Effective from the date this page is published · Version 1.1
1. Who is responsible
Ayman H Jaber, acting in a professional capacity as an individual, is the controller of the personal data described here. The controller is located in Saudi Arabia.
2. How to contact us about your data
Use the contact form on this website and select “Privacy or data-rights request” as the enquiry category. This is the formal route for any question or request about your personal data. A LinkedIn message is accepted as an informal alternative, but it is not the formal channel, because it depends on a third-party account.
3. What is collected, and what is required
| Field | Required? | Why it is needed |
|---|---|---|
| Name | Required | To identify you and address a reply |
| Email address | Required | The only means of replying to you |
| Nature of enquiry | Required | To route the enquiry, and to identify data-rights requests |
| Message | Required, up to 5,000 characters | To understand and assess what you are asking |
| Organisation | Optional | Context, where you represent one |
| Country or market | Optional | Context for professional relevance |
| Acknowledgement | Required | Confirms you have read this notice |
| Marketing preferences | Optional | If ticked, permits professional updates and relevant offers. Leaving it unticked has no effect on your enquiry |
The enquiry categories are: board or committee opportunity; speaking or professional contribution; executive coaching; personal advisory; Fusion Harbor advisory or partnership; training or leadership development; privacy or data-rights request; and institutional correspondence or other enquiry.
The acknowledgement confirms that you have read this notice. It is not consent to marketing, and it is not consent to processing outside Saudi Arabia.
Your IP address and browser user-agent are not stored with your enquiry.
4. Why your data is used
Handling your enquiry. To receive it; to check it is genuine and not automated abuse; to assess it; to reply; and to close and delete it.
Optional professional updates. Only if you tick the marketing preferences box, and only as described in section 6.
These are separate purposes with separate legal bases. Declining the second does not affect the first.
5. Legal basis
Ordinary inbound enquiries are handled on the basis of legitimate interests — you contacted a professional in order to be answered, and handling your message is what you asked for. A written balancing assessment supports this and is kept on file.
This basis is not relied on for sensitive personal data.
Optional professional updates are handled only on the basis of your consent, given by ticking the marketing preferences box. Consent is never assumed, never pre-ticked, and never bundled with the acknowledgement in section 3.
6. Optional professional updates
If — and only if — you tick the marketing preferences box, Ayman H Jaber may send you professional updates and relevant service offers, including information about Fusion Harbor.
Only your name and email address are used for this. Your message, enquiry category, organisation, and country or market are never used for marketing, and neither is your IP address or browser information, which are not stored at all.
Fusion Harbor does not independently receive, access, copy, export or control your enquiry. Ayman H Jaber remains the sole controller. Information about Fusion Harbor may be included in what he sends you; that is not the same as Fusion Harbor holding your data.
Your personal data is never sold, licensed, or provided to another party for that party’s own marketing. There is no profiling and no automated decision-making.
Withdrawing. You can withdraw at any time, free of charge, by either replying to any message with “unsubscribe” or “stop”, or submitting the contact form and choosing “Privacy or data-rights request”. Sending stops without undue delay. Every message identifies Ayman H Jaber as the sender and carries a plain withdrawal instruction.
How long this lasts. The permission ends at the earliest of: your withdrawal; deletion of the enquiry it was given with; or that enquiry reaching the end of the retention period in section 10. Enquiries are not kept longer to prolong marketing.
If a message is sent to you by email, Google Workspace processes that correspondence, as described in section 8.
7. What is never done
Your data is never sold. It is not used for profiling, and no decision about you is made by automated means. No analytics or advertising service tracks your use of this form. Marketing is sent only where you have given the optional consent described in section 6 — never otherwise.
