Privacy Notice - Kingdom of Saudi Arabia (KSA) Residents

In addition to the Website’s Privacy Policy and Cookie Policy, this privacy notice (the Privacy Notice) provides information that is only applicable to the processing of personal data relating to data subjects who are residents in the Kingdom of Saudi Arabia (the KSA). In accordance with the KSA Personal Data Protection Law implemented by Royal Decree No. M/19 of 09/02/1443H (16 September 2021) and amended by Royal Decree No. M/147 of 05/09/1444H (27 March 2023) (PDPL), the Implementing Regulations of the PDPL ("Implementing Regulations"), along with the amendments to the Data Transfer Regulations issued on September 1, 2024 (Data Transfer Regulations).

In the event of any conflict or inconsistency between the main Website Privacy Policy and this Privacy Notice, the provisions of this Privacy Notice shall prevail to the extent of such conflict or inconsistency, with respect of KSA residents.

Capitalised terms shall have the same meaning given to them in the Privacy Policy unless explicitly stated otherwise in this Privacy Notice.

For the purposes of this Privacy Notice, "you" and "your" refers to a specific KSA resident. “Personal data” shall encompass the definition of "personal data" from the PDPL.

Who is responsible for your personal data?

The primary responsible controller for your personal data will be Ashurst Law Firm (LLPC).

You can contact us via various channels, using the below details:

Data Controller	Ashurst Law Firm (LLPC)
Address	Alesayi Building Madinah Road (South) Al Andalus District/1, PO Box 55339, Jeddah 21534]
Phone	+966 12 228 2700
Email	data.protection@ashurst.com
License or Commercial Register:	4030221661

We may collect the categories of personal data set out in the Privacy Policy To the extent that any of the personal data that we collect includes sensitive data, which is personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown, then we will only process this data with your consent.

How do we collect personal data?

We may collect personal data directly from you in the circumstances set out in the Privacy Policy.

We will only collect personal data indirectly from you in some circumstances, such as if you provide us with your consent in accordance with the provisions of the Law; personal data is publicly available or was collected from a publicly available source; complying with this may harm you or affect your vital interests; personal data Collection or processing is necessary to protect public health, public safety, or to protect the life or health of specific individuals; personal data is not to be recorded or stored in a form that makes it possible to directly or indirectly identify you; and personal data collection is necessary to achieve our legitimate interests, without prejudice to your rights and interests, and provided that no sensitive data is to be processed.

Are you required to provide personal data?

Please refer to our Privacy Policy, which stipulates that you will provide us with your personal data entirely voluntarily and clarifies the effects if you choose not to consent or to provide personal data.

For which purposes we will use your personal data?

We may use your personal data only for the purposes set out in our Privacy Policy.

On what bases do we use your personal data

We use your personal data on the following bases:

• Based on your consent, where you have expressly given to us. In particular, we will process your personal data based on your explicit consent when we process your sensitive data for any Permitted Purpose, or any of your personal data for marketing or promotional purposes;
• Because processing is necessary for the performance of our obligations under a contract executed with you or your organisation;
• To comply with our legal obligations (such as record keeping obligations); or
• Because processing is necessary for purposes of our legitimate interest or those of any third party recipients that receive your personal data, provided that collection is necessary to achieve our legitimate interests, without prejudice to your rights and interests and provided that no sensitive data is to be processed.

We will not process your personal data in a manner that is inconsistent with the Permitted Purposes or the basis on which we have relied to collect your personal data.

Direct Marketing

Where you have expressly given us your consent, we may process your personal data for marketing purposes in accordance with our Privacy Policy. We will not, under any circumstances, process sensitive data for marketing purposes.

We will provide you the opportunity to opt out anytime if you do not want to receive further marketing-related communication from us. We will not use your personal data for taking any automated decisions affecting you or creating profiles other than described in our Privacy Policy.

With whom do we share your personal data?

We may share your personal data in the circumstances set out in the Privacy Policy.

In addition to the parties set out in the Ashurst Privacy Policy, we may share your personal data with:

• other members of the Ashurst Group; and
• competent authorities in the KSA.

We do not sell your personal data. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Personal data about other people you provide to us

Please ensure that you review, understand and comply with the section about personal data about other people you provide to us in our Privacy Policy.

Keeping personal data about you secure

In addition to the measures set out in our Privacy Policy, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Third parties will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are required to do so.

Transferring your personal data outside of the KSA

We may transfer your personal data abroad if required for the Permitted Purposes as set out in our Privacy Policy. The information you submit may be transferred, stored and hosted outside of the KSA, in which case we will implement appropriate measures to ensure that transfers of your personal data are done in a manner that is compliant with the PDPL, its Implementing Regulations, and the Data Transfer Regulations, your personal data remains protected and secure when it is transferred outside your home country and you can exercise your rights effectively.

If you would like further details of how your personal data is protected when transferred from one country to another, then please email data.protection@ashurst.com.

For how long do we retain your personal data?

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve such purposes through other means, and the applicable legal requirements.

Your rights

Subject to certain legal conditions, your rights as a data subject include the following in the KSA:

• The right to request access to your personal data if it is available to Ashurst;
• The right to request the deletion of your personal data where it is no longer necessary for the purpose(s) for which it was originally collected, unless Ashurst is required to retain the personal data for a particular period of time to comply with a legal obligation or if the personal data relates to a case under consideration by a judicial authority (in which case the personal data will be deleted after the period of time has lapsed or the judicial procedure is concluded);
• The right to request that Ashurst amends or updates your personal data where it is inaccurate or incomplete, subject to any supporting documents or evidence which may be required to verify such request;
• The right to be informed about how and why Ashurst processes your personal data;
• The right to request a copy of your personal data in a format that is readable and clear;
• The right to withdraw consent at any time (where Ashurst asked for your consent to use your information for that particular purpose); and
• Any other rights granted by applicable laws.

To exercise your rights, including the right to withdraw consent granted to us, please email data.protection@ashurst.com. We may ask you to provide proof of your identity upon receipt of your request. We will notify you in writing if we refuse a request or cannot address it.

Your right to complain

If you are not satisfied with our use of your personal data in respect of this Website or our response to any request by you to exercise your rights, or if you think that we have breached any relevant data protection laws, then please email data.protection@ashurst.com.

You may in addition have the right to complain to the Saudi Data & Artificial Intelligence Authority or any other competent authority in the KSA that is designated with the power to receive such complaints from time to time. For more information, please visit SDAIA’s websites:

• Saudi Data & AI Authority (sdaia.gov.sa)
• National Data Governance Platform “DGP” (dgp.sdaia.gov.sa)

Notification of changes

We may be required to update or change our Privacy Notice from time to time. In such case, we will upload an updated Privacy Notice on the Website and it will be effective from the time of posting.

Our use of cookies and other information-gathering technologies