سياسة الخصوصية

• Agency information - legal name, Arabic name, REGA license number, Commercial Registration, VAT number, address.
• User credentials - full name, email, phone, role (owner / manager / agent), hashed password, multi-factor authentication data.
• Request data - buyer, seller, and rental requests entered by Authorized Users, including contact details, budget, location preferences, and financing status.
• Property listings - addresses, photos, coordinates, Saudi National Address codes, title-deed numbers, and owner contact details.
• Document vault - uploaded files such as CR, REGA license, authorized-signatory ID, title deeds, and contracts.
• Usage logs - sign-in records, IP address, browser type, timestamps, and audit trail of actions taken on the Platform.
• Aggregate usage statistics - per agency, counts and totals only: number of listings, number of requests by type and stage, number of deals recorded and closed, number of active users, and storage consumed. Collected solely to operate, secure and improve the Platform. We do not collect the agency's client-level records, transaction values or commission earnings for this purpose, and Platform staff see these statistics in aggregate form only.
• Public contact form - when you write to us from the contact page on sarp-sa.net, we record the name, agency name, email, phone number and message you type, together with the IP address the submission came from, used only for rate limiting and abuse investigation and erased automatically after ninety (90) days (section 8). The form is protected by Cloudflare Turnstile, which checks that the sender is not a bot (section 6). The Provider is the Controller of this data.
• Property sharing with clients - an agency may send you a PDF brochure or a WhatsApp message describing a single listing. Both are generated in the agent's browser and reach you directly from the agent; neither passes through SARP's servers and SARP records nothing about you when you open them. SARP has no public agency or listing pages, no share links and no public request forms.
• WhatsApp support channel - if you message SARP's support number on WhatsApp, we record your phone number, profile name, messages and delivery status, in order to answer you and hand you to our team when you ask. This channel is for contacting SARP and is not connected to any agency's workspace.

• Performance of a contract - to deliver the Service the Customer has subscribed to and manage its users' accounts.
• Legal obligation - to comply with Saudi law, including REGA regulations, tax and accounting rules, Anti-Money Laundering rules, and orders from competent authorities.
• Legitimate interest - to secure the Platform, detect fraud and abuse, maintain audit logs, and improve the product, in a way that does not override Data Subject rights.
• Consent - for optional activities such as marketing emails, where consent can be withdrawn at any time without affecting the lawfulness of prior processing.

• Provision the Customer's tenant workspace and subdomain, and authenticate Authorized Users.
• Run the request pipeline, smart-matching engine, follow-up CRM, auctions module, and document vault.
• Send transactional notifications (password reset, approvals, assignment alerts, billing notices).
• Issue invoices and, where the Provider is VAT-registered, tax invoices under the e-invoicing regulations.
• Monitor Service health, investigate incidents, and block abuse.
• Respond to Data Subject requests, assist the Customer in responding to them, and comply with PDPL obligations.
• Improve the Platform, using only the aggregate statistics described in section 3.

• Google Cloud (Google LLC / Google Ireland Ltd) - Firebase Authentication, Cloud Firestore, Cloud Storage, Firebase App Hosting (Cloud Run), Secret Manager. Hosting and running the Platform; storing all Customer Data and user accounts. All Customer Data, including Client Personal Data, user credentials and uploaded documents. (Location: Data at rest (Cloud Firestore and Cloud Storage): region europe-west4 (the Netherlands). Application server (App Hosting): region europe-west4 (the Netherlands). Firebase Authentication account records (email, phone, password hash): Google's global authentication service, which is not pinned to a single region.)
• Cloudflare, Inc. - Turnstile. Bot protection on the public contact form (sarp-sa.net/contact) only. Not loaded on any authenticated page. IP address and browser signals of the visitor submitting the contact form. Nothing from inside any Customer workspace. (Location: Cloudflare global network)
• Meta Platforms, Inc. - WhatsApp Cloud API. Answering people who message SARP's own support number. Not connected to any Customer workspace. Phone number, profile name and messages of the person who contacts the support number. No Client Personal Data passes through it. (Location: Meta infrastructure (outside the Kingdom))
• Resend, Inc. - Transactional email. Sending account and billing email to Authorized Users: invitations, password resets, invoices, trial and payment notices, alerts. Recipient's name and email address and the content of the message. Sent only to the Customer's Authorized Users, never to the Customer's clients. (Location: United States)
• Unifonic - SMS. Subscription-lifecycle text messages to the office owner's phone (for example, trial ending). Owner's phone number and the message text. Never sent to the Customer's clients. (Location: Kingdom of Saudi Arabia)

