Transfer Risk Assessment Template for Galu Merchants

Effective date: 27 October 2026

Version: 1.2

About this template

This template helps a store that uses Galu assess the risks of transferring its buyers' personal data outside the Kingdom of Saudi Arabia. As controller of your buyers' data, the assessment and the decision are yours. This template is not legal advice.

It follows the phases, steps and headings of the Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom, published by the Saudi Data and AI Authority (SDAIA) in February 2025 (public classification), in both its English and Arabic editions, from SDAIA's knowledge centre at https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter. Galu fetched both editions on 21 October 2026. SDAIA states that the guideline is intended for reference only and is not legally binding, and that a supporting assessment tool is available on its platform.

Galu has filled in what it knows about its own processing, in the parts marked Galu. The parts marked [ ] are for you to complete. You can download this template as a Word document from this page and fill it in.

This template is published in Arabic and English. If the two versions differ, the Arabic version prevails. It was prepared by Galu, operated by Ahmed Mustafa, freelance document FL-657428298, Jeddah, Saudi Arabia.

Your store

Item	Your answer
Store name	[ ]
Contact for this assessment	[ ]
Assessed by	[ ]
Date of assessment	[ ]
Date of next review	[ ]

First: Preparation Phase

A. Determine Whether the Assessment of Potential Risks and Impacts Is Required

The guideline asks whether any condition in Paragraph (1) of Article (25) of the Implementing Regulation of the Personal Data Protection Law is present.

Condition	Galu	Your answer
1. The processing involves sensitive data	The recording page asks for no sensitive data. A video or photo may show the buyer's face; Galu runs no face recognition and does not use videos or photos to identify anyone.	[ ]
2. Collecting, comparing or linking two or more sets of personal data obtained from multiple sources	Galu does not combine buyers' data with data from other sources.	[ ]
3. Processing on a large scale or on a recurring basis for individuals with partial or complete legal incapacity, continuous monitoring, emerging technologies, or automated decision-making	Buyers must confirm they are 18 or older. Galu does not monitor buyers and makes no automated decisions about them.	[ ]
4. A product or service likely to pose a high risk to the privacy of the data subjects		[ ]

B. Description of Product or Service

Galu: Galu gives your store a recording page with its own link and QR code. You send the link to your buyers. A buyer can send a video of up to 60 seconds or one photo, and can add their name and a star rating, and allow you to contact them about what they sent. The buyer chooses whether you may show it on your website and confirms they are 18 or older. You review what buyers send in your dashboard, and items you approve that the buyer allowed to be shown appear on your Galu wall page and your embeds.

Your use of Galu: [ ]

C. Identifying the Purpose

Galu: to collect videos and photos from your buyers about what they bought, keep a record of each buyer's choices, and show the items each buyer allowed on your website.

Your purpose: [ ]

D. Identifying the Context of the Personal Data Processing

1. Collection Phase

A. Sources of Personal Data Collection: directly from your buyers, on your recording page. No third party supplies data about your buyers.
B. Methods of Personal Data Collection: the recording page (a web form and the phone's camera); session storage in the buyer's browser holds the link tag until sending. The recording page sets no cookies and loads no analytics.

2. Storage/Retention Phase

A. Geographic Location of Storage/Retention: the database in Germany (Frankfurt); video and photo files in the European Union; emails sent from the European Union; website hosting by a United States company with a global network.
B. Place of Storage/Retention: public cloud services of the providers listed in the Third phase below.
C. Period of Personal Data Retention: while your account exists. A buyer can ask you at any time, at the contact your privacy notice shows, to delete what they sent. When you delete a submission its files are deleted, usually within minutes, and its details stay hidden in your account until the account is deleted. After you ask to delete your account, deletion follows 30 days later. Deleted data leaves the database backups within 7 days. Video and photo files have no backups. The Privacy Policy gives the full detail.
Your retention period: [ ]

3. Usage Phase

You and your staff view, approve and export submissions in your dashboard, from wherever you sign in.
Galu: only Ahmed Mustafa has staff access, remotely, from Saudi Arabia, and only to give support at your request, to handle a security incident, to meet a legal obligation, or to operate and maintain the service.
Your other uses: [ ]

4. Disclosure Phase

To the public: only items the buyer allowed to be shown and you approved, on your Galu wall page and your embeds, with the buyer's name if given, the rating if given, and the date and time.
To Galu's sub-processors, listed in the Third phase below.
To authorities, where Saudi law requires.
Your other disclosures: [ ]

5. Destruction Phase

Your deletion of a submission, including at a buyer's request, and deletion of your account, as described in the Storage/Retention Phase above.
How you track retention and confirm destruction: [ ]

Second: Assessing Negative Impacts and Potential Risks of Personal Data Processing Phase

For each activity, the guideline uses these elements: Vulnerabilities or Weak Spots, Source of Threat, Expected Event, Impacts, Probability of Occurrence and Level of Risk (the impact severity relative to the likelihood of occurrence). Galu has filled in the activities and risks it knows of; rate the impact, probability and level yourself.