7. Who else processes your data
| Recipient | Role | What it handles |
|---|---|---|
| Bluehost / Newfold Digital | Hosting processor | Operates the website and the database in which enquiries are stored |
| Cloudflare | Anti-abuse | Security signals for Turnstile — see below |
| Google (Workspace) | Correspondence processor | Only the reply correspondence, if a reply is sent to you by email |
Cloudflare Turnstile protects this form from automated abuse. Cloudflare’s Turnstile Privacy Addendum states that the signals processed are the client IP address, TLS fingerprint, user-agent header, and the sitekey and its associated origin. Cloudflare acts on the site operator’s instructions for the anti-abuse purpose, and acts as an independent controller when it uses those signals to improve its own bot detection. See the Cloudflare Turnstile Privacy Addendum.
Google Workspace is involved only if the owner replies to you by email. Your enquiry is not automatically sent to Google — no automatic notification email exists. If a reply is sent, the reply correspondence and your email address are processed by Google Workspace and are retained separately from your form entry.
9. Processing outside Saudi Arabia
The website is hosted by Bluehost (Newfold Digital), and Cloudflare provides anti-abuse protection. Both operate internationally, so relevant processing may take place outside the Kingdom of Saudi Arabia. Where a reply is sent by email, Google Workspace may likewise process that correspondence outside the Kingdom.
Primary hosting is understood to take place in the United States. This is based on the publicly available information about the hosting service; the precise locations of every replica, log and backup are set by the hosting provider and are not certified to us.
The measures applied to this processing are the ones described in this policy: the data set is deliberately small, your IP address and browser details are not stored with your enquiry, no attachments can be submitted, no copy of your enquiry is emailed automatically, enquiries are deleted on the schedule in section 10, and access is restricted as described in section 13.
Nothing in this section asks for your consent to that processing, and this policy does not claim any regulatory approval, adequacy determination, standard contractual clauses or certification in respect of it.
10. How long data is kept
| Category | Period |
|---|---|
| Spam or clearly irrelevant submissions | Deleted promptly once identified |
| Enquiry not taken further | Deleted within 90 days of receipt |
| Enquiry taken further but not resulting in an engagement | Deleted within 90 days of the last substantive action |
| Enquiry resulting in an engagement | Only what is necessary is transferred to the engagement record; the enquiry entry is deleted within 30 days |
| Record of a data-rights request | Kept separately, only as long as needed to show the request was handled |
Deleting an entry removes it from the live database. Encrypted backup copies held by the hosting provider may persist until they are overwritten under that provider’s own operating cycle; the exact period is set by the provider and is not certified to us. Backups are not used for ordinary enquiry handling.
11. Your rights
Subject to the conditions in the applicable law, you may ask to: be informed about how your data is used; access your data; obtain a copy of it; have it corrected or updated; and have it destroyed.
To exercise a right, submit the form and select “Privacy or data-rights request”.
Identity is verified proportionately — normally by confirming the request from the email address used to send the original enquiry. Identity documents are not requested by default.
Requests are answered within the period required by the applicable law. If more time is lawfully required, you will be told, with the reason, before the initial period ends. If a request is refused or limited, the reason will be given.
If you are not satisfied, you may complain to the Saudi Data & AI Authority (SDAIA) through the National Data Governance Platform.
12. Sensitive and confidential information
Please do not submit sensitive personal data, confidential or proprietary information, or material subject to professional or regulatory restriction.
If such information is submitted anyway, it will not be assessed or reused; it will be deleted securely, and you will be asked to resend only the minimum needed.
13. Security
Access to stored enquiries is restricted to specifically authorised administrator and integration accounts over encrypted connections. Two-factor authentication is applied to supported interactive administrator access. The form is protected against automated abuse. Further security details are not published.
14. Children
This form is intended for professional correspondence and is not directed at children.
15. Changes
Material changes are recorded by version and effective date above. This policy is reviewed at least annually, and immediately if the architecture, the processors, or the applicable rules change.
Version history
- 1.1 — Added optional, consent-based professional marketing; no independent Fusion Harbor access.
- 1.0 — First published version.