TREND DC Company, the operator of the TrendX application, issues this unified guide as the official reference governing the relationship between the application and its users with respect to personal data protection and professional community standards. This guide brings together in one document three areas that were previously issued separately, in order to promote transparency, make policies easier to access, and fulfil the Controller’s obligation to adopt and make a privacy policy available to personal data subjects.
This guide has been prepared in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19), dated 9/2/1443 AH, as amended by Royal Decree No. (M/148), dated 5/9/1444 AH; its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA); the Implementing Regulation on Personal Data Transfer Outside the Kingdom; the guidance for preparing and developing privacy policies; the Personal Data Protection Policy issued by the National Data Management Office under the National Data Governance Framework (Version 2.0); and all other relevant laws and regulations in force in the Kingdom of Saudi Arabia.
This guide applies to all users of the TrendX application inside and outside the Kingdom of Saudi Arabia whenever their data is processed within the scope of the Law. This guide serves as the application’s official transparency and information document. Consent to personal data processing—where consent is the applicable legal basis—shall not be inferred merely from using or continuing to use the application. Instead, consent is obtained through explicit and documented mechanisms within the application, given freely, separately for each processing purpose, and in a manner that can be evidenced, in accordance with Article (11) of the Implementing Regulations.
Personal Data Controller
| Item | Details |
|---|---|
| Entity | TREND DC Company — TrendX application/platform |
| Activity | A digital platform for tracking trends, conducting opinion polls, and performing market analyses, available on iOS and Android |
| Website | www.trendx.co |
| info@trendx.co | |
| Responsible Department | Trend Tech |
| Personal Data Protection Officer | info@trendx.co (Attention: Personal Data Protection Officer) — see Section 11 of this Guide |
| Scope | All application users inside and outside the Kingdom of Saudi Arabia, subject to the scope of the Law |
Personal data subjects may contact the Company at any time to exercise their rights or ask questions concerning the processing of their data through any available channel, including email, communication through the application, or any other lawful channel adopted by the Company for this purpose.
The platform collects and processes users’ personal data to the extent necessary to provide its services, manage accounts and participation in surveys, improve the user experience, and meet legal requirements. The platform follows the data minimisation principle, limiting collection to the minimum necessary to achieve the specific and lawful purposes for which data is collected. Depending on the service or survey in which a user participates, the personal data collected and processed may include, without limitation, the following categories:
1.1 Account and identification data: As necessary, this may include name, email address, telephone number, date of birth, and national identification details, such as a national ID or residency number. These data may be used to create and manage user accounts, verify eligibility for certain services or surveys, verify users when necessary, and contact them regarding services or surveys in which they participate.
1.2 Usage and interaction data: Automatically collected activity logs within the application, including viewed trends, posts, comments, and votes; session data, including session start and end times and duration; device data, including device type, operating system, application version, and device identifier; Internet Protocol (IP) address and approximate geographic location; preferred language; and application settings.
1.3 Cookies and tracking data: This may include functional cookies required for the application to operate, performance and analytics data collected through Firebase Analytics or equivalent tools, and push notification tokens.
1.4 Survey participation and interaction data: Information users provide when participating in opinion polls and surveys on the platform, including answers, opinions, ratings, and comments they choose to submit. The nature of this data may vary depending on the survey topic and purpose. Data that is not necessary for the stated survey purpose will not be collected. Such data may also be used to analyse survey results, prepare reports and statistics, understand participants’ views and needs, and improve the services provided through the platform.
1.5 Contact details and preferences: Contact information users choose to provide, such as an email address or telephone number, and any preferences or settings they select concerning platform use or survey participation. This information may be used to contact users about their survey participation or the services provided to them, or to send relevant notifications and information, in accordance with applicable laws and policies.
The data collected varies according to the survey or service selected by the user. Not all categories listed above will necessarily be collected in every case. Some surveys may include questions about particular user characteristics, opinions, or preferences. In such cases, the platform explains the nature of the requested data and the purpose of its collection, and allows users not to participate or not to answer questions for which a response is optional.
The platform collects personal data through lawful and secure means and channels, to the extent necessary to provide services, administer opinion polls and surveys, respond to user needs, improve the platform experience, and meet relevant legal and operational requirements. Personal data may be collected through the following methods, without limitation:
2.1 Data provided directly by users: When registering on the platform, creating an account, updating account details, participating in opinion polls or surveys, using available platform services, contacting us, or providing any other information the user chooses to share.
2.2 Indirect collection: Some data is collected automatically while the application is being used through analytics and cookie technologies (Firebase, Amplitude, or equivalent tools), automated collection of device and network data, and integration with social media platforms when a user chooses to sign in through them.
