Privacy Policy
Last updated: 2 October 2026
Sirk Company Limited (“KOVA”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit kovagcc.com or otherwise interact with us. It is intended to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree No. M/19 of 1443H), as amended, and its Implementing Regulations (the “PDPL”), together with other data protection laws that may apply to you.
1. Who We Are (Data Controller)
For the purposes of the PDPL, the data controller is Sirk Company Limited, a company registered in the Kingdom of Saudi Arabia, with its registered office in the Al Narjis District, Prince Saud bin Abdullah bin Jalawi Street, Riyadh, Kingdom of Saudi Arabia. KOVA is the brand under which Sirk Company Limited and its affiliated companies operate: KOVA PMC Oy, registered in Finland (business ID 2994439-8), and KOVA Circular Consultant Project Development LLC, registered in the United Arab Emirates (together, the “KOVA group”). Where this Policy says that a KOVA group company is the controller for a particular activity, that company is responsible for it. You can reach our privacy contact using the details in Section 12.
2. Information We Collect
We collect information in three primary ways: information you provide to us directly, information we collect automatically when you use our website, and information we receive from third parties.
Information you provide to us
When you submit a contact or partnership form, apply for a position on our Careers page, or otherwise communicate with us, you may provide your name, email address, organization, telephone number, and any other information you choose to include in your message or application.
Information collected automatically
When you visit kovagcc.com, our servers and analytics providers may automatically collect certain technical information about your visit, including:
- IP address, browser type, device type, and operating system
- Pages visited, time spent on each page, and referring URLs
- Aggregate navigation and interaction patterns
Some of this information is collected through cookies and similar technologies. For more detail, please see our Cookie Policy.
Information from third parties
We may receive analytics information from service providers who help us understand how our site is used. This information is generally provided to us in aggregated or anonymized form.
We also obtain business contact details from third-party data providers and public sources for business outreach. How we handle those details is explained in Section 4.
We do not intentionally collect sensitive personal data (such as data revealing health, religious belief, or political opinion) through this website, and we ask that you do not submit such data to us through our forms.
3. How We Use Your Information
We use the information described above to operate, maintain, and improve our website; to respond to your inquiries and partnership requests; to evaluate employment applications; to protect the security and integrity of our website; and to comply with our legal obligations within the Kingdom of Saudi Arabia and other jurisdictions in which we operate.
We do not sell your personal data. We do not use your information to build advertising profiles or to deliver targeted advertising.
4. Business Outreach
We contact professionals by email about business opportunities relevant to their role, including infrastructure and industrial project development, partnerships and investment, and consulting and market-entry services. This section explains how we handle the business contact details we use for that purpose, in addition to the rest of this Policy. It applies to outreach sent by any KOVA group company named in Section 1, including emails sent from the kovapmc.com and kovagcc.com domains. The company whose details appear in the email is the controller for that email, and this Policy applies to it in full.
Information we use. Your name, job title, employer, business email address, business telephone number, work location and public professional profile, together with a record of our correspondence with you and of any preferences you tell us, such as a request not to be contacted.
Where it comes from. Third-party business-data providers, professional networking sites, company websites, public registers and industry events. On request, we will tell you the source of your details where we hold that information.
Why we use it, and our legal basis. To identify organisations that may be suitable partners, clients, suppliers or investors for our projects and services, and to contact the professionals responsible for the relevant areas. We rely on our legitimate interest in promoting our business to other businesses, having considered that our messages relate to your professional role, that we contact you at your business address, and that you can opt out at any time. Where the law that applies to you sets additional conditions for this kind of contact, we take reasonable steps to meet them. Our outreach is directed at professionals acting in their business capacity; we do not knowingly contact individuals under 18.
Your right to object. You can object to our outreach at any time, free of charge, by using the Unsubscribe link in any of our emails, by replying “stop”, or by writing to info@kovagcc.com. The Unsubscribe link opens a pre-addressed email to the sender that carries a short reference code; the code lets us match your request to our records and is used for nothing else. We will stop contacting you promptly, and in any case within the time limits set by applicable law. We keep your email address on a suppression list solely to make sure we do not contact you again.
Who we share it with. Only service providers that help us operate, such as our email, hosting and customer-relationship systems, under confidentiality and data-protection obligations, and otherwise as described in Section 6. We do not sell your personal information, and we do not share it with third parties for their own marketing or for targeted advertising.
International transfers. Our teams operate from the Kingdom of Saudi Arabia and the United Arab Emirates, and our service providers may process data in other countries. Where the law requires it, we put appropriate safeguards in place, such as standard contractual clauses.
How long we keep it. For as long as it is reasonably needed for the purposes above, and generally no longer than three years after our last contact with you. Suppression-list entries are kept for as long as needed to honour your request.
Your rights. Depending on where you are located, including under the EU and UK GDPR, the Saudi and UAE data-protection laws, and US state privacy laws, you may have the right to access, correct or delete your personal data, to restrict or object to its use, to receive a copy of it, and to withdraw consent where we rely on it. We will not treat you differently for exercising these rights, and we do not make decisions about you based solely on automated processing. To make a request, contact us using the details in Section 12; we may need to verify your identity first. You may also raise a concern with the data-protection authority in your country.
5. Legal Basis for Processing
We process personal data only where we have a lawful basis to do so under the PDPL. Depending on the circumstances, this may include: your consent (which you may withdraw at any time); the performance of a contract or steps taken at your request prior to entering into a contract; compliance with a legal obligation to which we are subject; or our legitimate interests in operating and securing our business, provided these do not override your rights and interests.
6. Sharing and Disclosure
We share personal data only with service providers acting on our behalf, including hosting, analytics, and email infrastructure providers, under contractual confidentiality and data protection obligations. We may also disclose information where required by law, court order, or a valid request from a competent regulator, or to establish, exercise, or defend legal claims.
7. International Transfers
KOVA is headquartered in the Kingdom of Saudi Arabia. Where personal data is transferred to service providers located outside of the Kingdom, we put in place appropriate safeguards consistent with the PDPL and its Implementing Regulations to ensure a comparable level of protection for your data.
8. Data Retention
We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting obligations. Inquiry records are typically retained for the duration of an active engagement and a reasonable period thereafter, after which they are securely deleted or anonymized.
9. Data Security
We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. While no method of transmission or storage is completely secure, we work to protect your information and to maintain the measures required of us under applicable law.
10. Your Rights
Subject to applicable law, and in particular the PDPL, you have the right to:
- be informed of the legal basis and purpose for collecting your personal data;
- access the personal data we hold about you;
- obtain a copy of your personal data in a readable and clear format;
- request the correction or updating of inaccurate or incomplete data;
- request the destruction of your personal data where it is no longer required; and
- withdraw your consent to processing where processing is based on consent.
To exercise any of these rights, please contact us using the details in Section 12. We will respond within the timeframes required by applicable law. If you believe your rights have not been respected, you may lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent supervisory authority in the Kingdom of Saudi Arabia.
11. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be highlighted on our website.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise any of the rights described above, please contact us at info@kovagcc.com, or by post at the registered address set out in Section 1.