Last updated: 30 Aug 2026
Seventh Brand is a Saudi company for exhibitions, conferences and stand manufacturing, and operates event technology systems at registration.7brand-sa.com.
Our role differs by data type:
We are the data controller for our clients' data, our site visitors, newsletter subscribers and store customers - we determine the purpose and means of processing.
We are a data processor for the personal data of event attendees collected by our client through our systems; the organising entity is the controller and decision maker, and we act on its instructions and never use that data for our own purposes.
Contact and contracting data: name, email, mobile, entity name and VAT number if provided - to fulfil your order, issue your tax invoice and answer your enquiry.
System account data: email, hashed password, role and entity - to enable sign-in and scope permissions.
Event attendee data: whatever the organiser defines on its registration page, based on name, mobile and email, with optional additional fields - to issue the badge, record attendance and serve the visitor.
Limited technical data: browser type, pages visited and timestamps - for performance measurement and abuse protection only.
Payment data: we store only the amount, status and method. Card details are entered directly with a licensed payment gateway, never pass through our servers, and are never retained by us.
Directly from you: site forms, registration, orders and account creation.
From the organiser, when it uploads its attendee list or registers visitors at the gate.
Automatically and minimally while you browse: the language cookie, the session cookie and server logs.
We do not buy data lists and do not collect data from external sources.
In-event voting is anonymous: we store the choice with a random session fingerprint that prevents repeat voting from the same device, never linked to a voter's name or email.
Attendee app preferences - such as starring a session - are stored in that person's own browser and never reach our servers.
Big screens at venues display aggregate counts only: no names, no individual records.
We do not sell, rent or trade your data in any form.
We share it only as necessary with: our email provider for system messages and badges, the licensed payment gateway to complete a transaction, our hosting provider, and the organiser of the event you registered for.
We disclose it where a legal obligation or an order from a competent judicial or regulatory authority requires it.
Every provider we use is bound to process data on our instructions with appropriate safeguards.
System data is hosted inside the Kingdom of Saudi Arabia.
Operating some supporting services - such as email delivery - may involve limited processing outside the Kingdom. This occurs only under the safeguards permitted by the Personal Data Protection Law and its regulations, and with the minimum data necessary.
Contracting and invoice data is retained for the period required by accounting and tax legislation in the Kingdom.
Attendee data is retained while our client operates its event and account with us; if the relationship ends or deletion is requested, we destroy or return it as agreed.
Trial account data is deleted automatically when the trial expires - the account, its event, its attendees and its votes are removed in full, leaving no trace.
Technical browsing logs are purged periodically after a short period.
Destruction is a permanent deletion from our databases and cannot be reversed.
Under the Personal Data Protection Law you have the right to be informed how and why your data is processed, to access it and receive a readable copy, to request correction, completion or updating, to request destruction when it is no longer needed, and to withdraw consent where processing relies on it.
To exercise these, write to the address below; we respond within thirty days.
If your data was collected through another entity's event, we refer you to that entity as the controller and assist it in meeting your request.
If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority.
We apply technical and organisational controls: encryption in transit, passwords stored hashed and irreversible, permission separation so a desk operator sees only their own event, request forgery protection on forms, and execution disabled for uploaded files.
If a breach occurs that may harm the data or its subject, we notify the competent authority within seventy-two hours of becoming aware, and inform affected data subjects and the client organiser without delay.
We use a cookie for language preference and a session cookie for cart contents and login state - both necessary for the site to work.
The attendee app uses local storage in your browser to keep your personal schedule and your read state for alerts.
We use no advertising cookies and do not track you across other sites.
Our services are directed at entities and adults. We do not knowingly collect data from anyone under eighteen except with guardian consent, or where the organiser has obtained that consent for events designed for children. If we learn that a minor's data was otherwise collected, we destroy it.
We update this policy whenever our services or the relevant regulations change, and record the last update date at the top of this page. Where a change is material, we notify account holders by email.