2.3 Survey participation and interaction data: Data provided when users participate in opinion polls and surveys available through the platform, including answers, opinions, ratings, and comments they choose to submit, according to the nature and stated purpose of each survey.
2.4 Data collected automatically during platform use: The platform may automatically collect technical and usage data when users access or use the platform, such as IP address, operating system, browser type, access date and time, and interaction data, to the extent necessary to operate the platform, improve its performance and security, and analyse usage.
2.5 Other legally permitted sources: Personal data may be collected from other sources where legally permitted and necessary for a specific, legitimate purpose, subject to the rules and controls governing the collection and processing of personal data.
The platform collects and processes personal data to the extent necessary to provide its services, administer the opinion polls and surveys it offers, and improve service quality and the user experience. The purposes for which personal data may be processed include, without limitation:
3.1 Enabling users to register on the platform and participate in opinion polls and surveys, managing their participation, and verifying eligibility for certain surveys according to each survey’s nature and requirements.
3.2 Analysing survey results, understanding participants’ views, trends, and needs, and preparing statistics, analyses, and reports relating to survey results to support service development and improvement.
3.3 Preparing and providing statistical reports and results to clients or other entities for the stated purposes of a survey. Where applicable, this will be done in a way that does not identify users or disclose their personal data, in accordance with the legal requirements governing personal data disclosure.
3.4 Improving and developing the platform and its services, including studying usage and interaction patterns, developing survey methods, improving the user experience, and increasing service efficiency.
3.5 Contacting users about their participation in surveys, providing notifications and information concerning their accounts, services, or surveys in which they have participated, or contacting them for other purposes where legally permitted.
3.6 Verifying and protecting platform security, detecting and preventing unlawful or fraudulent use, resolving technical issues, and taking measures necessary to safeguard information and personal data.
3.7 Meeting legal and regulatory obligations and responding to requests from competent authorities where required or permitted by applicable laws and regulations.
3.8 Retaining and archiving personal data to the extent necessary to achieve the purposes for which it was collected, meet legal retention requirements, or refer to it for other legitimate and legally permitted purposes.
The platform does not collect or process personal data for purposes beyond those specified and disclosed to users. Data collection and processing are limited to the minimum necessary to achieve the stated purpose, taking into account the nature of the services provided.
Based on Articles (5) and (6) of the Personal Data Protection Law and Article (11) of the Implementing Regulations, the Company relies on the following legal bases:
| Legal Basis | Application to TrendX |
|---|---|
| Consent | Obtained from users through an explicit and documented mechanism within the application, separately for each processing purpose. Users may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal, in accordance with Article (12) of the Implementing Regulations. Withdrawal can be made through application settings or by emailing info@trendx.co, and the withdrawal process will be as easy as, or easier than, the consent process. |
| Performance of a contractual obligation | Processing data necessary to provide the service under the terms of use between the user and the application. |
| Legal obligation | Responding to requirements from judicial or regulatory authorities in accordance with the laws in force in the Kingdom. |
| Legitimate interest | Processing non-sensitive usage and performance data to improve the service, secure the platform, and prevent fraud, provided that the processing does not adversely affect the rights and interests of the data subject, in accordance with the definition of legitimate interest in Article (1) of the Regulations. |
We process users’ personal data for specific and legitimate purposes in accordance with the Personal Data Protection Law, its Implementing Regulations, and other relevant laws and regulations. Each processing activity relies on an appropriate lawful basis according to its nature and purpose. The main processing purposes include:
5.1 Providing and administering services: Processing user data needed to create, activate, and manage accounts and services, and to enable users to access and benefit from the platform’s services and features.
5.2 Identity, account, and platform security verification: Verifying a user’s identity when necessary, enabling secure sign-in, protecting accounts and systems, and preventing unauthorised access to or misuse of the platform.
5.3 Conducting surveys and analysing results: Enabling users to participate in surveys and managing data collection, analysis, and the preparation of related results and reports according to each survey’s stated purpose.
5.4 Detecting and preventing fraud and misuse: Detecting, verifying, and investigating fraud or misuse of the platform or surveys, and taking necessary measures to reduce such activity and security threats.
5.5 Compliance with laws and legal obligations: Meeting applicable legal and regulatory obligations and responding to lawful requests from competent authorities.
5.6 Platform improvement and service development: Analysing how the platform is used, measuring user engagement, improving functionality, performance, and user experience, and developing existing or new services and features.
5.7 Analytics and statistics: Conducting analyses and preparing statistics and reports concerning platform use and its services to help us understand usage patterns and improve service quality.
