Privacy Policy Notice

This is the Privacy Policy content in English for UAE.

Introduction

This Privacy Policy has been prepared in accordance with the Personal Data Protection Law in the Kingdom of Saudi Arabia and the guidelines of the Saudi Data & AI Authority (SDAIA). This policy aims to clarify the data collected from you, the reason for its collection, and how it is processed and protected throughout its retention by Geidea.

This privacy notice applies to all sectors and business units in the Company. All Company staff, contractors, and vendors working either on a permanent or temporary basis are obliged to follow the outlined standards.

You can contact us via various available channels, using the contact details provided in this policy.

Who We Are

Geidea Co for Technology: Geidea Co for Technology is a company incorporated and organized under the laws of the Kingdom of Saudi Arabia, with its registered address at Canary Center 7304, Al-Sulaimaniyah Dist., Riyadh 122431, Kingdom of Saudi Arabia, established under Commercial Registration No. 1010332533 on 26/04/1433H. It will be referred to hereinafter as ("Geidea", "we", "our", or "us").

Commercial Registration No.: 1010332533

National Address: RHSB7304

What Personal Data We Collect and Use

In order to provide our customers with excellence in our services, it is necessary for Geidea to collect their Personal Data. Below is a non-exhaustive list of some Personal Data the company may use:

✓Personal details, for example: name, date of birth, nationality, country of residence, ID number and contact preferences.
✓Contact details, for example: mobile number, email and national address.
✓Contact details for the purposes for which you have given the company consent: phone number, e-mail address.
✓Customer Service Interactions: data exchanged with the company when using our customer support services, or any data provided as feedback or from web surveys.
✓Social Interactions: data provided when using social media to interact with the company.
✓Data provided by a third party (such as an agent) when you are referred or registered on the Website by them.
✓Data required for your use of our services, website or mobile app (such as cookies and usage data).
✓Data exchanged during communications with you (such as customer support requests and feedback).
✓Data required to improve operational services and resolve device-related complaints (such as merchant location data).

How We Collect Your Personal Data

We may collect personal data directly from you in different ways, including:

Direct Collection

✓Product and Services – when you register, use, or sign a contract to become our customer and use one of our products or services.
✓Direct Interactions – when you complete a form and send it to us via our website, mobile apps, email, post or a call to our call center, including enquiries or participation in a promotion.
✓Social Media Interactions – any posts and interactions you have directly with us on social media channels.
✓Browsing – data about how you use our website, including the date and time of your visit, the type of internet browser you use, and how you were referred to our website.
✓Web Surveys – data gathered through our online surveys regarding feedback on our website, mobile apps, and Customer Service; provision of your name and other details is optional.

Indirect Collection

✓Cookies Technologies.
✓Automatic Collection of Information.
✓Website Analytics.
✓Interconnection With Another Entity.

Legal Basis for Collecting and Processing Your Personal Data

In accordance with the Personal Data Protection Law, the legal basis on which we rely in processing such data is as follows:

Your explicit consent is one legal basis we rely on. You can withdraw your consent at any time without affecting processing operations carried out based on other legal bases. To do so, you can reach the Data Management Office at Geidea using the contact details provided in this policy.

Contractual: To fulfil our service obligations to you.

Legal Obligation: To comply with government requirements, including but not limited to national security and protection of public health.

Legitimate Interest and Consent:

✓Legitimate interest – for activities such as certain types of marketing, preventing fraud, and ensuring network and information security.
✓Consent – for other activities such as information, sales, and certain types of marketing.

Public Interest: For processing based on regulatory entities' requests or for public interest purposes. In addition, Geidea may work with other entities to ensure quality of service is provided; where your personal data is disclosed to these entities, it is restricted to the purposes specified in this privacy notice for which you have provided consent.

Data Minimization

Geidea ensures data is deleted once it is no longer necessary and avoids collecting third-party personal data unless required by law.

Personal Data Protection and Disclosure

Geidea always maintains the privacy and confidentiality of all personal data collected. Such data may only be disclosed or shared when approved and required by law, or when we believe such action is necessary or desirable to provide products and services or technical support. Geidea does not rent, sell, exchange, or transfer your personal data to third parties outside of Geidea or partner companies without your permission, unless it is collected without identifiers on an aggregated basis for analytical purposes, studies, or reports, with adherence to personal data protection regulations in the Kingdom of Saudi Arabia. We may also share information with trusted third parties who assist in operating our website, conducting our business, or providing services to you, provided they commit to maintaining confidentiality. Geidea will not disclose your personal data without your consent except under the following circumstances, where the entity requesting disclosure is a public entity and the data will be shared in strict accordance with the controls and procedures set out in the Personal Data Protection Law of the Kingdom of Saudi Arabia:

✓For security purposes.
✓To implement another law.
✓To meet judicial requirements.
✓To protect public health or safety.
✓To protect the life or health of a particular individual(s).
✓Sharing with a debt collection agency, credit bureau or insurance business to protect the interests of the Group and to prevent fraud or other illegal practices.
✓Sub-processing some or all of your contracted services with Geidea for better delivery of those services, for example courier businesses or identity verification service providers.

