Privacy policy

Scope of this policy

This policy explains the consultation form, status tracking, optional visit measurement and security data needed to protect the website from abuse.

Responsible entity and contact details

The responsible entity is Abdulaziz bin Faisal Kamel Law Firm, Bin Yala Tower, Jeddah, Saudi Arabia. For enquiries or privacy requests: info@kamellawyers.com or +966 54 432 3853.

Data collected by the form

• Name and mobile number, and email address if the applicant chooses to provide it.
• The requested service and a brief initial description of the matter.
• Client type, contact method, consultation format and proposed date and time slot, when optionally provided.
• A reference number, submission time and the version of the privacy notice accepted.
• A rotating technical fingerprint that cannot be used as a contact address, temporarily used to identify repeated attempts and prevent automated messages.

The form does not currently support uploading files or documents.

Purposes of use

• Reviewing the initial contact request and identifying the appropriate person or team to assess it.
• Contacting the applicant about the proposed service or requesting further information.
• Protecting the form, preventing abuse and documenting receipt and consent.
• Meeting applicable legal and professional requirements where necessary.

Storage and email notifications

The website is hosted through ChatGPT Sites. Request details are stored in a private D1 database associated with the site on Cloudflare. Access to the requests page is restricted to the authorised administrative account. Administrative email addresses and request details are not visible to visitors.

When email notifications are enabled, Resend sends the administration a notification containing only the reference number, request date and a link to the protected page. It does not include the applicant’s name, mobile number, email, matter summary or documents. The notification provider processes message metadata outside Saudi Arabia under its terms and safeguards.

Sharing and disclosure

Request data is not sold or used for marketing. Access is limited to the firm and technical infrastructure providers as necessary for operation, protection and notification, or where disclosure is legally required.

Retention period

The firm retains a request for as long as necessary to assess it, contact the applicant and meet legal and professional obligations. If an engagement is accepted, necessary information may be transferred to the organised matter file. Once the purpose no longer applies, information is deleted or destroyed under the firm’s procedures.

Optional visit measurement

Measurement starts only after you choose ‘Allow measurement’. You can decline or change your preference using the buttons at the bottom of this page without affecting reading or consultation requests. We store your choice locally and use a temporary random identifier in the browser tab that renews after 30 minutes of inactivity. We do not use advertising identifiers or third-party tracking files, and we respect your browser’s Do Not Track and Global Privacy Control signals.

Measurement records specified public page paths, the visit date and a general source category such as a search engine or external website. Measurement tables do not record the full referring address, URL parameters, search terms, raw IP address, name, mobile number or consultation subject. Staff and request-tracking pages are not measured.

If you allow measurement and submit a consultation request, we associate the request with its source category and first session page to show aggregated statistics to the owner only, without client details in the results dashboard. Measurement session records older than 90 days are deleted when a later measured visit occurs. Attribution data stored with a consultation follows the request’s retention period. Later declining measurement stops new recording but does not delete earlier requests.

Request tracking link

After a request is saved, a private link valid for 90 days displays only its general status, without the name, subject or team notes. We store a hash of the secret token, not the token itself, in the database. Anyone with the link can view the status, so keep it private. After verifying your identity, the team can issue a new link that invalidates the old one.

If you provide your email, Resend may send a receipt containing the request number and tracking link without the consultation subject. The email provider processes the recipient address and message data needed for delivery. You do not need to provide an email or create an account to track the request; you can use the link displayed after submission.

Security and spam prevention

The form uses server-side validation, request-origin checks, a hidden anti-bot field and limits on attempts within a short period. The raw IP address is not stored in the consultation request record.

Measurement and tracking interfaces also use rotating technical fingerprints to limit abuse, separately from measurement records. Their window expires after ten minutes and they are cleaned up on subsequent requests. The hosting provider may retain operational and security logs under its policies.

Data subject rights

You may contact us to request access to, correction or destruction of your data, or withdraw consent where legally applicable. The firm may request appropriate identity verification before processing a request and may retain information required by a legal or professional obligation.

Acceptance and updates

The form can only be submitted after selecting the consent checkbox. This policy may be updated when intake arrangements or providers change. The latest update date and consent notice version appear at the top of the page.