Privacy Notice

SADAD Payments System, launched by the Saudi Central Bank, first served as the national Electronic Bill Presentation and Payment (EBPP) service provider for the kingdom of Saudi Arabia. SADAD facilities and streamlines a wide range of payment transactions for individuals, banks, businesses, and the government sector, while continuing to develop new payment products and services. SADAD aims to provide you with one solution for all payments.

Taking into account the importance of privacy and protection of personal data, the administration of the SADAD website (“Administration” or “We”) aims to provide the best levels of service with a commitment to maintaining the confidentiality and privacy of personal data entered by or collected from the visitors or/and the Users of the SADAD website (“User”). The privacy notice has been developed to ensure compliance with personal data protection laws and regulations and other relevant applicable legislation in the Kingdom of Saudi Arabia, and to help the ("User") understand the nature of the data we collect and how these data will be processed and stored by the (“Administration”).

The use of the SADAD website by User is considered as a consent to this privacy notice.

Data Collection

The personal data that the ("User") enters for the purpose of registering or using the services of the SADAD website, or that he/she provides via phone or email, is collected, and this data includes, but is not limited to, the following:

• Data required when joining as a service provider (billing or payment channel provider) such as the user’s identification data, including first and last name, national ID or residence number, email address, phone number, and other similar contact data.
• Entity’s information, including name, activities, Commercial Registration, Licenses, and phone number.
• Technical information (IP/cookies).
• Data required when you communicate with us, such as name, email address, phone number, and other similar contact data.

The Legal Basis for Collecting and Processing Personal Data

The Personal Data Protection Law and applicable legislation in the Kingdom require that we inform the ("User") of the legal basis for collecting and processing personal data. SADAD website will only collect and process personal data on the following basis:

• When the collection and processing is necessary to fulfill SADAD website contractual obligations with the ("User"), or
• When we are legally obligated to comply with regulatory or legislative requirements, or
• When the processing is necessary for SADAD website’s legitimate interests. Where permitted by applicable law and regulatory,
• In addition to, to the processing of personal data for other activities mentioned in the below clause (The purpose of collecting and processing the personal data.)

The Purpose of Collecting and Processing the Personal Data

The personal data mentioned in the Data Collection clause is collected and processed for the following purposes:

• Registering on the SADAD website as a billing service provider or payment channel provider and other services and products provided by SADAD.
• Communicating with the ("User") of the SADAD website and interacting with him for various purposes, for example in the event of requesting assistance, responding to any inquiries, complaints, or communicating.
• Monitoring and detecting violations of the terms of use and policies of the site, as well as other potential cases of misuse.
• Managing the SADAD website and implementing its internal operations, including detecting faults, maintenance, raising the level of performance and security of the SADAD website, and other services, and managing its systems and networks.
• Data that does not contain any personal identifiers and cannot be used to identify the ("User") may be used by the ("Administration") to use data and statistical indicators and share them with relevant third parties as the ("Administration") deems necessary.

Personal Data Collection and Processing Methods

The personal data that the ("User") provides to the SADAD website is collected and processed by:

• Registering on the SADAD website by filling out the forms for registering billing service providers or payment channel providers.
• Or communicating directly via the official communication Via (contact us) to inquiries or submit a complaint.
• Through cookies that are collected when you visit the website (cookies).

Personal Data Retention, Storage, and Deletion

Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected, or for specified retention periods as long as necessary, or to meet legal, regulatory, or accounting requirements. In accordance with SADAD website policies and procedures. Data retention periods are subject to regular, periodic review to ensure that personal data is not kept for longer than necessary. Personal data is stored within the Kingdom of Saudi Arabia in SADAD website servers, and these servers are protected with the best technologies in accordance with the policies and controls of the National Cybersecurity Authority, in addition to other applicable standards, to prevent unauthorized access and reduce cyber risks. The data will be securely destroyed so that it cannot be viewed or retrieved again.

Personal Data Protection

• SADAD website takes the protection of personal data seriously and is committed to using the necessary organizational, administrative, and technical procedures and methods to protect personal data from any unauthorized access, use, alteration, or destruction. In addition to conducting internal and external audits, data encryption, and employee training on data protection and privacy
• The Access to personal data is limited to authorized employees based on the purposes and uses determined by the approved policies of SADAD website.

Sharing and Disclosing Personal Data

• SADAD website does not share or transfer personal data to external parties. This excludes any trusted third parties who assist us in operating the Website, or providing products, services, or technical support, as long as they adhere to SADAD cybersecurity and data sharing policies, as well as the regulations and laws related to the protection of personal data in the Kingdom of Saudi Arabia.
• The ("Administration") reserves the right to disclose personal data based on any legal request if such disclosure is compatible with the regulations and Laws adapted in the Kingdom of Saudi Arabia.
• Non-identifying data may be used as part of cumulative statistical data and indicators and shared with all relevant parties, as the ("Administration") considers appropriate.
• Personal data will not be disclosed or transferred or processed outside the Kingdom of Saudi Arabia, except based on the applicable laws and regulations, in the event of necessity or to achieve the intended purposes of collecting and processing it in the first place.

External Links

SADAD website may contain links to third-party websites or services, which are subject to separate privacy policies. Please note that these links are beyond the control of the ("Administration") and are not responsible for how other parties collect or use personal data. The ("User") bears full responsibility for the data and must review the privacy policies of these links.

The Rights of the Personal Data Subject

The data subject ("User") has the right to exercise his rights stipulated in the Personal Data Protection Law which include:

• Right to be informed: the data subject ("User") has the right to be informed about collecting and processing of its personal data and the legal basis for such processing and collecting.
• Right to access: The personal data subject ("User") has the right to request a copy of his/her personal data.
• Right to correct or update its personal data: The personal data subject ("User") has the right to request the correction or update of his/her personal data that he/she deems inaccurate, incorrect or incomplete.
• Right to destroy personal data: The personal data subject ("User") has the right to request the destruction of his/her personal data in certain circumstances, unless there is a legal or contractual requirement require retention of the data for longer period.
• Right to withdraw consent to the processing of personal data: The Data subject ("User") can withdraw his/her consent to the processing of his/her personal data –at any time- unless there are legitimate purpose that require the contrary.

The ("User") has the right to exercise the above rights by communicating with the ("Administration") via the channels mentioned in the communication section below, noting that the ("Administration") may request additional information in order to implement the request or verify identity.

User’s Responsibility for Privacy Protection

• The ("User") is obliged to contact the ("Administration") immediately when it is believed that someone has been able to access his data or his account.
• The ("User") is obligated not to give any confidential information over the phone or the Internet unless the identity of the person or party receiving the information is known.
• The ("User") is obligated not to share login information (user name and password) with others, and not to allow others to use his account.
• The ("User") is obligated to update personal and contact information, if replaced.

Communication, Complaints and Inquiries

In the event that there are some complaints or inquiries related to the Privacy Notice, dealing with personal data, or exercising the rights mentioned in the section “Rights of the Personal Data Subject,” please contact the ("Administration") via (contact us).

Privacy Notice Updates

The ("Administration") reserves the right to add, change, or modify any of the provisions of this privacy notice, and the user will be notified of that. The ("Administration") has the right to suspend the user’s account in the event that the new version of the privacy notice is not accepted.

Issue number: 1.0
Update date: October 9, 2024