely impervious to attack. If we ever become aware of a security incident affecting personal data we hold, we will notify affected individuals and the relevant regulatory authority in accordance with our obligations under the applicable data protection law — typically within 72 hours of becoming aware of the incident.

International Data Transfers

Our operations are based in Bahrain and we primarily use cloud service providers that may process data in data centres located in other countries. Where your personal data is transferred outside of Saudi Arabia or the UAE, we ensure that appropriate safeguards are in place — such as the use of standard contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms — to ensure that your data receives an equivalent level of protection regardless of where it is processed.

Using Our Website

By accessing and using the Code Defence website (codedefence.in), you agree to these terms. If you do not agree with them, please do not use the website.

The content on this website is provided for general information purposes only. It does not constitute professional cybersecurity, legal, or compliance advice. Every business's security situation is unique, and the information on this website should not be relied upon as a substitute for professional guidance tailored to your specific circumstances. If you need specific advice, please contact us directly.

Intellectual Property

All content on this website — including text, design, graphics, logos, and the Code Defence brand — is the property of Code Defence or its content providers and is protected by applicable intellectual property laws. You may not reproduce, distribute, or use any content from this website without our prior written permission, except for personal, non-commercial reference purposes.

Limitation of Liability

Code Defence makes reasonable efforts to ensure the accuracy and currency of the information on this website, but we make no warranty — express or implied — that the content is complete, accurate, or up to date. We are not liable for any loss or damage arising from your reliance on the information provided on this website.

Our liability to clients in connection with professional services engagements is governed by the terms of our individual engagement agreements, which take precedence over anything stated on this website.

Links to Other Websites

Our website may contain links to third-party websites for your convenience or reference. We are not responsible for the content, privacy practices, or security of those websites and do not endorse them. Visiting a linked site is at your own risk.

Changes to These Terms

We may update these terms from time to time to reflect changes in our practices or applicable law. We will note the date of the most recent update at the top of this page. Continued use of the website after any changes constitutes your acceptance of the revised terms.

Governing Law

These terms are governed by the laws of the Kingdom of Bahrain. Any disputes arising in connection with these terms or the use of this website shall be subject to the exclusive jurisdiction of the courts of Bahrain.

What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and to gather information about how you interact with the site. Most browsers accept cookies by default, but you can configure your browser to refuse cookies or to alert you when cookies are being placed.

How We Use Cookies

We use a minimal set of cookies on this website. We do not use advertising cookies, tracking cookies that follow you across other websites, or cookies that build profiles for marketing purposes.

Managing Cookies

You can manage cookie settings through your browser. Most browsers allow you to refuse all cookies, accept only certain types, or delete cookies that have already been set. Refusing essential cookies may affect the functionality of some parts of this website. Refusing analytics cookies will not affect your experience in any meaningful way.