Privacy Notice

This Privacy Notice describes how Qiddiya Investment Company, registered in the Kingdom of Saudi Arabia with our office located at Riyadh Digital City, MU04 – 10th Floor, Prince Turki Bin Abdulaziz, Al Awwal Road, Al Nakheel District, Riyadh 12382-6651 (hereinafter referred to as "we," "us," or "our") collects, uses, discloses, and protects information relating to you (your “Personal Data”) in relation to our website at Qiddiya.com and related webpages (our “Website”). For the purpose of data protection laws, we are the data controller. We are committed to ensuring the privacy and security of your Personal Data and complying with the applicable data protection laws in the Kingdom of Saudi Arabia, including but not limited to the Kingdom of Saudi Arabia Personal Data Protection Law (“KSA PDPL”) and its Implementing Regulations (“the Regulations”).

Please read this notice carefully to understand our practices regarding your personal data. If you do not agree with this notice in general or any part of it, you should not access the website, or otherwise provide your personal data to us.

This notice should be read alongside our Cookies Policy and Terms of Use.

Collection of personal data

At Qiddiya, we may collect Personal Data about you through various channels, including but not limited to:

When you visit our website and you voluntary subscribe for updates or complete a contact form
When you communicate with us electronically or in person.
When we gather information from third-party sources as permitted by applicable laws and regulations.
When you voluntary provide personal details and identity-related information.
When you apply for a job vacancy at Qiddiya, participate in the Qiddiya programs for training or placement opportunities or otherwise submit information to us through career and recruitment portals.
When you are a supplier to Qiddiya, and we collect certain Personal Data about you through the Ariba Portal

The types of Personal Data we may collect at Qiddiya include:

Identification Information: Full name, Date of birth, nationality, National identification number or passport number
Contact Information: Address, Phone number, Email address
Employment Information: Employment history, occupation, job title, visa status, dependent information, salary and notice period.
Proof of identity documents: Passport copy, National identification card (ID), Iqama copy for non-Saudi residents, proof of address documents.
Communication Records: Records of correspondence and communications with you.
Sensitive Personal Data: Biometric data (if used for authentication), Health and medical information, Criminal background information (if legally required or relevant)
Device Data: Information about your computer (or mobile device), including your IP address, operating system and browser type.
Website and Online Data: Data collected through website usage, cookies, and analytics. When you use our Website, we automatically collect the information sent to us by your computer, mobile phone or other device. This information includes: (i) your IP address; (ii) device information including, but not limited to, name and type of operating system; (iii) mobile network information; and (iv) standard web information such as your browser type and the pages you access on our Website.
Marketing and Preferences Data: Your preferences and consent for marketing communications.
Client Interactions and Feedback: Feedback, inquiries, and complaints you send us, with any accompanying information.
CV/Resume Data: This includes all data typically found in a CV or resume, such as educational information, skills and competencies, professional memberships and affiliations, driving licence status, languages, references, achievements and awards, publications and research.

Use of personal data

At Qiddiya, we may process the above types of Personal Data collected in connection with Qiddiya’s Website, including its programs, in line with the below lawful basis for processing and processing purposes.

We process your personal data in order to perform our contract with you, such as:

Providing you with your website and other content.
Preparation of the employment contracts and completion of the hiring procedure.
Sending you notifications relating to your application.
Sharing your information for training or program placement with relevant partners or third parties involved.

We obtain your consent to process your personal data for the following reasons:

Sign you up for our newsletters or alerts.
If you opted into marketing, for marketing and promotional activities such as sending general or targeted announcements relating to events, news and information we think will be of interest to you.
To share your candidate profile with our partners and third parties involved in the Qiddiya programs for training, evaluation, and placement opportunities.

In order to be responsive to you, to provide effective services to you, and to maintain our business relationship, as a matter of our legitimate interests, we will use your personal data for:

Creating Suppliers’ accounts.
Managing our business efficiently.
Evaluating your employment or similar applications.
Providing you with more relevant products and services.
Improving and developing our website and other services.
Maintaining the Website and our programs.
System administration or for our commercial purposes through processing Device Data. This data is used for statistical analysis of our users' browsing actions and patterns, and it does not identify any individual.

In addition, we will use some or all of the above personal data to comply with any applicable legal obligations, to enforce any applicable Terms of Use, and to protect or defend the website, our services, our rights, the rights of our users, or others.

