Privacy Policy (PDPL)

PRIVACY POLICY (سياسة الخصوصية)

Legal entity name​ (Commercial Registration No. Commercial Registration (CR) number​)

This policy is issued under the Personal Data Protection Law (Royal Decree No. M/19 of 2021), in full force since 14 September 2024, regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA). SDAIA has been an active enforcer — 48 violation decisions were issued in 2025–2026 — with fines of up to SAR 5 million (doubled for repeat violations; intentional leakage of sensitive data can carry up to 2 years' imprisonment).

1. DATA WE COLLECT 1.1. Categories of data collected​

2. WHY WE COLLECT IT 2.1. Purposes of processing​ 2.2. Legal basis: Legal basisConsent (default basis)Contract performanceLegal obligationVital interest. Consent is the default legal basis under the PDPL; for marketing communications, only an explicit opt-in is acceptable, and legitimate interest is NOT an available basis for processing sensitive personal data.

3. RETENTION 3.1. Retention period​

4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors​

5. CROSS-BORDER TRANSFER 5.1. Cross-border transfer​ 5.2. Transfers outside the Kingdom must comply with SDAIA's Data Transfer Regulations.

6. DATA PROTECTION CONTACT 6.1. Data protection contact​ 6.2. Registration on the National Data Governance Platform and appointment of a dedicated Data Protection Officer are required only where SDAIA's criteria for large-scale or sensitive processing are met — a smaller business needs only a documented contact person.

7. YOUR RIGHTS 7.1. Data subject rights and request channel​

Version date: Policy version date