Privacy Policy — How Riyadh Web3 Collects, Uses, and Protects Your Data

Introduction and Scope

This Privacy Policy (“Policy”) explains how The Vanderbilt Portfolio (“Publisher,” “we,” “us,” or “our”), the operator of Riyadh Web3 located at riyadhweb3.com (the “Platform”), collects, uses, stores, shares, and protects information about individuals who visit the Platform, subscribe to our newsletters, purchase our products and services, or otherwise interact with us (collectively, “you” or “your”). We are committed to protecting your privacy and handling your personal information with transparency and care.

This Policy applies to all information collected through the Platform, including our website, newsletters, premium content services, data products, and any related services, sales, marketing, or events. It also applies to information collected through email communications, contact forms, and any other channels through which you provide information to us. This Policy does not apply to information collected by third parties, including through any application or content that may link to or be accessible from the Platform.

We take our responsibilities as a data controller seriously and have designed our data practices to be consistent with the principles of data minimization, purpose limitation, and transparency that underpin modern data protection regulation worldwide, including the Saudi Personal Data Protection Law (PDPL), the European Union’s General Data Protection Regulation (GDPR), and other applicable data protection frameworks.

Information We Collect

Information You Provide Directly

We collect information that you voluntarily provide to us when you interact with the Platform. This includes:

Newsletter Subscription Information. When you subscribe to our newsletter, we collect your email address. We may also collect your name, organizational affiliation, job title, and areas of interest if you choose to provide this information through our subscription forms. Newsletter subscription is voluntary, and you may unsubscribe at any time using the unsubscribe link provided in every newsletter we send.

Contact Form and Email Correspondence. When you contact us through the Platform’s contact channels or via email to info@riyadhweb3.com, we collect the information you include in your message, which typically includes your name, email address, organizational affiliation, and the substance of your inquiry. We retain this correspondence to manage our relationship with you and to improve our services.

Premium Subscription Information. When you purchase a premium subscription or data product, we collect the information necessary to process your transaction, including your name, email address, billing address, and payment information. Payment processing is handled by third-party payment processors, and we do not store complete credit card numbers or other sensitive payment instrument details on our servers.

Feedback and User-Generated Content. If you submit feedback, comments, corrections, or other content to us, we collect the information contained in your submission along with any identifying information you provide.

Information Collected Automatically

When you visit the Platform, certain information is collected automatically through cookies, web beacons, and similar tracking technologies. This includes:

Device and Browser Information. We collect information about the device and browser you use to access the Platform, including device type, operating system, browser type and version, screen resolution, and language preferences. This information helps us optimize the Platform for the devices and browsers our readers use.

Usage Data. We collect information about how you interact with the Platform, including the pages you visit, the links you click, the time and duration of your visits, the referring website or source that directed you to us, and your navigation patterns within the Platform. This usage data helps us understand which content resonates with our audience, identify areas for improvement, and measure the effectiveness of our editorial and marketing efforts.

IP Address and Approximate Location. We collect your IP address when you access the Platform. We use IP addresses for security purposes (including detecting and preventing unauthorized access and abuse), for analytics (including understanding the geographic distribution of our audience), and for content personalization (including serving regionally relevant content where applicable). We do not use IP addresses to identify individual users, and we typically process IP addresses in aggregated or anonymized form for analytics purposes.

Cookie Data. Our use of cookies and similar tracking technologies is described in detail in our separate Cookie Policy. In summary, we use strictly necessary cookies to ensure the Platform functions properly, analytics cookies to understand how our audience uses the Platform, and advertising cookies to support our advertising-supported content model through Google AdSense and similar advertising networks.

Information from Third Parties

We may receive information about you from third parties in limited circumstances. These include analytics providers who provide us with aggregated data about our audience demographics and behavior, advertising partners who provide performance data related to advertising campaigns, and public sources such as company websites and professional networking platforms when we are researching organizations that have contacted us for partnership or business purposes.

How We Use Your Information

We use the information we collect for the following purposes:

Providing and Improving Services. We use your information to deliver the Services you have requested, including sending newsletters, providing access to premium content, processing transactions, and responding to your inquiries. We also use aggregated usage data to improve the Platform’s content, design, and functionality.

Communication. We use your contact information to communicate with you about your subscriptions, respond to your inquiries, and send you information related to the Services. We may also send you promotional communications about new content, products, or features that we believe may be of interest to you, but only if you have opted in to receive such communications or if we have a legitimate interest in sending them. You can opt out of promotional communications at any time.

Analytics and Research. We use aggregated and anonymized data to analyze trends in our audience, measure the performance of our content, conduct market research, and produce internal reports that inform our editorial and business strategy. Analytical use of data does not involve identifying individual users and is conducted in a manner consistent with data minimization principles.

Security and Fraud Prevention. We use information, including IP addresses and usage patterns, to detect, investigate, and prevent security incidents, unauthorized access, spam, abuse, and other malicious activity on the Platform.

Legal Compliance. We may use and disclose your information as necessary to comply with applicable laws, regulations, legal processes, or governmental requests, and to protect the rights, property, or safety of The Vanderbilt Portfolio, our users, or others.

Advertising. The Platform uses Google AdSense and may use other advertising networks to display advertisements. These advertising services may use cookies and similar technologies to serve ads based on your prior visits to the Platform or other websites. Advertising revenue supports the free content we provide on the Platform. For more information about how advertising cookies work and how to manage your advertising preferences, please see our Cookie Policy.

Data Sharing and Disclosure

We do not sell your personal information to third parties. We share personal information only in the following circumstances:

Service Providers. We share information with third-party service providers who perform services on our behalf, including email delivery services, payment processors, analytics providers, hosting providers, and customer support tools. These service providers are contractually obligated to use your information only for the purposes of providing services to us and are required to maintain appropriate security measures.