Disclosure of personal data

At Qiddiya, we may disclose your Personal Data to third parties with your consent, as necessary, or as otherwise required or permitted by law. Specifically, we share your Personal Data in the following circumstances:

With third-party organizations, training providers, and recruitment partners for the purposes of candidate evaluation, training, placement, and program management as part of the Qiddiya programs, ensuring that these parties adhere to appropriate data protection and confidentiality measures as required by applicable laws.
With service providers and vendors. Such third parties include: (i) data analytics vendors; (ii) security vendors; and (iii) website hosting vendors. These service providers assist us with many different functions and tasks, such as providing data storage and IT services and communicating with you.
When you request us to share information with third parties, with consent or to perform a contract with you. With your permission, we will disclose your personal data with relevant third parties. This could be in the form of a verbal agreement or a written agreement.
To our subsidiaries and affiliates, in our legitimate interests. We may share your personal data with companies within our corporate family.
With professional advisors, in our legitimate interests or as required by law. As necessary, we will share your personal data with professional advisors such as auditors, law firms, or accounting firms.
For legal and security reasons and to protect our services and business, in our legitimate interests or as required by law. We will share your personal data with regulators, law enforcement agencies, public authorities, or any other relevant organisations: (i) in response to a legal obligation; (ii) if we have determined that it is necessary to share your personal data to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries; (iii) to protect the interests of, and ensure the safety and security, of us, our users, a third party or the public; (iv) to exercise or defend legal claims; and (v) to enforce our Terms of Use, other applicable terms of service, or other agreements.
In connection with a business transaction or re-organisation, in our legitimate interests. We will share your personal data with a prospective buyer, seller, new owner, or other relevant third party as necessary while negotiating or in relation to a change of corporate control such as a restructuring, merger, or sale of our assets.

Rest assured that we ensure any third parties with whom we share your personal data comply with appropriate data protection and confidentiality measures as mandated by the applicable laws and regulations.

Cross-Border data transfers

We may transfer your personal data to countries outside of the Kingdom of Saudi Arabia, and your personal data may be processed by staff operating outside of the Kingdom of Saudi Arabia who work for us or one of our third party service providers or partners. We will ensure that adequate safeguards are in place to protect your personal data, as required by applicable data protection laws and regulations. These safeguards may include implementing standard contractual clauses approved by relevant data protection competent authorities or relying on other legal mechanisms recognized by the competent authorities.

Security of personal data

We take our responsibility to protect your personal data very seriously. We use physical, technical, and procedural safeguards that comply with applicable legal standards to ensure the security and confidentiality of your personal data from unauthorized access, use, disclosure, accidental or unlawful alteration, destruction and other unauthorized forms of processing. However, we cannot guarantee the security of your personal data transmitted through the website; any transmission is at your own risk.

Retention of personal data

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations. We will retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. When personal data is no longer required, we securely dispose of, anonymize, or de-identify it.

Authorized representative(s)

At Qiddiya, we may collect and process Personal Data concerning your authorized representative(s) if you have designated another person to act on your behalf concerning our services or interactions with us. It is your responsibility to ensure that you have obtained the necessary consent from your representative(s) to provide us with their Personal Data.

Your rights and choices

You have certain rights regarding your personal data, including:

The right to be informed: You have the right to know and be informed about the processing of your Personal Data, including our contact details, the specific reasons for collecting your Personal Data, the methods used for Personal Data collection, and whether this collected Personal Data will be shared with third parties.
The right to access: You have the right to access your personal data held by us.
The right to obtain a copy: You have the right to obtain a copy of your personal data held by us.
The right to request rectification: You can request the correction or update of any incomplete, inaccurate, or outdated Personal Data that Qiddiya has collected.
The right to request erasure: You have the right to request the deletion of your Personal Data collected by Qiddiya, including any data shared with third parties. This can be due to various reasons, such as you are withdrawing your consent for data collection or the data no longer serving its initial purpose. However, please note that Qiddiya may retain such information in accordance with applicable laws and regulations.
The right to withdraw consent: You can withdraw your consent to processing where consent is the lawful basis as required by law. If you withdraw your consent for any data previously shared with third parties, we will cease further processing and notify our third-party partners where applicable, ensuring that they also stop processing your data unless legally required otherwise
The right to complain: You may make a complaint to us (using the contact details below) if you have concerns regarding how we process your Personal Data. You may also make a complaint to the Competent Authority, which for the Kingdom of Saudi Arabia is the Saudi Data and AI Authority (contactable via sdaia.gov.sa).

