At Qiddiya, we may collect Personal Data about you through various channels, including but not limited to:

- When you visit our website and you voluntary subscribe for updates for complete a contact form.
- When you communicate with us electronically or in person.
- When we gather information from third-party sources as permitted by applicable laws and regulations.
- When you voluntary provide personal details and identity-related information.
- When you apply for a job vacancy at Qiddiya or through career and recruitment portals.
- When you are a supplier to Qiddiya, and we collect certain Personal Data about you through the Ariba
Portal

The types of Personal Data we may collect at Qiddiya include:

- Identification Information: Full name, Date of birth, National identification number or passport
number
- Contact Information: Address, Phone number, Email address
- Employment Information: Employment history, occupation, and job title.
- Proof of identity documents: Passport copy, National identification card (ID), Iqama copy for non-
Saudi residents, proof of address documents.
- Communication Records: Records of correspondence and communications with you.
- Sensitive Personal Data: Biometric data (if used for authentication), Health and medical information,
Criminal background information (if legally required or relevant)
- Device Data: Information about your computer (or mobile device), including your IP address,
operating system and browser type.
- Website and Online Data: Data collected through website usage, cookies, and analytics. When you
use our Website, we automatically collect the information sent to us by your computer, mobile phone
or other device. This information includes: (i) your IP address; (ii) device information including, but
not limited to, name and type of operating system; (iii) mobile network information; and (iv) standard
web information such as your browser type and the pages you access on our Website.
- Marketing and Preferences Data: Your preferences and consent for marketing communications.
- Client Interactions and Feedback: Feedback, inquiries, and complaints you send us, with any
accompanying information.

At Qiddiya, we may process the above types of Personal Data collected in connection with
Qiddiya’s Website in line with the below lawful basis for processing and processing
purposes.

We process your personal data in order to perform our contract with you, such as:
- Providing you with your Website and other content.
- Preparation of the employment contracts and completion of the hiring procedure.
- Sending you notifications relating to your application.

We obtain your consent to process your personal data for the following reasons:

- Sign you up for our newsletters or alerts.
- If you opted into marketing, for marketing and promotional activities such as sending general or
targeted announcements relating to events, news and information we think will be of interest to you.

In order to be responsive to you, to provide effective services to you, and to maintain our business
relationship, as a matter of our legitimate interests, we will use your personal data for:

- Creating Suppliers’ accounts.
- Managing our business efficiently.
- Providing you with more relevant products and services
- Improving and developing our Website and other services.
- Maintaining the
- System administration or for our commercial purposes through processing Device Data. This data is
used for statistical analysis of our users' browsing actions and patterns, and it does not identify any
individual.

In addition, we will use some or all of the above Personal Data to comply with any applicable legal
obligations, to enforce any applicable Terms of Use, and to protect or defend the Website, our services,
our rights, the rights of our users, or others.

At Qiddiya, we may disclose your Personal Data to third parties with your consent, as
necessary, or as otherwise required or permitted by law. Specifically, we share your Personal
Data in the following circumstances:

- With service providers and vendors. Such third parties include: (i) data analytics vendors; (ii) security
vendors; and (iii) website hosting vendors. These service providers assist us with many different
functions and tasks, such as providing data storage and IT services and communicating with you.
- When you request us to share information with third parties, with consent or to perform a contract
with you. With your permission, we will disclose your Personal Data with relevant third parties. This
could be in the form of a verbal agreement or a written agreement.
- To our subsidiaries and affiliates, in our legitimate interests. We may share your Personal Data with
companies within our corporate family.
- With professional advisors, in our legitimate interests or as required by law. As necessary, we will
share your Personal Data with professional advisors such as auditors, law firms, or accounting firms.
- For legal and security reasons and to protect our services and business, in our legitimate interests or
as required by law. We will share your Personal Data with regulators, law enforcement agencies,
public authorities, or any other relevant organisations: (i) in response to a legal obligation; (ii) if we
have determined that it is necessary to share your Personal Data to comply with applicable law or any
obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory
inquiries; (iii) to protect the interests of, and ensure the safety and security, of us, our users, a third
party or the public; (iv) to exercise or defend legal claims; and (v) to enforce our Terms of Use, other
applicable terms of service, or other agreements.
- In connection with a business transaction or re-organisation, in our legitimate interests. We will share
your Personal Data with a prospective buyer, seller, new owner, or other relevant third party as
necessary while negotiating or in relation to a change of corporate control such as a restructuring,
merger, or sale of our assets.

