PRIVACY NOTICE

1. Who we are

Company Name: Bidaya Finance Company

Registered Address: 7906 King Fahad Road, Olaya, Ibdaa Tower 20th Floor, 12313 Riyadh.

We provide details on how to contact us in the ‘contact us’ section of this privacy Policy.

2. Purpose of Notice

This notice aims to inform data subjects, such as clients associated with Bidaya Finance Company, about how Bidaya Finance Company deals with the personal data that they collect, process, and maintain. All individuals associated with Bidaya Finance Company, whether employees, clients, or beneficiaries, should regularly review this privacy notice to get any updates.

3. Personal Data Collection

Bidaya Finance Company collects only personal data necessary to provide its services. This personal data includes, for example, personal information (e.g., name, ID, age, gender, etc.), contact information (phone, email, and address), financial data (like credit data and transactions), calls (when you have a call with our call center), videos (only collected via our CCTVs that monitor our premises), health data, educational and employment data, and cookies. These personal data can be collected internally (e.g., from website registration forms) or external parties such as Saudi Credit Bureau (SIMAH) or IAM service.

4. Methods of Collecting Personal Data

Personal data is collected in many ways, such as:

Services: When registering with Bidaya Finance Company for a service.
Employment: When a potential employee submits his/her CV to Bidaya Finance Company for the screening process.
Visit: When an individual joins or enters Bidaya Finance Company as a visitor or trainer for a specific period.
Communication: When communicating with Bidaya Finance Company via Digital Channels or social media accounts.
Opinion polls: Personal data may be collected when publishing opinion polls.
Cookies: Collect information while browsing the Bidaya Finance Company website. However, Bidaya Finance Company website collects only the data required to improve our website experience.
From a third party: Personal data may be obtained from a 3rd party and shared according to local regulations and legislation.

5. Reasons for Collecting Personal Data

We will only collect and use your Personal Data in accordance with the requirements under the KSA PDPL. In most cases, our legal justification will be:

Customer consent for processing their personal data
Fulfilling and provisioning any of the contracted services between Bidaya Finance Company and its Customers
Processing is required by applicable Laws and is performed in accordance with them.
Processing is necessary for the purpose of our legitimate interest.

6. Principles of Personal Data Protection

Bidaya Finance Company protects the personal data based on ten principles, which are:

Responsibility: Bidaya Finance Company determines the requirements for privacy protection, documents them, reviews them annually, approves them, and publishes them to all personal data subjects.
Transparency: A privacy protection notice shall be drawn up including a specific, clear, and explicit identification of the purposes for which personal data are processed.
Choice and consent: All possible choices of the personal data subject are determined, and their implicit or explicit consent is obtained regarding the collection, use, or disclosure of their data.
Limit data collection: Limit the collection of personal data to the minimum amount of data that fulfills the business requirements and purposes identified in this Privacy Notice.
Access to data: The processing of personal data shall be restricted to the purposes specified in the Privacy Notice for which the data subject has provided implicit or explicit consent and shall be retained as long as this is necessary to achieve the specified purposes or as required by the laws, regulations, and policies in force in the Kingdom, and shall be destroyed in a safe manner that prevents leakage or loss, embezzlement, misuse, or unauthorized access to the system.
Limit use: How the data subject can access his or her personal data to review, update, and correct it must be determined and provided.
Limit data disclosure: Restrict the disclosure of personal data to third parties for the purposes specified in the Privacy Notice for which the data subject has provided implicit or explicit consent.
Data security: Protecting personal data from leakage, damage, loss, embezzlement, misuse, modification, or unauthorized access - according to what is issued by the National Cybersecurity Authority and other competent authorities.
Data quality: The quality of personal data is ensured by keeping it accurate, complete, and directly relevant to the purposes identified in this Privacy Notice.
Monitoring and compliance: Compliance with Bidaya Finance Company’s personal data protection policy is monitored, and privacy-related inquiries, complaints, and disputes are handled.