Advertising Partners. Our advertising partners, including Google AdSense, may collect information through cookies and similar technologies as described in our Cookie Policy. This information is used to serve relevant advertisements and is subject to the advertising partner’s own privacy policy.

Legal Requirements. We may disclose your information if required to do so by law or in response to valid requests by public authorities, including courts, regulatory agencies, or law enforcement bodies. We will attempt to notify you of legal demands for your personal information when appropriate and legally permitted.

Business Transfers. If The Vanderbilt Portfolio is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information.

With Your Consent. We may share your information with third parties when you have given us explicit consent to do so.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Specific retention periods depend on the type of information and the purpose for which it is held:

Newsletter Subscription Data. Retained for as long as your subscription is active, plus a reasonable period after unsubscription to process the request and for record-keeping purposes.

Contact and Correspondence Data. Retained for up to three years after the last communication, unless a longer retention period is required for legal or business reasons.

Transaction Data. Retained for seven years in accordance with financial record-keeping requirements.

Analytics and Usage Data. Aggregated analytics data is retained indefinitely. Individual-level usage data associated with identifiable users is retained for up to twenty-six months before being anonymized or deleted.

Server Logs. Retained for up to twelve months for security and operational purposes.

When personal information is no longer needed for the purposes for which it was collected, we delete or anonymize it in accordance with our data retention schedules and applicable law.

Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. These may include:

Right of Access. You may request a copy of the personal information we hold about you.

Right of Correction. You may request that we correct inaccurate or incomplete personal information.

Right of Deletion. You may request that we delete your personal information, subject to certain exceptions such as legal obligations or legitimate interests that require retention.

Right to Restrict Processing. You may request that we restrict the processing of your personal information in certain circumstances.

Right to Data Portability. Where applicable, you may request that we provide your personal information in a structured, commonly used, machine-readable format.

Right to Object. You may object to the processing of your personal information for certain purposes, including direct marketing.

Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted before withdrawal.

To exercise any of these rights, please contact us at info@riyadhweb3.com with “PRIVACY REQUEST” in the subject line. We will respond to your request within the timeframe required by applicable law, typically within 30 days. We may ask you to verify your identity before processing your request.

Data Security

We implement appropriate technical and organizational measures to protect the personal information we collect and process. These measures include encryption of data in transit using TLS/SSL, access controls that limit who within our organization can access personal information, regular security assessments and monitoring, and incident response procedures designed to detect, contain, and remediate security breaches.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information, but we commit to maintaining industry-standard security practices and to promptly notifying affected individuals and relevant authorities in the event of a data breach as required by applicable law.

International Data Transfers

The Platform is operated from multiple locations, and information we collect may be transferred to, stored in, and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your country. When we transfer personal information internationally, we take appropriate steps to ensure that it remains protected in accordance with this Policy and applicable law.

Children’s Privacy

The Platform and Services are not directed to individuals under the age of sixteen, and we do not knowingly collect personal information from children under sixteen. If we become aware that we have collected personal information from a child under sixteen without verification of parental consent, we will take steps to delete that information promptly. If you believe that we may have collected information from a child under sixteen, please contact us at info@riyadhweb3.com.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will update the “lastmod” date at the top of this page and, where appropriate, provide notice through the Platform or via email. We encourage you to review this Policy periodically to stay informed about how we protect your information.

Data Processing Activities Summary

The following table provides a structured overview of our data processing activities, the legal bases we rely upon, and the retention periods applicable to each category of processing. This summary is provided for transparency and to assist data subjects in understanding how their information flows through our systems.

We process personal data in accordance with the principle of data minimization — we collect only the data necessary for each specific purpose and do not retain it beyond the period required. Our data processing register, maintained internally, contains additional detail about each processing activity including the specific systems used, access controls applied, and the identity of any third-party processors involved. Data subjects may request access to the register entries relevant to their personal data by contacting us through the channels specified below.

Saudi-Specific Data Protection Considerations

The Saudi Personal Data Protection Law (PDPL), which became fully enforceable in September 2024, establishes a comprehensive data protection framework that governs our collection and processing of personal data from visitors located in Saudi Arabia. The PDPL’s requirements are particularly relevant to the Platform’s operations given our focus on the Saudi technology ecosystem and our significant Saudi readership.

Under the PDPL, personal data processing requires a lawful basis — consent, contractual necessity, legitimate interest, legal obligation, or protection of vital interests. We rely on consent for non-essential processing activities such as analytics and advertising cookie deployment, on contractual necessity for processing required to deliver subscribed services, and on legitimate interest for processing that supports the Platform’s security and editorial operations. The PDPL’s data minimization principle — requiring that data collection be limited to what is necessary for specified purposes — is reflected in our practice of collecting only the data categories identified in this Policy and retaining them only for the periods specified in our retention schedule.

Data localization requirements under the PDPL mandate that certain categories of personal data pertaining to Saudi data subjects be stored and processed within the Kingdom unless specific conditions for cross-border transfer are met. Where our data processing involves transfers outside Saudi Arabia — for example, through the use of international cloud hosting or analytics services — we ensure compliance through approved transfer mechanisms, including adequacy determinations, standard contractual clauses, or explicit consent. The deployment of local cloud infrastructure by major providers including AWS (launching a Saudi cloud region in 2026 with a $5.3 billion investment), Oracle (operating two Saudi public cloud regions), and Google Cloud has expanded our options for local data processing, and we evaluate data residency options on an ongoing basis to maximize local processing where practicable.

Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: info@riyadhweb3.com (subject line: “PRIVACY INQUIRY”) Publisher: The Vanderbilt Portfolio Editor-in-Chief: Donovan Vanderbilt Platform: https://riyadhweb3.com Effective Date: March 23, 2026