Rest assured that we ensure any third parties with whom we share your Personal Data comply with
appropriate data protection and confidentiality measures as mandated by the applicable laws and
regulations.

We may transfer your Personal Data to countries outside of the Kingdom of Saudi Arabia, and your
Personal Data may be processed by staff operating outside of the Kingdom of Saudi Arabia who work
for us or one of our third party service providers or partners. We will ensure that adequate
safeguards are in place to protect your Personal Data, as required by applicable data protection laws
and regulations. These safeguards may include implementing standard contractual clauses approved
by relevant data protection competent authorities or relying on other legal mechanisms recognized by
the competent authorities.

We take our responsibility to protect your Personal Data very seriously. We use physical, technical,
and procedural safeguards that comply with applicable legal standards to ensure the security and
confidentiality of your Personal Data from unauthorized access, use, disclosure, accidental or unlawful
alteration, destruction and other unauthorized forms of processing. However, we cannot guarantee
the security of your Personal Data transmitted through the Website; any transmission is at your own
risk.

We retain your Personal Data for as long as necessary to fulfill the purposes outlined in this Privacy
Notice unless a longer retention period is required or permitted by applicable laws and regulations.
We will retain and use your Personal Data to the extent necessary to comply with our legal
obligations, resolve disputes, and enforce our legal agreements and policies. When Personal Data is
no longer required, we securely dispose of, anonymize, or de-identify it.

At Qiddiya, we may collect and process Personal Data concerning your authorized representative(s) if
you have designated another person to act on your behalf concerning our services or interactions
with us. It is your responsibility to ensure that you have obtained the necessary consent from your
representative(s) to provide us with their Personal Data.

You have certain rights regarding your Personal Data, including:

The right to be informed: You have the right to know and be informed about the processing of your
Personal Data, including our contact details, the specific reasons for collecting your Personal Data,
the methods used for Personal Data collection, and whether this collected Personal Data will be
shared with third parties.
- The right to access: You have the right to access your Personal Data held by us.
- The right to obtain a copy: You have the right to obtain a copy of your Personal Data held by us.
- The right to request rectification: You can request the correction or update of any incomplete,
inaccurate, or outdated Personal Data that Qiddiya has collected.
- The right to request erasure: You have the right to request the deletion of your Personal Data
collected by Qiddiya. This can be due to various reasons, such as you are withdrawing your consent
for data collection or the data no longer serving its initial purpose. However, please note that Qiddiya
may retain such information in accordance with applicable laws and regulations.
- The right to withdraw consent: You can withdraw your consent to processing where consent is the
lawful basis as required by law.

Please note that a number of these rights only apply in certain circumstances, and all of these rights
may be limited by law. Your rights may also depend on the jurisdiction in which you reside.

Please note that this statement outlines your rights and choices concerning your
Personal Data when interacting with Qiddiya:

Qiddiya is committed to ensuring that you are properly informed about your rights and has
established dedicated channels for you to exercise them effectively. We aim to address all requests or
complaints within 30 days and maintain records of all interactions. If you believe any of your Personal
Data is inaccurate or incomplete wish to exercise any of these rights or have any privacy-related
inquiries, please don't hesitate to contact us using the provided contact details below.

Where we rely on your consent for processing Personal Data, you have the right to withdraw your
consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on
consent before its withdrawal. To manage your consent preferences, please contact us using the
details provided below.

