Overview

This privacy notice (“Privacy Notice”) describes how Aljazira Capital (“AJC’’, “We”, “Us” or “Our”) may collect, use, store, share, or process your personal data. It is important to us that you are aware of our personal data, security practices and policies while using our products, services and online services. We are dedicated to transparent and responsible data handling practices that comply with the Personal Data Protection Law in the Kingdom of Saudi Arabia. We also describe the measures we take to protect your personal data and how you can contact us about our privacy practices.

Abbreviations

Definitions

The terms in this Privacy Notice shall have the following definition unless the context indicates otherwise:

· Personal Data - Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank account, CMI investment account and credit card numbers, photos and videos of an individual, and any other data of personal nature.

· Processing - Any operation carried out on Personal Data by any means, whether manual or automated, including collecting, recording, saving, indexing, organizing, formatting, storing, modifying, updating, consolidating, retrieving, using, disclosing, transmitting, publishing, sharing, linking, blocking, erasing and destroying data.

· Sensitive Data - Personal Data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown.

· Controller: Any Public Entity, natural person or private legal person that specifies the purpose and manner of Processing Personal Data, whether the data is processed by that Controller or by the Processor

· Processor: Any Public Entity, natural person or private legal person that processes Personal Data for the benefit and on behalf of the Controller.

If you have any questions or concerns about our Processing of your Personal Data, then please contact us at contactus@aljaziracapital.com.sa.

Purpose

This Privacy Notice aims to provide you with information about how we may collect and process your personal data. It is important that you read this Privacy Notice together with any other privacy notice or fair processing notices that we may issue so that you are fully aware of how and why we are using your personal data.

Controller and Processor

"AJC" is the subsidiary of Bank Aljazira and is headquartered on King Fahad Road,

P.O. Box 20438 Riyadh 11455, Kingdom of Saudi Arabia. It is a regulated company under the Capital Market Authority (CMA). AJC determines the “how” and “why” your personal data is collected and processed. Therefore, AJC acts as the data controller of your personal data under the PDPL Law. In some cases, we will act as the data processor when processing your information on behalf of another Data Controller.

Personal Data

Personal data means any data by which you may be identified as an individual. It does not include data where the personal identifiers have been removed, and the person is not or no longer identifiable (anonymized data).

Your personal data will be collected or obtained by us whether we deal with you as an individual or as a representative of another individual, business, charity, trust, or other organization. We process different types of personal data (as further described below). We will collect, use, store, and transfer different kinds of personal data about you, which may include:

· Personal identifiers: includes information used to identify a specific individual, such as name, date of birth, place of birth, nationality, national ID, country of residence, passport number and place of issue, visa details, tax identification details, passport details, photo;

· Contact information: includes information related to postal address, telephone number, email address, mobile number, and emergency contact details;

· Family information: includes information related to marital status, and children details;

· Professional information: includes information related to employer; employee ID, business interests, and career history;

· Website technical data: includes information related to your IP address, website login data, browser type and version, time zone setting and location, browser plug- in types and versions, operating system and platform, and other technology on the devices you use to access our website;

· Website profile and usage data: includes information related to the interests, preferences, feedback, and survey responses, and information about how you use our website;

· Transaction details while using our online trading platform : includes information related to location, IP address and device used; and/or

· Sensitive data: includes personal data relating to criminal convictions and offenses, biometric or health data.

In certain circumstances, we will also collect, use, store and transfer sensitive data about you. Note that we will only process sensitive data to the extent permitted under the PDPL Law.

Where we rely on consent as the legal basis, we will provide you with full details of the data that we intend to process and why. So, you can carefully consider whether or not you want to consent to the processing of your personal data. Where we require your explicit consent to use and/or share your personal data, you have the right to withdraw your consent. If you do withdraw your consent, we may not be able to provide you with the products or services for which we need to use your personal data.

Please note that if certain information is not shared with us, that may limit what we are able to do for you and in some cases, you may be unable to access our website or receive our offers.

Personal Data Collection

We may collect your personal data directly from you in a number of ways, including:

·   When you apply for any product/service on our website (www.aljaziracapital.com.sa) or digital application, through the website, mobile application, telephone or directly with one of our employees;

·     When you provide it online or by any other method of communication; and

· Technical information, including the IP address and device ID used to connect to the internet, may be collected from you when you visit our website or our mobile applications.

We may obtain your personal data indirectly from third parties in the following ways, but not limited to:

· Following an introduction to us by another third party, such as credit bureaus, accountancy firms, law firms, or management consultancies;

· When a partner or third party shares your information with us to obtain a service from us:

o on your behalf; or

o that is to be held jointly with you; or

o   on behalf of a business, charity, trust or other organization of which you are a director, shareholder, owner, trustee or beneficiary (as applicable); or

o where they have nominated you as a guarantor under our agreement with them, or to provide any other security, or informed us that you are a donor or lender of any deposit monies or occupier of any security property;

· when we carry out searches for the purposes of processing your application and/or during the course of your relationship with us; or

·  in response to our marketing activities, you request information about our products via a third party channel e.g. website or platforms.

If you are applying to us through a third party, the third party should have provided you with its own privacy notice explaining how it may process your personal data.

Purposes for Which We Will Use Your Personal Data

We have set out below, in a table format, a description of the ways we use your personal data. AJC will use the appropriate legal basis to process your personal data. Collecting and processing your personal data is required (mandatory) in order for us to provide you with our services. You should be aware that you have various data subject rights that you can exercise. We have developed a record of processing activity register that maps all our processing activities to an appropriate lawful basis.

