Scope

This Privacy Notice (the “Notice”) governs your use of Sanad Cash spend management system, which provides services accessible at www.sanadcash.com (the “System”). The System is operated by Sanad Cash for Financial Technology Company, a corporation established under the laws of the Kingdom of Saudi Arabia, with its registered office in Riyadh, Saudi Arabia, under Commercial Registration number 1010725921 and unified number 7023868784 (hereafter referred to as “Sanad Cash”, “we”, “us”, or “our”). This Privacy Notice is an essential component of the System's terms and conditions.

This policy governs the collection, processing, and storage of personal information by Sanad Cash for Financial Technology Company, covering both online and offline interactions.

By using our services, you consent to the collection and use of your personal information as outlined in this policy.

The Information We Collect

• Personal Information: Information provided directly by you during registration, through your use of our services, or via communication with us, including:
  • Name, Phone number, Email address, Date of birth, Gender
  • Credit/Debit card information
  • National address information
  • National ID/Iqama information
  • Passport information
• Portal and App Login Information: Account login details, including credentials and passwords.
• Correspondence: Information you provide by filling out forms or communicating with us.
• Marketing: Details of marketing preferences you provide.
• Device Data: Information about the device you use to access our services, such as IP address, device ID, type, operating system, and browser type.
• Location Data: Approximate geolocation derived from your IP address or device Location Services.
• Transaction Data: Information related to card transactions, bill payments, reimbursements, and account activities.
• Service Log and Usage Data: Insights into how you interact with our services, including diagnostic and performance information.
• Cookies and Tracking Technologies: Used to collect and store information about your interactions with our website. You can manage cookie preferences through browser settings.

Legal Basis for Processing Personal Data

We process personal data in accordance with lawful grounds outlined by the PDPL, including:

• Consent: Explicit consent from you before processing.
• Contractual Requirement: Necessary for fulfilling a contract.
• Legal Obligation: Compliance with applicable legal obligations.
• Legitimate Interests: Based on business interests, provided fundamental rights are not overridden.

Purposes for Processing Your Information

• Providing, operating, and maintaining our services and system functionality.
• Managing account access and assisting with customer support.
• Communicating updates and handling orders, payments, and returns.
• Verifying identity, preventing fraud, and ensuring compliance with regulations.
• Analyzing usage trends and optimizing performance.
• Using automated decision-making for fraud detection or risk analysis.
• Generating anonymized or aggregated data for insights.

Personal Data Storage and Security

• Data is securely stored on servers located in Saudi Arabia with strict security measures.
• We follow industry standards such as CIS Benchmarks™ and PCI DSS for data protection.
• Data is retained as long as necessary and deleted or anonymized when no longer required.
• Despite robust measures, the internet is not entirely secure. We adhere to Saudi data protection regulations.

Rights of Data Subjects

Under the Personal Data Protection Law (PDPL), you have rights such as:

• Accessing and obtaining a copy of your data.
• Requesting correction or deletion of your data.
• Restricting the processing of your data.
• Requesting the destruction of unnecessary data.
• Withdrawing consent for data processing.

To exercise these rights, contact us via the methods provided below. We will respond within 30 days.

Sharing Your Personal Data

We may share your data with third parties, including:

• Service Providers: For IT, card management, and consultancy services.
• Regulatory Authorities: To comply with legal obligations.
• Business Partners: For fraud prevention and payment processing.
• Corporate Transactions: During mergers or asset transfers.
• Cross-Border Transfers: Data may be processed outside Saudi Arabia with safeguards.

Changes to this Privacy Policy

We may update this Privacy Policy periodically. Material changes will be communicated via the app, website, or direct notifications. Continued use of our services implies acknowledgment of changes.

Contact Information

If you have inquiries or wish to exercise your rights under the PDPL, contact us at dp@sanadcash.com.