Back

Security

Security 

Xplere Consultancy · xplere.com 

Last updated: October 19, 2026 

Our clients in sports, entertainment and tourism trust us with business, operational and audience data. This page explains how Xplere Consultancy protects that information, how we handle security incidents, and how to report a vulnerability to us. For how we handle personal data specifically, see our Privacy Policy at https://xplere.com/privacy-policy. 

At a glance 

  • Our website is served over encrypted HTTPS connections and sits behind a security and content-delivery layer. 
  • We limit access to client data to the people who need it for their work. 
  • We handle client personal data as a processor, on documented instructions, under written agreements. 
  • Found a vulnerability? Tell us at [email protected]. We will not take action against good-faith reports. 

 

1. Our approach 

Security is part of how we deliver consulting and technology projects, not an add-on. We apply the principles of least privilege, defence in depth and data minimisation: we collect and keep only what a project needs, protect it with layered controls, and give people only the access their role requires. Our programme is aligned with the Saudi Personal Data Protection Law (PDPL) and with the security requirements our public-sector and club clients set in their contracts. 

2. Website and infrastructure 

  • Encryption in transit. xplere.com is served over HTTPS (TLS), and traffic between your browser and our site is encrypted. 
  • Edge protection. We use Cloudflare for content delivery, DDoS mitigation and web-application filtering.  
  • Patching. We keep the WordPress core, themes and plugins up to date and remove components we do not use.  
  • Backups. Website backups are taken every month and stored for a year. 
  • Spam and abuse protection. Forms and comments are protected by automated spam detection. 

3. Access control 

  • Access to systems and client data is granted on a need-to-know basis and reviewed when roles change or people leave. 
  • Staff accounts use unique credentials, multi-factor authentication is required for email, the website admin and cloud tools 
  • Administrative access to the website and infrastructure is restricted to named personnel. 
  • Staff and contractors sign confidentiality obligations before handling client information.  

4. How we protect client data 

  • Role. When we process personal data for a client (for example fan, member or visitor data), we act on the client’s instructions under a written agreement and do not use that data for our own purposes. 
  • Minimisation. We ask for the minimum data a project needs and use anonymised or aggregated data wherever the work allows. 
  • Segregation. Each client’s project data is kept separate and shared only with the project team. 
  • Secure transfer. We exchange files through approved, encrypted channels rather than ad-hoc methods. 
  • Return and deletion. At the end of an engagement, we return or securely delete client data as the contract requires. 
  • Data location. Where client data must stay in the Kingdom, we agree the hosting location with the client in advance, in line with PDPL and sector requirements. 

5. Suppliers and partners 

We choose suppliers that handle data on our behalf with security in mind, put data-protection terms in our contracts with them, and share only the data they need to provide their service. Our technology and delivery partners are bound by confidentiality and security obligations in their agreements with us. 

6. Testing and monitoring 

  • We monitor our website and infrastructure for availability and suspicious activity by tooling or delete. 

7. Incident response 

We maintain a process to detect, assess, contain and learn from security incidents. If an incident affects personal data and is likely to cause harm, we notify the affected clients and individuals and the competent authority within the timeframes required by the PDPL and by our client agreements, and we tell them what happened, what data was involved, and what we are doing about it. 

8. People and awareness 

Our team receives security and data-protection guidance every 6 months when they join and afterwards, including how to spot phishing and how to report concerns quickly. 

9. Report a vulnerability 

We welcome reports from security researchers and anyone who finds a weakness in our website or services. To report one: 

  1. Email [email protected] with a clear description, the affected URL or system, and the steps to reproduce it. 
  1. Give us reasonable time to fix the issue before you disclose it publicly. 
  1. Do not access, change or delete data that is not yours, disrupt our services, run denial-of-service or social-engineering attacks, or test physical security. 

If you follow these guidelines, we will treat your report as authorised, will not pursue legal action against you for it, and will acknowledge it within 3 business days and keep you updated until it is resolved. We do not currently run a paid bounty programme. 

10. Contact 

Xplere Consultancy 

Al Aqiq District, Riyadh, Saudi Arabia 

General: [email protected] 

Phone: +966 9200 33213 (Sun–Thu, 9:00–18:00 AST)