شروط الخدمة

• it is a real estate office duly licensed by REGA under a valid brokerage licence; every FAL licence it attributes to itself or to any of its Authorized Users is genuine and current; and all information provided during onboarding, including REGA licence number, Commercial Registration and VAT number, is accurate and current;
• as Controller it has a valid lawful basis under the PDPL and the Regulations for every item of Client Personal Data it records on the Platform, has given the Data Subjects the notice the PDPL requires, and has obtained their consent wherever consent is the basis relied on;
• it will not upload to or enter into the Platform any data it has no right to process, including copies of identity documents, title deeds or powers of attorney of persons with whom it has no contractual relationship or lawful engagement; and
• it will promptly notify the Provider of any change in its regulatory status, such as cancellation or suspension of its licence, that affects its entitlement to use the Service.

• Use the Platform only for lawful purposes consistent with Saudi laws and REGA regulations.
• Maintain the confidentiality of user credentials and notify the Provider of any unauthorized access.
• Ensure that Authorized Users are trained on data protection and acceptable use.
• Not attempt to reverse engineer, decompile, or extract source code from the Platform.
• Not use the Platform to transmit malware, viruses, or harmful content.
• Not resell, sublicense, or offer the Platform as a service to any third party.
• Process Client Personal Data only on a lawful basis under the PDPL and the Regulations, and set its Authorized Users' permissions no wider than the work requires.

8.1 Roles and instructions. The Customer is the Controller of Client Personal Data: it decides why and how that data is processed. The Provider is a Processor and processes Client Personal Data solely on the Customer's documented instructions, which are this Agreement and the configuration and actions the Customer and its Authorized Users perform within the Platform (creating records, uploading documents, setting permissions, exporting and deleting). If the Provider considers that an instruction contravenes the PDPL or the Regulations, it shall inform the Customer without delay and refrain from carrying it out until it is corrected.

8.2 Purpose limitation. The Provider shall not use Client Personal Data for any purpose of its own. It shall not sell or rent it, profile the Data Subjects, use it for marketing, use it to train any model or product, or combine it with another Customer's data. What the Provider's staff see is confined to the aggregate statistics described in Clause 7.

8.3 Confidentiality. The Provider shall make Customer Data accessible only to persons whose duties require it and who are bound in writing to keep it confidential, on a least-privilege basis. The Provider's staff open an individual record of the Customer only to handle a support request the Customer has raised or to handle a security incident, and every such access is recorded in the audit log with the identity of the person and the time.

8.4 Security measures. The Provider shall implement and maintain at least the following technical and organisational measures:

• Encryption in transit (TLS) and at rest for databases and uploaded files.
• Role-based access control (owner, manager, agent, platform staff) with least-privilege defaults.
• Per-office isolation: each office's data sits in its own workspace and no office can reach another's data.
• An audit log of create, update, delete, export and document-view actions that users cannot alter.
• No persistent document links: a download link for a document is generated only on request, after the requester's authorisation has been checked, and expires within 15 minutes.
• Two-factor authentication (2FA): mandatory for platform staff, available to every Authorized User, and enforceable by the Customer for all of its users.
• Regular backups, service keys held in a managed secret store, and software components updated to close security weaknesses as they are disclosed.

8.5 Sub-processors and hosting region. The Customer authorises the Provider to engage the Sub-processors listed below, and no others. Customer Data is stored with Google Cloud in one named region, europe-west4 (the Netherlands), and the application server that processes it and renders pages runs in region europe-west4 (the Netherlands). The Provider intends to migrate data storage to region me-central2 (Dammam, Kingdom of Saudi Arabia) inside the Kingdom; after that migration the application server remains in its current region, because that service is not offered in the Dammam region, and data travels between the two encrypted over Google's private network on every request. The Provider shall give the Customer not less than 30 days' written notice of any change of hosting region and of the addition or replacement of any Sub-processor. The Customer may object in writing within the notice period; if the ground of objection cannot be resolved, the Customer may terminate this Agreement without penalty, with a refund of fees for the unused period, and export its data under Clause 8.9. The Provider shall bind each Sub-processor in writing to data-protection obligations no less protective than those in this Clause and remains liable to the Customer for its Sub-processors' performance.

8.6 Transfer outside the Kingdom. For as long as the current storage region is outside the Kingdom, Customer Data, including Client Personal Data, is stored and processed outside the Kingdom of Saudi Arabia. Once the migration of storage to a region inside the Kingdom is complete, the data remains stored inside the Kingdom but is processed on every request by the application server outside it and is transmitted to that server encrypted; user account records likewise remain in Google's global authentication service. The Provider relies for this transfer on the appropriate safeguards provided for in the Regulation on Personal Data Transfer Outside the Kingdom, namely: the contractual data-protection commitments that bind Google Cloud under its Data Processing Addendum, the technical measures in Clause 8.4, and limiting the transfer to what is necessary to run the Service. The Provider does not claim, and does not warrant, that the competent authority has issued a decision recognising the hosting country as providing an adequate level of protection. The Customer, as Controller, acknowledges that it was informed of this position before subscribing and that it is responsible for meeting any additional condition the PDPL or the Regulations impose on a Controller in respect of this transfer. The Customer shall be notified when the migration of storage into the Kingdom is complete, and this Clause shall be updated accordingly.

