Consent & Lawful Basis

This document applies to personal data we process through Skyline Cloud services, including cloud hosting, business email, DNS, and SSL, accessed via our cloud portal at cloud.alskyline.com and information presented on alskyline.com.

Personal data means any data that identifies, or could reasonably identify, a natural person. Processing means any operation performed on personal data, such as collection, storage, use, or deletion. A data subject is the individual to whom the personal data relates. A lawful basis is the legal ground that permits us to process your personal data under the PDPL.

Where we act as a processor on behalf of a customer (for example, when a tenant administrator manages mailboxes for their organization), the customer is responsible for establishing the lawful basis for the data they place in our service. We process that data under their instructions and in line with our agreements and this notice.

Under the PDPL, we process personal data only where we have a valid lawful basis. We rely on one or more of the following bases, depending on the purpose of processing:

Where we rely on consent, we obtain it in a way that is specific, informed, freely given, and based on an affirmative opt-in. We do not use pre-ticked boxes, and consent is never bundled as a condition of receiving a service that does not require it.

Before you consent, we tell you in clear language who is processing your data, for what purpose, and what the processing involves, so your decision is genuinely informed. Consent for one purpose does not imply consent for another; each distinct purpose is presented separately where appropriate.

Skyline Cloud is a hosting, email, DNS, and SSL platform and does not seek sensitive personal data in the ordinary course of providing its services. Sensitive data includes categories that reveal, for example, a person's racial or ethnic origin, religious or philosophical beliefs, health, genetic or biometric data, or criminal records, as defined under the PDPL.

Where any processing of sensitive data would occur and we are the responsible party, we will obtain your explicit consent for that specific processing, separate from any general consent, unless another lawful basis permitted under the PDPL applies. If you or your organization choose to store content within our services, you are responsible for ensuring you have a lawful basis — including explicit consent where required — for any sensitive data you place there.

You can withdraw consent at any time, and we make withdrawal as easy as giving it. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect processing that rests on a different lawful basis, such as performance of a contract or a legal obligation.

Once we receive your withdrawal, we stop the relevant consent-based processing without undue delay. You will not be penalized for withdrawing consent to optional processing, although some optional features that depend on that consent may no longer be available.

The lawful basis we rely on does not diminish your rights. Subject to the PDPL and its Implementing Regulations, you may exercise the following rights, which we handle through the contacts below:

Whatever the lawful basis, we apply technical and organizational safeguards designed to protect your personal data. Our practices are built to align with the PDPL and recognized national frameworks; formal certification is assessed by the respective competent authority.

We keep customer data and backups in the Kingdom (Riyadh) only, with no off-shore backup provider. Public connections use TLS 1.2/1.3 only. Data is protected by encryption at rest at the infrastructure layer (AES-256) together with field-level application encryption for sensitive fields. SSL private keys are generated on a hardened node kept isolated from the mail and portal environment.

If a personal data breach occurs that may cause harm, we will notify the Saudi Data & Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of it, in line with the PDPL. Where the breach is likely to cause harm to data subjects, we will also notify the affected individuals without undue delay.

Suspected security issues can be reported to security@alskyline.com.

For questions about lawful basis, consent, or your rights, contact our privacy team at privacy@alskyline.com or our Data Protection Officer at dpo@alskyline.com. Legal notices may be sent to legal@alskyline.com.

This document and our processing of personal data are governed by the laws of the Kingdom of Saudi Arabia, and any dispute is subject to the jurisdiction of the competent courts of Riyadh. We may update this document from time to time; the version published on our site is the current one.