Clear purpose
We explain what information is requested in the flow and use it to operate the brief, application and proposal experience.
PRIVACY & SECURITY
TRUST, BY DESIGNPrivacy for
Privacy for
better briefs.
TWOSEL is designed to keep project conversations focused and controlled. This page explains how we approach personal data, access and security with reference to Saudi Arabia’s Personal Data Protection Law.
Data minimisation
We aim to collect information that is relevant to matching, responding to and administering a project—rather than more than is needed.
Protected access
Access is designed around role checks, private invitation links and controlled workspaces rather than public project disclosure.
Information used to make the platform work.
Organisation and contact details, project scope, markets, budgets, timelines, selection criteria and the services sought.
Agency and owner contact details, profile information, specialties, matching-service tags and onboarding information.
Email addresses, short-lived hashed magic-link tokens and security-related session records used to protect workspaces.
Agency responses such as approach, relevant work, team, pricing and timeline, shared in the relevant client workspace.
For the match, the response and the decision.
We process information to create and protect accounts, save and resume briefs, identify relevant agency capabilities, manage invitations and deadlines, receive structured proposals, administer the partner network and respond to lawful support or privacy requests.
A selected agency only receives the project information made available through its invitation. Client workspaces are designed to keep proposals associated with the relevant client brief. Operations access is restricted to administrator-protected platform functions.
Control over your personal data.
The PDPL gives data subjects rights that include being informed, accessing data, requesting a copy, correction and destruction where data is no longer needed. It also provides for withdrawal of consent where consent is the relevant basis. [1]
Be informed
Understand why personal data is collected, how it is used and the relevant legal basis.
Access and obtain
Ask to access personal data held about you and request it in a clear, readable format where applicable.
Correct
Ask us to correct, complete or update personal data that is inaccurate or incomplete.
Request destruction
Ask us to delete personal data that is no longer needed, subject to lawful retention requirements.
Withdraw consent
Withdraw consent where consent is the applicable basis for processing, subject to the PDPL and its regulations.
To exercise a privacy right
Email hello@twosel.com with “Privacy request” in the subject line, the email used on TWOSEL, and the type of request. We may need to verify your identity before responding.
SECURITY APPROACHPractical controls,
Practical controls,
not vague assurances.
Personal data protection
The PDPL calls for organisational, administrative and technical measures to protect personal data, including during transfer. [1]
Cybersecurity reference
The National Cybersecurity Authority publishes ECC 2-2024 and implementation guidance to safeguard information and technology assets. [4]
OFFICIAL SOURCES
Read the source material.
This page is informed by official Saudi government material. Links open in a new window.
01
SDAIA — Personal Data Protection Law
02Official English text of the Personal Data Protection Law (PDPL).
SDAIA — Data protection guidance
03Official overview of PDPL principles, controller duties and data-subject rights.
SDAIA — Laws and regulations directory
04Official access to the implementing regulation, transfer rules, privacy guidance and breach materials.
NCA — Essential Cybersecurity Controls
Official NCA publication of ECC 2-2024 and its implementation guide.