We will only use your Personal Data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you, and we will explain the legal basis that allows us to do so. If you wish to get an explanation as to how the Processing for the new purpose is compatible with the original purpose, please contact us using the contact details provided.

Legal Basis for Processing Your Personal Data

AJC operates in the Kingdom of Saudi Arabia and we will only process your personal data in line with the lawful basis outlined in the PDPL law. AJC shall process your personal data based on one of the following conditions:

·         Processing is based on consent;

· Processing achieves your definite interest and it is impossible or difficult for us to contact you;

·    Processing is in accordance with another law or in implementation of an agreement to which the personal data owner is a party;

·    If the controlling entity is a public entity and such processing is required for security purposes or to meet judicial requirements; or

·     Processing is necessary to achieve a lawful interest of AJC, without prejudice to your rights and interests.

Disclosure of Personal Data

We may have to share your personal data with our partners and third parties such as credit bureaus, accountancy firms, law firms, or management consultancies. We have set out the purposes for sharing your personal data below:

· If a change happens to our business (merger, sell, transfer or others) then the new owners may use your personal data in the same way as set out in this Privacy Notice.

·  In some instances, we may be required by law, regulation or instruction to provide your personal data to government-authorized agencies. To do this, we will supply your personal data to such agencies who may carry out, amongst other things, checks on you which may lead to possible limitations of accessing future Financial Products and/or Services from AJC based on the consumer records provided to these agencies.

We require all third parties to respect the security of your personal data and to treat it in accordance with the PDPL Law. We will also obtain your consent where applicable and ensure contractual terms on sharing personal data with the third party are established. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Personal Data for Marketing

You may receive marketing communications from us about our products and services. You may request to stop receiving marketing messages at any time by following the links on any marketing message to withdraw your consent. Where you withdraw your consent to receiving marketing messages, this will not apply to personal data provided to us for other purposes.

Sharing of your Personal Data

Your personal data may be shared with third parties to fulfil the purposes described in this Privacy Notice. In some circumstances where the PDPL Law permits, your data will be transferred to other entities or Bank Aljazira Subsidiaries within the same jurisdiction or within a different jurisdiction. Such transfers will be performed in compliance with the relevant data privacy laws across the jurisdiction. When we transfer your personal data, we will take the necessary steps to apply appropriate safeguards to ensure your personal data is protected in line with the PDPL Law. To the extent required, we may also transfer your personal data to third parties in connection with reorganization, restructuring, merger, acquisition, or transfer of assets provided they agree to treat your personal data in a manner consistent with the applicable law and requirements.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know and use it. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach. Our procedure will notify you and any applicable regulator of a breach where we are legally required to do so based on the requirements outlined in the PDPL Law.

Data Retention and Storage

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, reporting or data privacy law requirements. We will arrange safe and secure storage of your personal data in our servers, systems and applications.

Social Media

AJC operates channels, pages and accounts on some social media sites to inform, assist and engage with customers. AJC monitors and records comments and posts made on these channels in order to improve its products and services. Please note that you must not communicate to AJC through such social media sites the following information:

• Confidential personal data, including any information regarding your financial situation, investment account details, login credentials, passwords and transactions, etc.
• sensitive data.
• excessive, inappropriate, offensive or insulting information towards individuals.

AJC is not responsible for any information posted on those sites other than the information posted by its employees on its behalf.

Cookies

We use 'cookies' to monitor how people use our site. A cookie is a piece of information (IP address, details of device used and operating system etc.) that is stored on your computer's hard drive and it records how you have used a website. This helps us to understand how our customers use our website so we can develop and improve the site.

Your Rights

This Privacy Notice provides information about your rights. Under certain circumstances and in accordance with the PDPL Law, you may exercise the following rights:

· Right to be informed: you are entitled to be informed of the valid legal or practical justification for collecting your personal data, and the purpose thereof, and that your personal data should not be processed later in a manner inconsistent with the purpose for which it was collected.

· Right of access: you are entitled to have access to your personal data that is available to us, which includes accessing it.

· Right to request access: you are entitled to obtain a copy of personal data in a commonly used electronic format and the you may request a printed hard copy that is clear and identical to the content of the records and free of charge.

· Right to request correction: you are entitled to request correction, completion, or updating of your Personal Data, which is available to us.

· Right to request destruction: you are entitled to request the erasure (destruction) of your Personal Data available to us, which is no longer required by us (subject to compliance with the requirements of the Law).

· Right to withdraw consent: you are entitled to request the consent withdrawal.

· Right to Complaint: On becoming aware of any privacy incident, then you may also complain to the competent authority within a period of 90 days from the date of such incident, providing the following information:

o     Place and time of the violation;

o     Name, identification, address, and telephone number of the complainant;

o     Information about the complained entity; and

o     Clear and specific description of the violation.

·         You can claim compensation for material or moral damage if you are harmed as a result of any violation stipulated in the Law and its Implementing Regulations.

If you have any concerns or complaints about how we process your personal data, you may inform us of any issues you have, and we will endeavor to resolve these for you. Please note that not all of these rights are absolute, if you wish to exercise any of the rights set out above, please contact the AJC at contactus@aljaziracapital.com.sa.

Review and Updates

This Privacy Notice is updated from time to time. New and updated Privacy Notices can be found at the bottom of our website’s home page. It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if any of the information we hold on you changes during your relationship with us.