We give the Customer not less than 30 days' written notice before adding or replacing a Sub-processor or changing the hosting region. Where necessary we also share data with:

• Banks - subscription fees are paid by bank transfer, so the Customer's own bank and ours process the transfer in the ordinary course. We do not use a payment processor and we never hold card details.
• Zakat, Tax and Customs Authority - where the Provider is VAT-registered, the invoice data the e-invoicing regulations require to be transmitted.
• Competent authorities - where disclosure is required by Saudi law or a valid order from a regulatory or judicial body.

• Encryption in transit (TLS) and at rest for databases and file storage.
• Per-tenant data isolation so one agency cannot see another agency's data.
• Role-based access control (owner / manager / agent / platform staff) with least-privilege defaults.
• Two-factor authentication: mandatory for platform staff, available to every agency user, and enforceable by the agency for all of its users.
• Immutable audit logs for create, update, delete, export and document-view actions.
• No persistent document links: a download link is generated on request after an authorisation check and expires within 15 minutes.
• Regular backups, service keys held in a managed secret store, and software components updated to close security weaknesses as they are disclosed.

• Data storage (Cloud Firestore and Cloud Storage): one named region, europe-west4 (the Netherlands), which is outside the Kingdom of Saudi Arabia. The Provider intends to migrate data storage to region me-central2 (Dammam, Kingdom of Saudi Arabia) inside the Kingdom.
• Application server (Firebase App Hosting): region europe-west4 (the Netherlands). This is where data is processed and pages are rendered; it stays in this region after the storage migration because the service is not offered in the Dammam region, and data travels between it and storage encrypted over Google's private network on every request.
• User accounts (Firebase Authentication): a global Google authentication service not pinned to a single region; it holds sign-in data (email, phone, password hash) and is unaffected by the storage migration.

We give the Customer not less than 30 days' written notice of any change of the data-storage region or the application-server region and update this Policy accordingly. The Customer is informed of the current hosting locations before subscribing.

• The right to be informed - to know the lawful basis and purpose of collecting your data, and that it will not be processed for another purpose. This Policy gives that notice where we are the Controller; the agency gives it for its own clients' data.
• The right to access your Personal Data - to see what we hold about you. Authorized Users: Settings → Privacy → Export data. Agency clients: contact the agency, or write to us and we forward your request to it within three business days.
• The right to request your Personal Data in a readable and clear format (portability) - a structured, machine-readable copy. Produced from Settings → Privacy → Export data; agency clients obtain it from the agency, which can export it with the same tool.
• The right to request correction, completion or updating of your data - an Authorized User edits account data from profile settings; the agency corrects its client records directly in the Platform; otherwise, write to us.
• The right to request destruction of your Personal Data (deletion) - where it is no longer needed for the purpose it was collected for and no statutory retention applies. Authorized Users: Settings → Privacy → Request deletion; agency clients: through the agency, which deletes the record in the Platform, or write to us and we forward the request.
• The right to withdraw consent - at any time, without affecting prior processing; from notification settings or by writing to us.
• Objection to processing and restriction - you may object to processing based on legitimate interest, ask that your data no longer be used for direct marketing, and ask that a disputed record be kept but not used until the dispute is resolved. Make the request by writing to us or through the agency.
• The right to lodge a complaint with the competent authority - you may complain to the Saudi Data & AI Authority (SDAIA) as described in section 12.

• Session cookie - keeps you signed in after authentication.
• Language cookie - remembers your Arabic/English preference.
• Security cookies - help detect session hijacking and cross-site forgery.

• Provider: Khalid Dhafer Saad Alqarni - Freelance Certificate No. FL-002881762
• Email: privacy@sarp-sa.net
• General: sales@sarp-sa.net
• Address: Riyadh, Kingdom of Saudi Arabia