8.7 Breach notification. The Provider shall notify the Customer in writing within 72 hours of becoming aware of any breach, destruction or unauthorised access affecting Customer Data. The notice shall state, so far as then known and supplemented as it becomes known: the nature of the incident, when it occurred and when it was discovered; the categories of data and of Data Subjects affected and their approximate number; the likely consequences for them; the measures taken or proposed to contain the incident and mitigate its effects; and a contact at the Provider. The Provider shall cooperate with the Customer so that the Customer, as Controller, can notify SDAIA and the Data Subjects within the periods the law prescribes.

8.8 Assistance with Data Subject requests. If a request from a Data Subject concerning data held by the Customer reaches the Provider directly, the Provider shall forward it to the Customer within three (3) business days and shall not decide it itself. The Provider enables the Customer to answer requests for access, correction, destruction and a copy of the data through the Platform's own tools; where a request cannot be met with those tools, the Provider shall give the necessary assistance on written request within ten (10) business days.

8.9 Export, return and deletion. At any time during the term the Customer may export a complete copy of its data in a structured, machine-readable format through the Platform (Settings → Privacy → Export data). On expiry or termination of this Agreement for any reason, the Provider shall keep export available and shall then delete all Customer Data from its operational systems within 30 days of the termination date; backup copies are overwritten in their ordinary rotation and are restored only to recover the Platform as a whole. On request, the Provider shall give the Customer a written certificate confirming that deletion is complete. Excluded from deletion is what Saudi law requires the Provider to retain of its own records, such as its accounting records and the invoices it issued to the Customer; these do not contain Client Personal Data.

8.10 Demonstration of compliance. On written request made not more than once in any year, the Provider shall give the Customer what is reasonably needed to demonstrate compliance with this Clause, including a description of the security measures in force, the current list of Sub-processors, and the audit-log entries relating to the Customer. On request the Customer may obtain a standalone copy of these terms in the form of a signable Data Processing Agreement identical in substance to this Clause; once signed, that agreement prevails over this Clause where the two conflict.

9.1 Subscription fees are payable in advance in Saudi Riyals (SAR). …

9.2 The Customer may elect a prepayment term of one (1), three (3), six (6) or twelve (12) months. Terms of three months or longer attract a discount on the list price of 5%, 10% and 17% respectively; a term of one month attracts no discount. Twelve months is the maximum term. The elected term is fixed for its duration and the corresponding discount is applied to the invoice raised for that term.

9.3 Fees are payable by bank transfer to the account stated on the invoice, quoting the invoice number. Payment is recognised only upon the Provider confirming receipt of cleared funds against its bank statement; the submission of a transfer receipt by the Customer constitutes notice of payment and not payment itself. The Provider shall review a submitted receipt without undue delay.

9.4 …

9.5 Service is provided for the period covered by fees actually received. Where fees are not received by the due date stated on the invoice, the Provider may, after written notice, suspend the Service; and where the amount remains unpaid thirty (30) days after suspension, the Provider may terminate this Agreement. Suspension does not extend the paid period, and access is restored upon confirmation of the outstanding amount. Clause 15 (Term & Termination) applies to termination for non-payment as it applies to any other termination.

14.1 The aggregate liability of the Provider to the Customer for everything arising out of or in connection with this Agreement, however caused, whether in contract, tort or otherwise, shall not exceed the total subscription fees actually paid by the Customer to the Provider in the twelve (12) months immediately preceding the event giving rise to the claim. This limit applies to all claims in the aggregate and not to each claim separately.

14.2 The Provider shall in no event be liable for any indirect or consequential loss, for loss of profit, revenue or opportunity, for business interruption or downtime, for damage to commercial reputation, or for loss resulting from temporary unavailability of the Service, even if advised of the possibility of such loss.

14.3 Clauses 14.1 and 14.2 do not apply to liability that the laws of the Kingdom of Saudi Arabia do not permit to be excluded or limited, including liability arising from fraud, misrepresentation, wilful misconduct or gross negligence, or for personal injury, or any liability the competent court holds cannot be excluded.

14.4 The Customer's indemnity in Clause 3 for breach of its warranties, and its obligation to pay the fees due, are not subject to the limit in Clause 14.1.

• Provider: Khalid Dhafer Saad Alqarni - Freelance Certificate No. FL-002881762
• Trading as: SARP
• Address: Riyadh, Kingdom of Saudi Arabia