Privacy Notice

Saudi Tadawul Group (“Company”, “We”, “us” or “our”) is committed to protecting your privacy and ensuring compliance with the KSA Personal Data Protection Law approved by the Royal Decree No. 19/m, dated 1443/2/9 (corresponds to 16 September 2021) (“Law”) and its Implementing Regulation. This Privacy Notice will explain how we collect, store and protect your personal data while using our website.

We determine how and why your personal data about you as a customer is collected and used. Therefore, we act as the controller of your personal data under the Law.

Address: King Abdullah Financial District (KAFD) - Parcel 1.17, Financial Blvd, Al Aqiq, Riyadh 13519, Kingdom of Saudi Arabia.

Policy update

This Privacy Notice may be updated at any time to reflect changes in legal, regulatory, or operational requirements. Updated versions will be communicated to you by publishing on the website.

Sources of personal data

We collect and process personal data throughout our website (e.g., “Contact Us”, “Newsletter Subscription”, “Sign Up for Career opportunities” forms, etc.).

Categories of personal data collected

We collect various types of personal data, including, but not limited to:

• Identification details: first name, last name.
• Contact information: phone number, email.
• Online identifiers: cookies and similar technologies, IP address, browser type, language preference, time zone, referring URL, dates and times of access, operating system, and, where applicable, mobile device and network information.
• Other identifying information: Any other information collected that could identify you.

We do not collect or process sensitive personal data through this website.

Legal basis for processing personal data

We will collect and process your personal data under the following legal basis, in accordance with the Law:

• For legitimate interest.
• With your consent to the collection and processing of personal data, where required.

We will ensure that our legitimate interest doesn’t override your rights and freedom. If consent is used as the legal basis for personal data processing, you may withdraw it at any time.

We will uphold the legal basis for data processing. However, we have the right in accordance with the Law to process your personal data for other than the legal bases defined above; which are included in the following cases:

• If your personal data is publicly available and/or has been collected from publicly available source.
• If processing your personal data will serve a vital interest.
• If collection or processing of your personal data is necessary to protect public health or safety, or to protect the life or health of you or other individuals.
• If your personal data is recorded or stored in a form that makes it impossible to identify you directly or indirectly (anonymized data).

Purpose of processing

We will collect and process your personal data only when there is a legal basis to do so, and solely for the purposes including but not limited to communicating with you, sending you a newsletter, and providing you an opportunity to create a profile on our Career Portal.

We may update or modify our processing activities from time to time to reflect changes in operational requirements, legal obligations, or technological developments. When such changes affect the way we collect, use or share your personal data, we will notify you through the appropriate channels (e.g., by updating Privacy Notice on the website).

Data sharing and disclosure

As necessitated by the processing purposes above, we have the right to disclose your personal data to the following entities to allow them to access, collect and process your personal data:

• STG group: STG Subsidiaries and/or entities within STG group.
• Business Partners: Third-party contractors or service providers who perform functions on our behalf (e.g., KABi HYRDD recruitment platform).

Any disclosure of personal data will be in accordance with the Law and in the following circumstances:

• You consent to the disclosure.
• Your personal data has been collected from a publicly available source.
• The entity requesting disclosure is a public entity, and the collection or processing of your personal data is required for public interest or security purposes, or to implement another law, or to fulfill judicial requirements.
• The disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals.
• The disclosure will only involve subsequent processing in a form that makes it impossible to directly or indirectly identify you (anonymized data).
• The disclosure is necessary to achieve our legitimate interests (in this case no sensitive data will be processed).

We store and process personal data within the Kingdom of Saudi Arabia. If it becomes necessary to transfer your personal data for processing outside of the KSA. In such cases we will comply with the requirements of the Law regarding cross-border personal data transfers, as well as with the requirements of other laws and regulations, where applicable, we will:

• Ensure an adequate level of protection in the recipient country, and/or
• Implement safeguards in line with the Law and its Implementing Regulations governing cross-border data transfer (if required).

Data retention

We keep all personal data only for as long as it is necessary to:

• Fulfill the purpose for which personal data was collected.
• Comply with legal, regulatory, or contractual requirements.

Once retention periods have expired, data will be securely deleted or anonymized.

Data subject rights

Under the Law, you have the certain rights regarding your personal data, including:

• You have the right to be informed about your data is collected, stored, processed and retained.
• You have the right to access your data.
• You have the right to obtain copy of your data.
• You have the right to request correction of inaccurate or incomplete data.
• You have the right to request destruction of your personal data, subject to legal or contractual restriction.
• You have the right to withdraw consent where processing is based on consent.

Data security measures

At Saudi Tadawul Group we are committed to protecting the data entrusted to us. We have implemented appropriate administrative security policies, rules and technical measures to protect personal data. All security measures are designed to prevent unauthorized access, discloser, modification and unlawful destruction or loss of data. All security measures are aligned with the applicable laws in the Kingdom of Saudi Arabia.

Cookies

We use cookies to understand how you interact with our services, collect information about visits, and to enhance performance of our website. Some cookies collect information that may identify your device or browser (such as online identifiers), while others collect general information about how the website is used (for example, entry method, navigation, and interaction with pages).

You can manage cookies, which are placed on your devices (tablet, smartphone, PC, etc.): delete cookies, set permissions for them, and withdraw your consent to our use of cookies. Instructions for deleting or blocking cookies on various browsers are available at the links: (Google Chrome, Internet Explorer, Opera, Mozilla Firefox, Safari).

We use analytics and performance services on our website, including Google Analytics and Microsoft Clarity, to analyze how users interact with the website. On our behalf, these service providers analyze website usage to assess performance and improve functionality, content, and user experience.

We may also use third-party cookies provided by platforms such as Google, LinkedIn, and Twitter/X for analytics, performance measurement, and related purposes, subject to your consent where required.

You can refuse the use of non-essential analytics cookies by managing your cookie preferences or by using tools such as the Google Analytics Opt-out Browser Add-on.

Please note that disabling certain cookies may affect the availability or proper functioning of some features and services on the website.

Contact information

If you have any questions or comments regarding our use of your personal data, or you wish to exercise any of your rights as a data subject, please contact us by using the following contact details:

• Email: info@tadawulgroup.sa