1. Introduction and Responsible Entity
IS CyberNext respects the privacy of website visitors, applicants and team members. This policy explains how their personal data is collected, used, protected and retained, and the rights available to them under the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations and other applicable laws.
Initiative Provider: Innovative Solutions (IS), legally registered as شركة الحلول المتميزة. Proposed controller: the same company, subject to confirming who actually determines the purposes and means of registration-data processing, including any joint-controller arrangements, before publication.
Privacy and data-subject requests: info@iscybernext.com. Data Protection Officer details will be added if designation is legally required.
This policy applies to personal data collected through the Initiative's official website, registration and project submission processes, and related communications and administration.
2. What Personal Data Do We Collect?
Depending on the actual registration fields and services used, we may collect:
- Identification and contact information: name, email address, mobile number, date of birth, nationality, gender, city, applicant category, and national ID, Iqama or passport number where collection is necessary and legally justified.
- Team member information: names, email addresses and mobile numbers of additional members submitted by the team's principal representative.
- Project information: project title, field, description and development stage, team information, and supporting documents, presentations, files and links submitted by the applicant.
- Application and correspondence information: application status, submission stages and relevant communications and timestamps.
- Technical and usage information: operational logs necessary for site security and operation may contain request times and technical errors.
Registration fields will identify which information is mandatory and which is optional before submission. Collection will be limited to data necessary for specified, lawful purposes.
3. How Do We Collect Personal Data?
We collect information directly from applicants through the registration form, their uploaded materials and links, and the Initiative's communication channels. For team applications, a principal representative may supply other members' details. Such processing is subject to the applicable requirements for notifying data subjects and respecting their rights.
Technical information may also be collected automatically if the website uses services that require it.
4. Why Do We Process Data, and on What Legal Basis?
Personal data may be processed to:
- Receive, manage and validate registration applications.
- Screen, review and evaluate projects and determine shortlisting outcomes.
- Communicate with applicants and provide updates relevant to the Initiative.
- Arrange attendance, presentations and final judging at Black Hat 2026.
- Protect the website against unlawful use and meet applicable legal requirements.
- Registration data must not be used for unrelated marketing without an independent lawful basis and the required notice and choices.
Lawful bases: Administration of applications may rely on the participation agreement where legally applicable; processing required by law may rely on legal obligations; and security measures may rely on legitimate interests only when the prescribed conditions are met.
If mandatory information is not provided, it may be impossible to complete registration or assess eligibility. Any consequences of withholding optional information should be made clear in the form where applicable.
5. Who Receives Personal Data?
Certain information may need to be made available to parties authorized to administer the Initiative, evaluate submissions, or provide hosting and operational services, only to the extent necessary for their defined responsibilities and subject to applicable law. The presence of an organization's logo on the website does not, by itself, mean that organization has access to personal data.
Potential recipient categories, where necessary: authorized initiative administration staff, screening and judging panels for project review, and contracted technical providers needed to host or operate the platform.
International transfers/access: the actual hosting location and any access from outside the Kingdom have not yet been finalized. No claim of Saudi-only hosting is made.
Personal data will not be disclosed beyond the defined scope without an appropriate lawful basis.
6. Where Is Data Stored, and How Is It Protected?
Hosting and storage: the provider, server location and actual access geography are to be confirmed before public registration is enabled, and will then be disclosed accurately here.
The responsible entity is required to adopt technical, organizational and administrative safeguards appropriate to the nature of the data and the risks involved, to reduce unauthorized access, use, alteration or disclosure.
7. Retention and Secure Disposal
Personal data will be retained for as long as necessary to achieve the purposes for which it was collected and meet any applicable legal obligations. Once no longer required, it will be securely disposed of in accordance with procedures designed to prevent unauthorized retrieval or access, unless further retention is legally justified.
Proposed retention rules, subject to implementation and sign-off: applications, team-member details, supporting documents and initiative correspondence will be deleted within 12 months after the Initiative concludes, unless an applicable legal duty or ongoing claim justifies longer retention. Operational logs will be kept for no longer than 90 days, and rolling backups for no longer than 90 days, then securely deleted. These are proposed operating commitments, not a claim that deletion jobs are already implemented.
Disposal: delete data from primary databases and document storage, and expire backup copies on the approved cycle while restricting access during retention.
8. Your Personal Data Rights
Subject to the applicable requirements, limitations and exceptions under the PDPL and its Implementing Regulations, data subjects have the right to:
- Be informed about the purpose and legal basis of the collection and processing of their data.
- Request access to their personal data.
- Request a copy of their data in a readable, clear format where applicable.
- Request correction, completion or updating of their personal data.
- Request the destruction of data that is no longer required, subject to applicable law.
- Withdraw consent where processing relies on consent, subject to any other lawful grounds for processing or retention.
- Submit a complaint to the competent authority through the applicable official channels.
How to exercise your rights: email info@iscybernext.com. Eligible requests will be handled without undue delay and within 30 days, extendable by a further 30 days where the implementing regulations permit and after notifying the requester of the reasons. Proportionate identity verification may be needed.
9. Information About Other Team Members
When a team's principal representative provides another member's personal information, they must be authorized to share it and should inform that member about this policy. The responsible entity must also meet any applicable requirements to notify individuals whose information was obtained from someone else and enable them to exercise their rights.
10. Changes to This Policy
This policy may be updated to reflect changes to operational practices or applicable law. The updated version and its effective date will be published on the Initiative's official website. Where a change requires additional notice or consent, the applicable legal requirements will be followed.
11. Contact
For privacy enquiries or requests to exercise your rights, contact info@iscybernext.com.