Privacy Policy

1. Introduction

This Privacy Policy outlines Wataniya Finance’s (hereinafter referred to as “WFCO”) commitment to protecting the privacy and personal data of our customers, employees, and other stakeholders in compliance with the Saudi Personal Data Protection Law (PDPL). We recognize the importance of handling personal information responsibly and transparently, and this policy explains how we collect, use, disclose, and safeguard personal data.

WFCO is dedicated to ensuring that personal data is processed lawfully, fairly, and securely, in alignment with the rights of data subjects and in adherence to PDPL principles, including data minimization, purpose limitation, accuracy, and confidentiality. This policy details the types of information we collect, the purposes for which we use it, and the rights of individuals regarding their data.

This Privacy Policy applies to Wataniya Finance Company services in the Kingdom of Saudi Arabia, including our website, mobile applications, and related digital channels.

2. Purpose

This policy aims to inform data subjects (clients, customers, employees, third parties) associated with WFCO about how WFCO deals with the personal data that they collect, process, and maintain. All individuals associated with WFCO, whether employees, clients, contractors, or beneficiaries, should regularly review this privacy policy to get any updates.

3. Policy Statement

3.1 Collecting & using personal data

In accordance with the Saudi Data and Artificial Intelligence Authority (SDAIA), WFCO protects personal data based on ten principles:

• Responsibility: WFCO determines the requirements for privacy protection, documents them, reviews them annually, approves them, and publishes them to all personal data subjects.
• Transparency: A privacy policy shall be drawn up including a specific, clear, and explicit identification of the purposes for which personal data are processed.
• Choice and consent: All possible choices of the personal data subject are determined, and their implicit or explicit consent is obtained regarding the collection, use, or disclosure of their data.
• Limit data collection: Limit the collection of personal data to the minimum amount of data that fulfills the business requirements and purposes identified in this Privacy Policy.
• Access to data: The processing of personal data shall be restricted to the purposes specified in this Privacy Policy for which the data subject has provided implicit or explicit consent and shall be retained as long as this is necessary to achieve the specified purposes or as required by the laws, regulations, and policies in force in the Kingdom of Saudi Arabia, and shall be destroyed in a safe manner that prevents leakage, loss, embezzlement, misuse, or unauthorized access.
• Limit use: How the data subject can access his or her personal data to review, update, and correct it must be determined and provided.
• Limit data disclosure: Restrict the disclosure of personal data to third parties for the purposes specified in this Privacy Policy for which the data subject has provided implicit or explicit consent.
• Data security: Protecting personal data from leakage, damage, loss, embezzlement, misuse, modification, or unauthorized access, according to what is issued by the National Cybersecurity Authority and other competent authorities.
• Data quality: The quality of personal data is ensured by keeping it accurate, complete, and directly relevant to the purposes identified in this Privacy Policy.
• Monitoring and compliance: Compliance with WFCO personal data protection policy is monitored, and privacy-related inquiries, complaints, and disputes are handled.

3.2 Information WFCO collects

WFCO collects information about you through the following methods:

• Application forms
• Written or electronic communication channels
• Data received from authorized third parties
• Data received from governmental organizations

For collecting and processing sensitive data, WFCO always obtains explicit consent from data subjects by providing a clear understanding of the scope of processing. Data subjects can always withdraw their consent (see section 3.16), subject to certain conditions, such as:

1. Withdrawal of consent shall not affect the lawfulness of processing already carried out.
2. Processing of personal data that is based on another legal basis may continue.

3.3 Data you provide to us

When you use WFCO services, we may gather information about you (“Personal Data”), which may include:

• Contact details such as your name, email address, postal address, state, province, ZIP/postal code, city, phone number, financial information (such as account details and salary details), national identification number, and any other personal data as defined by applicable laws and regulations in the Kingdom of Saudi Arabia.
• If applying for a job, details such as employment history, nationality, date of birth, and other pertinent information necessary for conducting background checks.
• Additional account registration and profile details such as job title, educational background, professional qualifications, and photo.
• WFCO also collects your personal information to perform Know Your Customer (KYC) checks prior to disbursing the finance amount. We may also collect information from government organizations (such as a credit check via SIMAH) in order to comply with business and regulatory requirements.

3.4 Tracking technologies and cookies

• A session cookie is created when a user interacts with the website.
• WFCO uses cookies for the following purposes:
  1. Essential cookies: used for technical reasons to enable the website to work efficiently.
  2. Functional cookies: used to remember the choices you make when using our website to provide a more personal experience and to avoid re-entering preferences every time you visit.
• You can manage and disable cookies through your browser settings, including Google Chrome, Safari, Mozilla Firefox, and Microsoft Edge / Internet Explorer.

3.5 Purposes for using your personal data

Depending on your interactions with WFCO and subject to your consent where required, we may use your personal data for the following purposes:

• Employment purposes
• Managing your requests and financing applications
• Commercial activities such as contracts, billing, invoicing, product delivery, order processing, payments, permissible marketing, procurement, supplier due diligence, customer screening, licensing, and non-disclosure agreements
• Maintaining and operating our website, mobile applications, and business
• Compliance with legal obligations, resolving disputes, enforcing agreements, or as otherwise permitted by law
• Contacting you via email, telephone, SMS, or other electronic communications (including push notifications) regarding updates or informative communications related to functionalities, products, or contracted services, including security updates when necessary
• Providing news, special offers, and general information about other goods, services, and events similar to those previously purchased or inquired about, unless you have opted out
• Data analysis, identifying usage trends, and assessing the effectiveness of promotional activities
• Marketing: you may receive marketing communications from WFCO about products and services. You may stop receiving marketing messages at any time by following the links in any marketing message or by contacting the Data Protection Officer using the details in section 3.16. Withdrawing marketing consent does not apply to personal data provided for other purposes, such as providing financing services.