How Long We Store Your Personal Data

Your Personal Data will be stored for as long as necessary to fulfil the purpose for which it was collected, unless required to be kept longer for compliance with another law, a legal purpose (e.g. to fulfil a judicial/court order), or by a regulatory authority's rules and regulations to which the company must comply. When stored, Geidea takes all reasonable steps to protect your Personal Data against misuse, loss, unauthorized access, modification or disclosure. Archival of Personal Data is done in a secure environment and subject to company internal best practice and restrictions to protect it. Destruction of your Personal Data is done using secure methods that prevent access or retrieval: digital data is destroyed using secure deletion techniques (multiple overwrites, or encryption followed by deletion of the encryption key), and paper documents are shredded so they cannot be reassembled or read.

Where Do We Process Information About You?

We may need to transfer personal information about you to other companies in the Group or third parties located in KSA. If we send personal information about you outside KSA, we will make sure that such transfer is permitted by law and that your personal information is adequately protected as required by applicable law, which may include entering into a Data Sharing Agreement (DSA) or Data Processing Agreement (DPA) with the relevant parties. Except for cases of extreme necessity to preserve the life or health of an individual or their vital interests, Geidea may not transfer personal data outside the Kingdom or disclose it to a party outside the Kingdom, unless this is in implementation of an obligation under a convention to which the Kingdom is a party, or to serve the interests of the Kingdom.

How Do We Protect Your Personal Data?

✓Protection against data breaches and malicious actors/hackers.
✓Implementing relevant controls, standards, and rules issued by the National Cybersecurity Authority, including best practices and cybersecurity standards.
✓Compliance with any requirements mandated by the Saudi Central Bank (SAMA).
✓Note: the internet is not totally secure, and the company cannot be held responsible for third-party or external links.

Your Rights Regarding Processing of Your Personal Data

✓Right to Be Informed: You are entitled to be informed how we collect your personal data, the legal basis for collection and processing, how such data is processed, stored, and destroyed, and to whom it will be disclosed.
✓Right of Access to Your Personal Data: You have the right to request access to your personal data held by Geidea.
✓Right to Request Access to Your Personal Data: You are entitled to request access to your Personal Data held by Geidea in a readable and clear format, consistent with the content of the records, in electronic format (when technically possible) or as a printed copy.
✓Right to Request Correction of Your Personal Data: You are entitled to request correction of your Personal Data that you believe is inaccurate, incorrect or incomplete.
✓Right to Request Destruction of Your Personal Data: You are entitled to request erasure of the Personal Data held about you in certain circumstances only; your deletion request will be balanced against our specific legitimate/legal ground for retention.
✓Right to Withdraw Your Consent for Processing Your Personal Data: You are entitled to withdraw your consent for processing your Personal Data at any time, unless legal bases require otherwise.
✓Right to Request Restriction of Personal Data Processing in Case of Inaccuracy: You have the right to request the restriction of processing your personal data until it is corrected if it is inaccurate, unless legal bases require otherwise.

Response Time

In case of submitting a request to exercise your rights, you will receive a response within 30 days of the request receiving date. Geidea reserves the right to extend this timeframe if the request requires unexpected or extraordinary efforts or if multiple requests are received from the same data subject; this extension shall not exceed an additional thirty days, and Geidea will notify the data subject in advance about the extension and the reasons for it.

Request Costs

Unless otherwise stipulated by law, you will not be required to pay any fees in return for exercising your rights regarding your personal data.

Contacting Geidea for Personal Data Requests

If you have a request regarding your personal data or wish to exercise any of your rights — such as obtaining a copy of your data, modifying/correcting it, requesting its destruction, or withdrawing previously given consent — you can contact us through the channels below, or fill out the Service Form and send it to the Data Management Office. Our specialized team will handle your request and update you with the results.

Data Management Office / Personal Data Protection Officer

Address: Riyadh - Al Sulaimaniyah Dist. - Prince Abdul Aziz Bin Musaid Bin Jalawi - Canary Center - Geidea Co - Data Management Office

Phone: 011 465 2881

Email: gdmo@geidea.net

Disclaimer

✓The internet is not totally secure, and the company cannot be held responsible for third-party or external links.

Date of Last Update

Effective Date: 14 Sep 2024. Please be aware that this Privacy Notice will be updated from time to time to recognize any changes in privacy law or modifications to regulations the Group must comply with.

Governing Law and Complaints

This Privacy Policy has been prepared in accordance with the Personal Data Protection Law in the Kingdom of Saudi Arabia and the guidelines of the Saudi Data & AI Authority (SDAIA). If you have concerns or feel we are not complying with the Personal Data Protection Law, you can submit a complaint to the Geidea Data Management Office. If you are not satisfied with our handling of the complaint, or if we do not respond within 30 business days from the date of receiving it, you can escalate it to the Saudi Central Bank (SAMA), Riyadh, Kingdom of Saudi Arabia (https://sama.gov.sa/), or via the National DG Platform (https://dgp.sdaia.gov.sa/).