سياسة الخصوصية

This Privacy Policy (the "Policy") explains how SARP (the "Provider") collects, uses, shares, and protects personal data processed through the SARP platform (the "Service"). It applies to the licensed Saudi real estate agency that subscribes to the Service (the "Customer"), to the Customer's Authorized Users, and to end-clients whose data the Customer uploads or manages on the Platform. The Policy is issued in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.

"Personal Data" means any data - regardless of source or form - that would lead to identifying an individual specifically, or that makes it possible to identify an individual directly or indirectly. "Controller" means the party that determines the purpose and means of processing Personal Data. For end-client data (buyer/seller leads, property owners), the Customer is the Controller. "Processor" means any party that processes Personal Data on behalf of a Controller. The Provider acts as Processor for the end-client data the Customer stores on the Platform. "Data Subject" means the individual to whom the Personal Data relates. "SDAIA" refers to the Saudi Data & AI Authority, the supervisory authority for PDPL in the Kingdom.

We collect the following categories of data:

• Agency information - legal name, Arabic name, REGA license number, Commercial Registration, VAT number, address.
• User credentials - full name, email, phone, role (owner / manager / agent), hashed password, multi-factor authentication data.
• Request data - buyer, seller, and rental requests entered by Authorized Users, including contact details, budget, location preferences, and financing status.
• Property listings - addresses, photos, coordinates, Saudi National Address codes, title-deed numbers, and owner contact details.
• Document vault - uploaded files such as CR, REGA license, authorized-signatory ID, title deeds, and contracts.
• Usage logs - sign-in records, IP address, browser type, timestamps, and audit trail of actions taken on the Platform.

We process Personal Data only where a lawful basis applies:

• Performance of a contract - to deliver the Service the Customer has subscribed to.
• Legal obligation - to comply with Saudi law, including REGA regulations, ZATCA e-invoicing, Anti-Money Laundering rules, and orders from competent authorities.
• Legitimate interest - to secure the Platform, detect fraud, maintain audit logs, and improve the product, in a way that does not override Data Subject rights.
• Consent - for optional activities such as marketing emails, where consent can be withdrawn at any time.

We use Personal Data to:

• Provision the Customer's tenant workspace and subdomain, and authenticate Authorized Users.
• Run the request pipeline, smart-matching engine, follow-up CRM, auctions module, and document vault.
• Send transactional notifications (password reset, approvals, assignment alerts, billing receipts).
• Issue tax invoices in line with ZATCA e-invoicing rules.
• Monitor Service health, investigate incidents, and block abuse.
• Respond to Data Subject requests and comply with PDPL obligations.
• Improve the Platform, using aggregated or anonymized data where possible.

We do not sell Personal Data. We share it only with:

• Infrastructure providers - cloud hosting, database, file storage, and email delivery - bound by written data-processing agreements with security and confidentiality obligations.
• Payment provider - Moyasar, a payment service provider licensed by the Saudi Central Bank (SAMA), which processes subscription payments.
• Tax authority - invoice metadata transmitted to ZATCA as required by the e-invoicing regulations.
• Competent authorities - where disclosure is required by Saudi law or a valid order from a regulatory or judicial body.

We do not use third-party advertising networks, behavioral-ad cookies, or external analytics vendors that track users across sites.

We apply industry-standard technical and organizational measures, including:

• Encryption in transit (TLS) and at rest for databases and file storage.
• Per-tenant data isolation so one agency cannot see another agency's data.
• Role-based access control (owner / manager / agent / platform staff) with least-privilege defaults.
• Multi-factor authentication for platform administrators and available for agency users.
• Immutable audit logs for create, update, and delete actions.
• Regular backups, key rotation, and vulnerability patching.

No system is perfectly secure; the Customer acknowledges that transmission over the internet carries inherent risk and agrees to notify the Provider promptly of any suspected breach.

We retain Personal Data for as long as the Customer's subscription is active. After termination or cancellation, the Customer may export Customer Data within thirty (30) days; thereafter, we delete or anonymize the data except where Saudi law requires a longer retention period - for example, ZATCA e-invoicing records and related tax data must be kept for six (6) years, and certain REGA-linked records may have their own statutory retention. Audit logs tied to regulated actions are kept for the period required by the applicable regulation.

The Platform currently runs on Google Cloud in the europe-west4 region (the Netherlands). We chose this region for operational maturity during the early phase of the product, and we are actively evaluating migration to a Saudi region (Riyadh or Dammam) as usage grows. We will notify the Customer in advance of any region change and, where applicable, update this Policy. The Customer acknowledges the current hosting region when subscribing. Data transfer outside the Kingdom is limited to what is necessary to operate the Service, is protected by the technical measures described above, and complies with the PDPL provisions on cross-border transfer and its Implementing Regulations.

The Saudi Personal Data Protection Law grants Data Subjects the following rights:

• Right to be informed - understand what we collect and why (this Policy).
• Right of access - obtain a copy of the Personal Data we hold about you.
• Right to rectification - correct inaccurate or incomplete data.
• Right to erasure - request deletion where the data is no longer needed and no legal retention applies.
• Right to data portability - receive your data in a structured, commonly used format.
• Right to object - object to processing based on legitimate interest.
• Right to withdraw consent - withdraw any consent previously given, without affecting prior lawful processing.

We aim to acknowledge every request within three (3) business days and resolve it within thirty (30) days. Where a request cannot be fulfilled (for example, because a tax invoice must be retained by ZATCA), we will explain the reason and identify the data held under legal hold.

For any question about this Policy, to exercise your PDPL rights, or to report a suspected data breach, contact our privacy team at privacy@sarp-sa.net. Please include enough detail for us to verify your identity and locate the data in question.

You have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA), the supervisory authority for PDPL compliance in the Kingdom. SDAIA's contact details and complaint channels are available at sdaia.gov.sa. We encourage you to contact us first so we can try to resolve the issue directly.

The Platform uses a small number of first-party cookies strictly necessary to operate the Service:

• Session cookie - keeps you signed in after authentication.
• Language cookie - remembers your Arabic/English preference.
• Security cookies - help detect session hijacking and cross-site forgery.

We do not set third-party advertising cookies, we do not use cross-site tracking pixels, and we do not integrate external analytics vendors such as Google Analytics or Meta Pixel on authenticated pages. Your browser can block or delete cookies; some core features (for example, staying signed in) will not work if you block session cookies.

The Platform is a business-to-business product for licensed real estate agencies and is not intended for individuals under eighteen (18) years of age. We do not knowingly collect Personal Data from minors. If you believe a minor has submitted Personal Data to us, please contact privacy@sarp-sa.net and we will delete it.

Because the Platform is currently hosted in europe-west4 (the Netherlands), Personal Data is transferred outside the Kingdom for the limited purpose of running the Service. Additional cross-border transfers may occur for email delivery (via our transactional email provider). All such transfers are conducted under written data-processing agreements that include security and confidentiality obligations, and in accordance with the cross-border transfer provisions of the PDPL and its Implementing Regulations. If you would like a list of the sub-processors involved, contact privacy@sarp-sa.net.

We may update this Policy from time to time to reflect changes in the Service, the law, or our practices. When we make material changes, we will notify the Customer by email at least thirty (30) days before the changes take effect. The latest version is always available on this page, with the "Last updated" date at the top. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

SARP - Privacy & Compliance

• Email: privacy@sarp-sa.net
• General: sales@sarp-sa.net
• Address: Riyadh, Kingdom of Saudi Arabia