3.6 Disclosure / sharing your information

WFCO may disclose your personal data in the following circumstances:

• With service providers: we may share your personal data with service providers to operate, monitor, and analyze the service, and to contact you.
• With business partners: your personal data may be shared with our business partners to offer you specific products, services, or promotions.
• With your consent: we may disclose your personal data for other purposes with your explicit consent.
• Additionally, your personal data may be disclosed if we have a good-faith belief that such disclosure is necessary to:
  1. Comply with applicable laws, regulations, legal processes, or other legal obligations (including SAMA and SDAIA).
  2. Detect, investigate, and prevent security, fraud, or technical issues.
  3. Protect the rights, property, or safety of WFCO, our users, employees, or others.
• All data shared with third parties is subject to proper due diligence and data processing agreements which ensure that the receiving party is obliged to fulfil its obligations.

3.7 Legal basis of collecting and processing personal data

WFCO operates in the Kingdom of Saudi Arabia and will only process your data in accordance with the lawful bases defined by the Personal Data Protection Law. WFCO processes your personal data based on one or more of the following conditions:

• Your explicit consent. You can withdraw your consent at any time without affecting processing operations carried out based on other legal bases.
• Fulfilment of a contractual obligation, such as employment or providing the requested financing services.
• Compliance with a statutory obligation, such as requirements provided by SAMA or SDAIA.
• Achieving legitimate interests or objectives of WFCO in providing financial services to its customers.

3.8 Information storage

The personal data that we collect from you is securely stored on our databases, located on our secure servers in the Kingdom of Saudi Arabia.

3.9 Data retention

We will keep your personal data for no longer than is necessary for the purpose for which it is being processed, as identified in this Privacy Policy. We retain your personal data until it is anonymized or destroyed as necessary to provide the service, fulfil requested transactions, or for other essential purposes such as complying with legal obligations, maintaining business records, resolving disputes, ensuring security, detecting and preventing fraud and abuse, and enforcing our agreements.

Usage data is generally retained for a shorter period unless needed for security enhancements or service improvements, or retention is legally mandated.

3.10 Data destruction

Upon the cessation of the purpose for which your personal data was stored, WFCO securely destroys it in accordance with internal policies or anonymizes it, subject to applicable laws. Should you require earlier deletion, you may request this by emailing the Data Protection Officer.

3.11 Data security

Wataniya is committed to ensuring the security of your information. We have implemented appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect, preventing unauthorized access or disclosure.

3.12 Your rights

As the owner of personal data under applicable law, you have rights as defined in the PDPL:

• Right to information: know the justification for collecting your personal data and the purpose for which it is processed.
• Right to access: access and obtain a clear and comprehensive copy of your personal data.
• Right to rectification: request correction, completion, or updating of your personal data.
• Right to erasure: request deletion of your personal data, subject to legal provisions.
• Right to withdraw consent: you may withdraw your consent for processing your personal data at any time unless there are legal bases that require otherwise or otherwise stipulated by law. You will not be required to pay any fees for exercising this right.
• Right to a copy: request a copy of collected personal data in a readable and clear format.

Please contact our Data Protection Officer using the details in section 3.16.

3.13 Breach notification

In case of a data breach, WFCO commits to notify data subjects as well as the competent authority and regulator within the defined timeframes:

• To SAMA: within 4 hours once WFCO becomes aware of the data breach
• To the competent authority: within 72 hours once WFCO becomes aware of the data breach
• To data subjects: within 8 hours once WFCO becomes aware of the data breach

3.14 Monitoring and compliance

WFCO regularly audits its data protection processes to ensure compliance with this Privacy Policy and regulatory requirements. Key activities include:

1. Annual compliance reviews, conducted internally and verified by external auditors.
2. Key performance indicators (KPIs) used to measure adherence to data security and processing standards.

3.15 Protect your privacy

To help protect your personal information, we recommend that you:

• Contact us immediately by toll-free phone 8001244342 or email DPO@wfco.sa if you think someone else may have your password, user ID, or other confidential information.
• Do not share your password, user ID, or other confidential information with anyone.
• Make sure your antivirus software is updated regularly.

3.16 Personal Data Protection Officer

Data subjects can exercise their rights by reaching out to the Data Protection Officer at WFCO:

3.17 Complain to the competent authority

You (as a data subject) have the right to submit a complaint to SDAIA within 90 days if you do not receive a positive response from WFCO within 90 days. Complaints can be made to:

• Kingdom of Saudi Arabia — Riyadh
• Saudi Data & AI Authority: sdaia.gov.sa
• National Data Governance Platform (DGP): dgp.sdaia.gov.sa

3.18 Changes to this Privacy Policy

This Privacy Policy will be reviewed at least annually, or as directed by Wataniya Finance Company management, for its appropriateness with the changing internal and external environment, including mandates from the Saudi Data and Artificial Intelligence Authority. Wataniya Finance Company will notify you of any material changes by email, with a revised date.

By using our website, mobile applications, or services, you acknowledge that you have read and understood this Privacy Policy.