7. Your Rights About Your Personal Data

According to the Personal Data Protection Policy at Bidaya Finance Company, personal data will only be collected, processed, and stored by the following rights:

The right to be informed. This includes notifying relevant party of the legal basis or actual need for requesting personal data and its purpose and that such data will not be subsequently processed in a manner inconsistent with the purpose for which it was collected, and his implicit or explicit consent was given.
The right to withdraw his consent to processing his personal data, at any time, unless legitimate purposes require the opposite.
The right to access, review, and request correction or updating of your personal data.

8. Protection of Personal Data

Bidaya Finance Company uses appropriate cybersecurity controls to protect your personal data throughout its lifecycle. All applied cybersecurity controls secure and protect personal data in a manner commensurate with its nature, sensitivity, and the media used to transfer and store it, and in accordance with the data classification policy and cybersecurity policies approved by Bidaya Finance Company.

9. How do we share and transfer your personal data

Personal data is shared securely and according to the applicable laws and policies only with Saudi-authorized authorities, such as SAMA and SIMAH. We never illegally transfer your personal data to other parties and won’t share, transfer, or store any personal data with any third party outside KSA.

10. Bidaya Finance Company Consent Management

This outlines Bidaya Finance Company 's approach to obtaining, managing, and recording consent from individuals for the processing of their personal data, following the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (KSA). Key Principles:

Transparency: Bidaya Finance Company will be clear and transparent about how personal data is collected, used, and shared.
Freely Given: Consent must be freely given without pressure or undue influence.
Informed: Individuals must be informed about the specific purposes for which their data will be used before they consent.
Specific: Consent should be specific to the intended purpose of data processing.
Granular: Bidaya Finance Company will offer granular consent options, allowing individuals to choose which types of data processing they consent to.
Revocable: Individuals have the right to withdraw their consent at any time.

11. Consent Collection Methods

Bidaya Finance Company will use clear and concise language when obtaining consent. Here are some methods:

Tick-boxes on online forms: Individuals can choose whether to consent by ticking a box.
Pre-populated opt-in options: Forms may come with opt-in options pre-selected, but users can opt-out if they disagree.
Clear opt-in/opt-out mechanisms: Bidaya Finance Company will provide clear options for individuals to opt-in or opt-out of data processing.

12. Consent Register

Bidaya Finance Company will maintain a comprehensive consent register to track individual consent for various data processing activities This register includes details such as:

Date you provided consent.
Purpose(s) for which you consented to data processing.
Specific data categories you consented to.
Method used to collect your consent (e.g., checkbox, sign-up form).
Date you withdrew consent (if applicable).

The consent register will also track specific situations where additional requirements apply:

Sensitive Data: Bidaya Finance Company will obtain your explicit and informed consent before processing any sensitive personal data categories as defined by the Personal Data Protection Law (PDPL).
Consent from Minors: For data collection involving minors, Bidaya Finance Company will obtain verifiable parental consent according to the Personal Data Protection Law (PDPL)'s requirements.
Tacit Consent: In limited cases where implied consent is lawful under the Personal Data Protection Law (PDPL), Bidaya Finance Company will document the justification for relying on tacit consent in the register.

13. Your Rights Regarding Consent

You have the following rights regarding your consent:

Right to Withdraw Consent: You can withdraw your consent at any time by contacting us using the methods described in the "Contact Us" section below.
Right to Access Your Data: You have the right to access the personal data we hold about you
Right to Rectification: You have the right to request that we rectify any inaccurate or incomplete personal data we hold about you.
Right to Erasure: In certain circumstances, you have the right to request that we erase your personal data.

14. Contact Us

If you have any suggestions or inquiries about this notice, please contact us at privacy@bidaya.com.sa or call our toll-free number 8001181111 (inside KSA).

15. Changes in the Privacy Notice

The Privacy Notice will be reviewed at least annually or as directed by Bidaya Finance Company management for its appropriateness with the changing internal and external environment including the mandates from the Saudi Data and Artificial Intelligence Authority.

Bidaya Finance Company will notify you of any material changes to this Guidelines by posting the revised Guidelines on our website.

By using our website or services, you acknowledge that you have read and understood this Personal Data Consent Guidelines.