If personal data is transferred or disclosed outside the Kingdom, this will be done in accordance with the requirements and controls set out in the Personal Data Protection Law, its Implementing Regulations, and other relevant laws and regulations, after taking the measures necessary to ensure the required level of data protection.
Where necessary and for specific, legitimate purposes, the platform may share or disclose personal data to other parties in accordance with the Personal Data Protection Law, its Implementing Regulations, and other relevant laws and regulations. Sharing is limited to the data necessary for the stated purpose, and appropriate measures are taken to maintain confidentiality and protect data against unauthorised access, use, or disclosure. Personal data may be shared with the following categories of entities:
6.1 Service providers and processors: Entities that provide technical or operational services to the platform or act on its behalf, such as hosting and cloud storage providers, information technology services, analytics providers, information security providers, technical support providers, and other services necessary to operate, deliver, and improve the platform.
6.2 Partners and service providers: Entities that cooperate with the platform or provide services or solutions related to platform operations, survey implementation, analytics, research, and reporting, within the scope of the stated sharing purpose and in accordance with applicable laws and regulations.
6.3 Government and competent authorities: Where disclosure is required under applicable laws or regulations, in response to a judicial order or decision or a request from a competent authority, or to fulfil a legal obligation imposed on the platform.
6.4 Other parties with your consent: The platform may share personal data with other entities based on your consent, after explaining the purpose of the sharing and the relevant data required.
The platform may use survey data to conduct analyses and research, prepare statistics and reports, develop services, and improve the user experience, within the specific and legitimate purposes for which the data was collected. Where analytical or research results do not identify a data subject or another individual, they may be processed, shared, or published in statistical or aggregated form in accordance with applicable legal controls.
When sharing personal data with another entity, the platform seeks to select entities that have appropriate data protection safeguards. It may also enter into agreements or contractual arrangements defining the scope and purposes of processing and the parties’ obligations regarding the protection, confidentiality, and security of personal data, as required by applicable laws and regulations.
If personal data is transferred or made accessible outside the Kingdom, the platform will comply with the applicable requirements for international transfers and take measures to ensure continued protection of personal data and respect for data subjects’ rights.
Personal data will only be shared or disclosed to the extent necessary to achieve the stated purpose and in accordance with the applicable legal bases and personal data protection requirements.
Under the Personal Data Protection Law and its Implementing Regulations, data subjects have the following rights:
| Right | Description and How to Exercise It |
|---|---|
| Right to be informed | To know what data we collect, the legal basis, how it is processed, stored, and destroyed, and the parties to whom it is disclosed. |
| Right of access | To request access to and obtain a clear, readable copy of your data. A response will be provided within 30 days through info@trendx.co. |
| Right to rectification | To request correction, updating, or completion of inaccurate or incomplete data. A response will be provided within 15 working days, and you will be notified when the correction is completed. |
| Right to destruction | To request destruction of your data when it is no longer needed, unless a legal basis requires retention (Article 18 of the Law). |
| Right to withdraw consent | To withdraw consent at any time without affecting the lawfulness of prior processing, using a process no less easy than the process used to give consent (Article 12 of the Regulations). |
| Right to data portability | To obtain your data in a commonly used, readable electronic format, or request its transfer to another Controller where technically feasible. |
| Right to human review of automated decisions | To request human review of a decision affecting you that was based entirely on automated processing of your data (see Section 21.3), pursuant to Article 11(2)(c) of the Regulations. |
| Right to complain | To submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) if dissatisfied with the handling of your request (see Section 24). |
To exercise any of these rights, contact info@trendx.co or use the application settings. No fees are charged for exercising these rights.
8.1 Storage and protection measures: Personal data is stored on secure servers using approved encryption technologies, in accordance with controls issued by the National Cybersecurity Authority (NCA), with role-based access controls (RBAC) and ISO/IEC 27001:2022 information security management standards.
8.2 Retention periods
| Data Type | Retention Period |
|---|---|
| Active account data | For as long as the account remains active |
| Usage and analytics data | 24 months from the date of collection |
| Security and incident logs | 36 months, or longer where required by law |
| Deleted account data | 30 days from the deletion request, after which it is destroyed |
| Processing audit logs | 12 months for administrative activities |
8.3 Data destruction: When the purpose for processing has ended or the retention period has expired, data is securely destroyed using methods that prevent recovery, including secure erasure and digital destruction techniques in line with applicable international standards (ISO/IEC 27001:2022). This is subject to Article (8) of the Implementing Regulations concerning destruction of all copies, including backups, and notifying entities to which the data was disclosed.