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. Your rights may also depend on the jurisdiction in which you reside.

Please note that this statement outlines your rights and choices concerning your Personal Data when interacting with Qiddiya:

Qiddiya is committed to ensuring that you are properly informed about your rights and has established dedicated channels for you to exercise them effectively. We aim to address all requests or complaints within 30 days and maintain records of all interactions. If you believe any of your Personal Data is inaccurate or incomplete wish to exercise any of these rights or have any privacy-related inquiries, please don't hesitate to contact us using the provided contact details below.

Consent withdrawal

Where we rely on your consent for processing personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To manage your consent preferences, please contact us using the details provided below.

Your responsibilities

While we take reasonable steps to protect your personal data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access to your personal data you may be aware of.

Minor’s privacy

If you are under the age of eighteen (18), you must obtain the consent of your parent or legal guardian before using our website or providing any personal data to us.

We do not knowingly collect personal data from minors without the consent of their parents or guardians. If you believe that we have inadvertently collected the personal data of a minor, please contact us immediately so that we can act appropriately to delete the relevant personal data.

If we seek your consent to process your personal data for a specific purpose in accordance with this Privacy Notice, such consent must be granted on your behalf by your parent or guardian. By using our website, you represent and warrant that you are of the required age in your jurisdiction or have obtained the necessary parental or guardian consent.

Use of CCTV and surveillance

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely, for security and safety purposes, where we may use closed-circuit television (CCTV) cameras and surveillance systems on our premises. The recorded footage may be used to monitor and investigate security incidents, prevent fraud, and ensure the safety of our employees, residents, visitors, suppliers.

Marketing communications

At Qiddiya, processing for this purpose is based on your consent. This may include using your Personal Data, including your email address, mobile number, and mailing address, to deliver advertising directly to you or on our websites as well as sending you marketing communications regarding our promotions, and events. You have the option to withdraw your consent or opt out of receiving marketing communications at any time by following the instructions provided in the communication or by reaching out to us using the contact details provided below. Our marketing communications may include both personalized and non-personalized materials, with personalized materials being tailored specifically based on the information we have about you.

Social media

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely, to engage with you on social media platforms to provide information, respond to inquiries, and promote our events. Please note that any information you post or disclose on our social media pages may be visible to the public, and you should exercise caution when sharing Personal Data or Sensitive Personal Data.

Monitoring and recording of calls and electronic communications

At Qiddiya, processing for this purpose is generally based on Qiddiya’s legitimate interests, namely, to ensure quality control, assurance, training, and compliance purposes, we may monitor and record telephone calls, including customer service calls and calls with our representatives as well as record electronic communications, such as emails and instant messages, exchanged between you and our representatives. We will notify you if a call is being recorded, and the recorded calls will be overseen in accordance with applicable data protection laws and regulations. These measures are taken to ensure the security of our systems, prevent fraud, and maintain regulatory compliance.

Cookies

A cookie is a small file that is placed on your computer’s hard drive. Its functions include storing your login and session statuses, recording your user preferences, and analyzing web traffic.

Apart from the data that you elect to disclose and share with us, we cannot access your computer or any other information about you with cookies. Although most browsers automatically accept cookies, you can amend your browser settings to disable cookies or interact with any cookies consent mechanism we provide. This may however prevent you from fully experiencing the website as it was intended.

For more information, please refer to our Cookies Policy.

Third-Party links

Our website may contain links to third-party websites or services that are not operated or controlled by us. This Privacy Notice does not apply to such third-party websites or services, and we are not responsible for their privacy practices, content or their use of your information. We encourage you to review the privacy policies of those third parties before providing any personal data to them.

Update to this Privacy Notice

Qiddiya reserves the right to modify or update this Privacy Notice as needed from time to time, including to reflect changes in our privacy practices and legal obligations or in accordance with applicable data protection laws and regulations. We will notify you of any significant changes by posting the updated Privacy Notice on our website or using other appropriate means. We encourage you to periodically review this Privacy Notice for any updates. The revised Privacy Notice will take effect as of the updated effective date stated at the beginning of the notice.

Governing law and jurisdication

This Privacy Notice shall be governed by and construed in accordance with the applicable laws of the Kingdom of Saudi Arabia. Any disputes arising out of or relating to this Privacy Notice shall be subject to the exclusive jurisdiction of the courts of Kingdom of Saudi Arabia.

Language

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Notice, the English language version will prevail.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact: DataOffice@qiddiya.com