Privacy Policy

Effective 7 October 2026. This policy explains what personal data Growth Hub Global ("Growth Hub", "we") collects through growthhub.global, why we collect it, where it is kept, and the rights you have over it. It is written to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations.

Who we are

Growth Hub Global operates the Growth Hub workspace centres and this website. Our Al Khobar centre is at 4046 Custodian of the Two Holy Mosques Road, Madinat Al Umal District, Al Khobar 34443, Kingdom of Saudi Arabia. For anything in this policy, write to info@growthhub.global or call +966 50 667 8277.

What we collect

  • Account details when you register: your name, email address, phone number, country, your company name if you give it, and a password, which we store only as a one-way hash.
  • Optional profile details: you may add your preferred language and your birthday (day and month only) so we can send you a birthday offer. These details are optional, and you can remove them at any time in your account settings.
  • Booking details: the space, date, time, number of people, term, any notes you add, and the history of the booking's status.
  • Billing details: invoices, payments recorded against them, refunds, and, for company accounts, the company's commercial registration and VAT numbers.
  • Enquiries and partner applications: the name, email, phone, company and message you submit through our contact and partner forms.
  • Reviews, wishlist items, loyalty and referral activity, and notification preferences.
  • Technical data when you sign in: the IP address and browser identifier of the session, and the time you were last active.
  • Usage analytics, only if you accept analytics cookies (see the Cookie Policy).

Why we use it

  • To run your account, take and manage your bookings, issue invoices and send the emails that go with them (confirmations, cancellations, verification and password-reset links).
  • To operate memberships, meeting-hour allowances, loyalty points and referral rewards.
  • To answer enquiries and assess partner applications.
  • To keep the site secure: sessions, sign-in alerts for new devices, rate limiting and an audit log of changes made by our staff.
  • To understand how the public pages are used, in aggregate, when you have consented to analytics.

We do not sell your personal data or share it with third parties for their advertising. We send you marketing messages, including offers, only with your consent, and every message includes an easy way to unsubscribe.

We process your personal data on the following grounds under the Personal Data Protection Law:

  • (a) to perform our agreement with you, including your account, membership or booking;
  • (b) to comply with our legal obligations, such as tax, zakat and accounting records;
  • (c) our legitimate interest in keeping our website, systems and centres secure, including through CCTV; and
  • (d) your consent, for analytics cookies and marketing messages.

You may withdraw your consent at any time by contacting us at info@growthhub.global. Withdrawal does not affect processing carried out before it.

Who we share it with

We use a small number of service providers who process data on our instructions only:

  • Vercel Inc. (United States), which hosts the website from its Mumbai, India region.
  • Supabase Inc. (United States), which hosts our database and stores uploaded files in its Mumbai, India region.
  • Brevo (Sendinblue SAS, France), which delivers our transactional email.
  • Google Ireland Limited (Ireland), for Google Analytics, only after you accept analytics cookies, with IP addresses anonymised and advertising features switched off.

We also share data where the law requires it, and with our professional advisers and payment banks as needed to issue and settle invoices.

Where your data is kept

Your personal data is stored and processed outside the Kingdom of Saudi Arabia, in Mumbai, India, by the providers listed under "Who we share it with". These transfers are made only as necessary to provide our services and are protected by the Standard Contractual Clauses issued by the Saudi Data & AI Authority (SDAIA).

Responsibility. We remain responsible for your personal data when it is processed by our providers, in accordance with the Personal Data Protection Law. We are not responsible for any loss of, or unauthorised access to, your data that results from your own acts, such as sharing your password, or from events outside our reasonable control, provided we have taken the security measures required by law.

How long we keep it

  • Your account, bookings, invoices and payments: for as long as your account is open, and afterwards for the period Saudi tax and commercial law requires us to keep financial records.
  • Sign-in sessions: staff sessions expire after 7 days, customer sessions after 30 days or at the end of the browser session if you tell us the computer is shared. Expired sessions are deleted nightly.
  • Database backups: taken nightly and deleted after 14 days.
  • Enquiries and partner applications: until they are closed and for a reasonable period afterwards so we can answer follow-up questions.
  • The audit log of staff actions: kept for the life of the service, as it is our security record.

Security cameras

Our centres use security cameras in entrances and common areas to protect people and property. Cameras are never placed in private offices, meeting rooms, restrooms or prayer rooms, and signs indicate where cameras are in use. Recordings are accessed only by authorised staff, kept for 7 days, and then deleted, unless they are needed for an investigation or legal claim or are requested by a competent authority.

Your rights

Under the PDPL you have the right to know what personal data we hold about you, to receive a copy of it, to correct it, to ask us to delete it where we no longer need it, and to withdraw consent you have given. You can update your name, phone, company and language from your account page, and you can close your account there; closing an account deactivates it and stops all processing except what we must keep for legal reasons. To exercise any other right, email info@growthhub.global from the address on your account. We answer within 30 days.

If you believe we have not handled your data properly, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority under the PDPL.

Children

Our services are intended for businesses and professionals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we discover that we have, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at info@growthhub.global.

Changes

If we change this policy we will post the new version here with a new effective date. Material changes will be announced on the website before they take effect.