9.1 Registration on TrendX is limited to individuals who have reached 18 years of age. The date of birth entered at registration is used to verify this requirement. An account will not be created for anyone under this age. If the Company discovers that an existing account belongs to someone under 18, the account will be suspended immediately and the individual’s personal data destroyed unless a legal basis requires otherwise.
9.2 If the Company permits younger age groups or introduces services aimed at individuals lacking full legal capacity in the future, their data will only be processed after obtaining the consent of their legal guardian and taking appropriate steps to verify the guardianship, in accordance with Article (13) of the Implementing Regulations.
9.4 When providing consent, the legal guardian must act in the best interests of the data subject who lacks full legal capacity. The Company must ensure that such consent does not harm their interests and must enable them to exercise their rights under the Law once they attain full legal capacity.
9.5 Information about processing will be provided in simple and appropriate language whenever the Company knows that the data subject lacks full legal capacity.
If a personal data breach occurs that may cause harm to data subjects or prejudice their rights or interests, the platform undertakes to:
10.1 Notify the Saudi Data and Artificial Intelligence Authority (SDAIA) within no more than 72 hours after becoming aware of the breach. The notification will include a description of the incident, affected categories of individuals, types of data, risks, measures taken, and contact details for the Personal Data Protection Officer.
10.2 Notify affected data subjects without undue delay, in clear and simple language, describing the incident, potential risks, measures taken, and recommendations to avoid or mitigate harm.
10.3 Document the incident and corrective measures and retain copies of reports submitted to the competent authority for regulatory review.
10.4 Take all necessary measures to limit the effects of the incident and prevent recurrence, without prejudice to any other reporting obligations under requirements issued by the National Cybersecurity Authority.
11.1 Personal Data Protection Officer: Because the Company’s core activities involve processing that inherently requires regular and systematic monitoring of data subjects’ behaviour (including trend tracking, surveys, and analytics), the Company has appointed a Personal Data Protection Officer. The Officer’s responsibilities include acting as a direct point of contact with the competent authority; overseeing impact assessments and review reports; enabling data subjects to exercise their rights and responding to their requests; notifying the competent authority of data breaches; maintaining and updating records of processing activities; addressing internal violations; and taking corrective action. Contact: info@trendx.co (Attention: Personal Data Protection Officer).
11.2 Record of personal data processing activities: The Company maintains a written and up-to-date record of personal data processing activities for the duration of the processing and for an additional five years from the end of each activity. At a minimum, the record includes processing purposes, categories of data and data subjects, retention periods, disclosure recipients, descriptions and legal bases of transfers outside the Kingdom, and security measures. The record will be made available to the competent authority upon request. The Company will also register in the national register of Controllers when the relevant rules are issued and apply to it.
11.3 Personal data processing impact assessment: The Company prepares a documented assessment of the impacts and risks that may affect data subjects, in accordance with Article (25) of the Implementing Regulations, before introducing any new product or service involving personal data processing. This particularly applies to activities involving continuous monitoring of data subjects, decisions based on automated processing, or emerging technologies. If the assessment identifies a risk of harm to privacy, the Company will address the causes and repeat the assessment before proceeding.
TrendX aims to foster the best form of professional dialogue. It is a space built on responsible opinions, thoughtful analysis, and data derived from genuine engagement. We treat one another with respect, disagree professionally, and contribute content that adds value. By participating in TrendX, users commit to building a safe, trustworthy, and professional environment.
1.1 The platform is a space for constructive professional discussion, not personal attacks or abuse. Content involving any of the following is prohibited:
1.2 If you see content that violates these standards, please use the reporting tools available in the application.
The platform is a professional community built on trust. Users are expected to use accurate information, provide truthful details about themselves or their organisations, avoid creating fake accounts, refrain from impersonating individuals or entities, and not publish misleading or fabricated information.
We welcome broad discussions about work, management, markets, trends, and skills, provided that all contributions remain professional. The following are not permitted:
When creating a survey or post, ensure that the question is clear; avoid misleading or provocative wording; do not use content to create division; and do not ask questions that violate privacy or target specific individuals. Content on TrendX should encourage thought, measure trends, and enrich dialogue.
TrendX relies on two complementary systems to identify content that violates these standards:
Following review, content may have its visibility restricted, be flagged for review, or be permanently removed, in accordance with the controls detailed in Part Three.
In specific cases, content that might otherwise violate these standards may be permitted to remain if it has clear educational value, forms part of legitimate professional analysis, or relates to a professionally relevant news event. In such cases, an appropriate warning may be displayed before the content is viewed.