Activity	Vulnerabilities or Weak Spots	Source of Threat	Expected Event	Impacts	Probability of Occurrence	Level of Risk	Controls and Measures
Storage of video and photo files	Files can be opened by anyone who has the exact address; they are not protected by sign-in	Anyone who obtains a file's address	A video or photo that is not shown publicly is viewed	[ ]	[ ]	[ ]	Long random addresses, not published or listed unless the item is shown; you can delete files
Sign-in to your dashboard	A weak, reused or stolen password	An outside attacker	Someone opens your dashboard and sees or exports buyers' data, including IP addresses	[ ]	[ ]	[ ]	Passwords stored only as a hash; use a strong unique password
Storage with sub-processors	A security incident at a provider	A provider's staff or an outside attacker	Stored data is exposed	[ ]	[ ]	[ ]	Providers' own security; Galu notifies you within 24 hours of becoming aware
Export of consent records	The export contains buyers' IP addresses and browser details	Your own staff	The file is shared beyond those who need it	[ ]	[ ]	[ ]	Export only when needed; [ ]
Buyers' requests to you	A request may come from someone other than the buyer	Anyone who knows your contact for buyers	A submission is stopped or deleted at the request of someone who is not the buyer	[ ]	[ ]	[ ]	Check who is asking before acting; [ ]
[ ]	[ ]	[ ]	[ ]	[ ]	[ ]	[ ]	[ ]

Activities that let a buyer reach their own data: a buyer asks you, at the contact your privacy notice shows, to stop showing or delete what they sent, or about anything else in their data. You should verify the buyer's identity before acting: [ ]

Controls and measures under Article (19) of the Law and Article (23) of its Implementing Regulation: Galu's measures are in section 9 of the Terms of Service. Your administrative, technical and physical measures: [ ]

Third: Risk Assessment for Data Transfer or Disclosure to Entities Outside the Kingdom

1. Risk assessment procedures for the transfer or disclosure of personal data are mandatory

Check whether a condition in Paragraph (1) of Article (7) of the Regulation on Personal Data Transfer outside the Kingdom applies:

Condition	Your answer
a. Transfer of personal data outside the Kingdom or disclosure to entities outside the Kingdom, as specified in Article (4) of the Regulation	[ ]
b. Transfer of sensitive data outside the Kingdom or disclosure to entities outside the Kingdom on a continuous or large scale	[ ]

a. Nature of Data Transfer or Disclosure: every submission is stored outside the Kingdom (the database in Germany, files in the European Union), so the storage is continuous. Galu's staff reach it remotely from Saudi Arabia. Categories of data subjects: your buyers aged 18 or older. Content: a video or photo; optionally a name, a star rating and the permission to be contacted (submissions sent before this version took effect may also hold an email address and caption); the record of the buyer's answers, including IP address and browser details. Your expected volume: [ ]
b. Entities Receiving Transferred Personal Data:

Provider	Purpose	Data involved	Region
Supabase Inc.	Database, sign-in (including the sign-in emails for confirming an address and resetting a password), the server functions that run Galu, and storage of store logos	Merchant account details; submissions (the buyer's name, star rating and contact permission, where the buyer gave them, and, on submissions sent before this version took effect, an email address and caption); consent records, including the buyer's IP address and browser; store logos	Germany (Frankfurt, eu-central-1)
Cloudflare, Inc. (R2 storage)	Stores and serves the video, photo and thumbnail files that buyers send	Video and photo files, and video thumbnails	European Union (R2 EU jurisdiction)
Resend Inc.	Sends Galu's emails: new-submission alerts to merchants, and messages from the in-app support form to Galu's support mailbox	The merchant's email address and store name; in a new-submission alert, the buyer's name and star rating, if given; the content of support messages	European Union (Resend's EU sending region)
Vercel Inc.	Hosts the website, the dashboard and the recording page	The IP address and request details of every visitor, merchants and buyers included	United States company, with a global network that serves each request from a nearby location

All four are companies established in the United States, and may be subject to United States laws that can require disclosure to authorities there (section 7.8 of the Terms of Service). Your evaluation of each entity's security standards and the laws that govern it: [ ]

c. Evaluating the adequacy of measures implemented to reduce negative impacts and potential risks, or identifying and applying additional measures: [ ]

Fourth: The Guidelines for Identifying Factors Related to the Analysis of Implications for the Vital Interests of the Kingdom

This phase considers the implications for the Kingdom's vital interests under Subparagraph (a) of Paragraph (2) of Article (29) of the Law. After reviewing the results above, consider:

Consideration	Your answer
1. The scope of processing, including the content of personal data, the number of data subjects, and their categories	[ ]
2. The scope of the impact of the transfer or disclosure (limited to the data subjects, extending to family and friends, or reaching society at large)	[ ]
3. The adequacy of technical, organizational, and administrative measures and procedures taken to prevent or mitigate risks	[ ]

The guideline says that if, after all steps and measures, the evaluation still indicates high levels of risk and irreversible impacts in the near term on the interests of individuals or the community, the controller should explore alternative methods, such as reassessing whether the processing is needed in its current form, eliminating or modifying it, or adopting more effective measures.

Result and decision

Item	Your answer
Overall level of risk	[ ]
Decision (proceed, proceed with additional measures, or do not proceed)	[ ]
Additional measures to apply	[ ]
Approved by	[ ]
Date	[ ]

Source

Saudi Data and AI Authority (SDAIA), Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (الدليل الاسترشادي لتقويم مخاطر نقل البيانات الشخصية إلى خارج المملكة), February 2025, public classification, published at https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter and fetched by Galu on 21 October 2026. SHA-256 of the files fetched: English edition 287f56e03e77197059aef283e9d8a74a3772160fded15a6e96fe4a88c2aaba17, Arabic edition f4a599963b80d7d002e57225d64b9d2703a0c8a3e9f755ffa54c01880f1c2466. Check SDAIA's knowledge centre for a newer edition before relying on this template.