While we take reasonable steps to protect your Personal Data, you need to act appropriately to
safeguard your information, such as keeping your login credentials secure and promptly notifying us
of any unauthorized access to your Personal Data you may be aware of.

If you are under the age of eighteen (18), you must obtain the consent of your parent or legal
guardian before using our Website or providing any Personal Data to us.

We do not knowingly collect Personal Data from minors without the consent of their parents or
guardians. If you believe that we have inadvertently collected the Personal Data of a minor, please
contact us immediately so that we can act appropriately to delete the relevant Personal Data.

If we seek your consent to process your Personal Data for a specific purpose in accordance with this
Privacy Notice, such consent must be granted on your behalf by your parent or guardian. By using
our Website, you represent and warrant that you are of the required age in your jurisdiction or have
obtained the necessary parental or guardian consent.

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely,
for security and safety purposes, where we may use closed-circuit television (CCTV) cameras and
surveillance systems on our premises. The recorded footage may be used to monitor and investigate
security incidents, prevent fraud, and ensure the safety of our employees, residents, visitors,
suppliers.

At Qiddiya, processing for this purpose is based on your consent. This may include using your
Personal Data, including your email address, mobile number, and mailing address, to deliver
advertising directly to you or on our websites as well as sending you marketing communications
regarding our promotions, and events. You have the option to withdraw your consent or opt out of
receiving marketing communications at any time by following the instructions provided in the
communication or by reaching out to us using the contact details provided below. Our marketing
communications may include both personalized and non-personalized materials, with personalized
materials being tailored specifically based on the information we have about you.

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely, to
engage with you on social media platforms to provide information, respond to inquiries, and promote
our events. Please note that any information you post or disclose on our social media pages may be
visible to the public, and you should exercise caution when sharing Personal Data or Sensitive
Personal Data.

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely, to
ensure quality control, assurance, training, and compliance purposes, we may monitor and record
telephone calls, including customer service calls and calls with our representatives as well as record
electronic communications, such as emails and instant messages, exchanged between you and our
representatives. We will notify you if a call is being recorded, and the recorded calls will be overseen
in accordance with applicable data protection laws and regulations. These measures are taken to

A cookie is a small file that is placed on your computer’s hard drive. Its functions include storing your
login and session statuses, recording your user preferences, and analyzing web traffic.
Apart from the data that you elect to disclose and share with us, we cannot access your computer or
any other information about you with cookies. Although most browsers automatically accept cookies,
you can amend your browser settings to disable cookies or interact with any cookies consent
mechanism we provide. This may however prevent you from fully experiencing the website as it was
intended.

For more information, please refer to our Cookies Policy.

Our Website may contain links to third-party websites or services that are not operated or controlled
by us. This Privacy Notice does not apply to such third-party websites or services, and we are not
responsible for their privacy practices, content or their use of your information. We encourage you to
review the privacy policies of those third parties before providing any Personal Data to them.

Qiddiya reserves the right to modify or update this Privacy Notice as needed from time to time,
including to reflect changes in our privacy practices and legal obligations or in accordance with
applicable data protection laws and regulations. We will notify you of any significant changes by
posting the updated Privacy Notice on our website or using other appropriate means. We encourage
you to periodically review this Privacy Notice for any updates. The revised Privacy Notice will take
effect as of the updated effective date stated at the beginning of the notice.

This Privacy Notice shall be governed by and construed in accordance with the applicable laws of the
Kingdom of Saudi Arabia. Any disputes arising out of or relating to this Privacy Notice shall be subject
to the exclusive jurisdiction of the courts of Kingdom of Saudi Arabia.

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the
English language version and local language version of this Privacy Notice, the English language
version will prevail.

If you have any questions, concerns, or requests regarding this Privacy Notice or our privacy
practices, please contact:
DataOffice@qiddiya.com