Privacy Policy

Version: 3.0

Article One: Introduction

• This Privacy Policy explains the personal data that will be collected, the purpose of its processing, how it will be used, the legal basis for its collection and processing, the entities to which such data will be disclosed, if any, the geographical scope of the processing, the data retention period and the method of its disposal, the rights of the data subject and how such rights may be exercised, and the mechanism for communicating with the entity. It also explains the entity's commitment to making individual’s data available to them through clear and easily accessible means at the time of collection, such as by providing links to this Privacy Policy on its websites or applications, in accordance with the controls stipulated under the Personal Data Protection Law and its Implementing Regulations issued pursuant to Royal Decree No. (M/19) dated 09/02/1443H (hereinafter referred to in this Agreement as the "Law").

• Adalah Information Systems Technology Company Limited (Single-Person Company) is a company incorporated in the Kingdom of Saudi Arabia under Unified National Number [7021786608] (hereinafter referred to in this Agreement as the "Company"). The Company is the owner and operator of the legal platform "Qanoniah" (hereinafter referred to as "Qanoniah").
  The Company's activities include Information and Communications, Systems Analysis, and Artificial Intelligence Technologies. In its commitment to protecting the user's data and information, the Company undertakes to maintain the confidentiality and privacy of such data and to use it for the purpose of achieving the desired standard in providing the services required by the user, in accordance with the laws, regulations, and applicable terms and conditions in force in the Kingdom of Saudi Arabia.
  The user's use of the Company's website shall constitute the user's acceptance of this Privacy Policy.

Article Two: Data to Be Collected and the Purpose of Its Collection 

Article Three: Methods of Data Collection

3.1 Data is collected directly when the data subject provides it to the website through registration, using electronic forms containing blank fields and drop-down lists that are completed directly by the data subject. No personal data is collected from any other sources.

3.2 The IP address is collected indirectly through “Cookies”, which are collected when the website is visited.

Article Four: Use of Personal Data

4.1 The personal data collected, whether directly or indirectly, shall be used for the purposes of completing the registration process, improving the beneficiary's experience, and enabling the beneficiary to benefit from the services provided by Qanoniah, which fall within the scope of its activities as described in the Introduction.

4.2 The collection of the mandatory personal data specified in Article Two is essential due to its direct connection with the provision of the services on the Platform in accordance with internationally recognized practices, such as linking the account to the customer's information and ensuring the delivery of a service that meets the standards expected by our customers. Accordingly, this consent shall not be considered a condition for providing the service; however, the Company will not be able to provide the service without such data.

4.3 The Company confirms that the personal data collected will not be processed for purposes other than those set out in this Privacy Policy.

Article Five: Storage and Disposal of Personal Data

5.1 Personal data shall be stored within the Kingdom of Saudi Arabia, in the City of Dammam, through the cloud service provider Google under a contract with CNTXT. These servers are protected using best-in-class technologies in compliance with the policies and controls of the National Cybersecurity Authority (NCA) and international standards, including ISO/IEC 27001:2022, for which the Company has been certified (Certificate No. AMER300612, Issue Date: 19/06/2026), in order to prevent unauthorized access and mitigate cybersecurity risks. Thereafter, the data shall be securely destroyed within five (5) years from the date of termination of the contractual relationship with the customer, using methods that render the data inaccessible and irrecoverable, in accordance with the Company's adopted policies.

5.2 The Company implements administrative and technical measures to protect personal data against data breaches, damage, or unauthorized access. Such measures include, without limitation:( the use of data encryption, anonymization, and pseudonymization).

Article Six: Legal Basis for the Collection and Processing of Personal Data

6.1 Personal data is collected and processed based on the consent of the data subject. The data subject may withdraw such consent to the collection and processing of their personal data at any time, unless there is another legal basis permitting such collection or processing.

6.2 In accordance with the controls and procedures set out in the Personal Data Protection Law and its Implementing Regulations, the legal bases upon which we rely for the processing of personal data are as follows:

• The explicit consent of the data subject, which may be withdrawn at any time, as described in Article Seven, Paragraph 7.5.

• The achievement of legitimate interests and objectives, including improving the user experience of the Platform's services, verifying the identity of the account holder, and protecting personal accounts against unauthorized access.

Article Seven: Rights of the Data Subject

7.1 Right to Be Informed: The data subject has the right to be informed of the methods by which we collect their personal data, the legal basis for its collection and processing, how it is processed, retained, and destroyed, and with whom it will be shared. Full details are available in this Privacy Policy (this Policy) or through the "Settings" page, which enables the customer to view their data.

7.2 Right of Access to Personal Data: The data subject has the right to request a copy of their personal data by contacting the email address specified in Article 7.9. A copy shall be provided electronically in a clear, readable format that accurately reflects the contents of the records, free of charge, within seven (7) business days via email. The data subject may also access the "Settings" page in Qanoniah to view their personal data.

7.3 Right to Correct Personal Data: The data subject has the right to request the correction, completion, or updating of their personal data if they believe it to be inaccurate, incorrect, or incomplete, by contacting the email address specified in Article 7.9. The request shall be reviewed and the data updated within seven (7) business days, and the data subject shall be notified by email accordingly. The data subject may also update their information through the "Settings" page in Qanoniah, provided that such amendments do not conflict with the applicable Terms of Use.

7.4 Right to Request the Destruction of Personal Data: The data subject has the right to request the destruction (deletion) of their personal data unless a statutory provision requires its retention for a specified period or contractual requirements apply. Such request may be made by accessing the "Settings" page and selecting the "Delete Account" option. The data subject acknowledges that this action will result in the deletion of all data associated with the account.

7.5 Right to Withdraw Consent to the Processing of Personal Data: The data subject may withdraw their consent to the processing of their personal data at any time, unless there is another legal basis requiring continued processing. Such withdrawal may be requested by contacting the email address specified in Article 7.9.

7.6 Right to Lodge a Complaint: The data subject has the right to submit any complaint arising from the application of the provisions of the Personal Data Protection Law to the competent authorities.

7.7 Right to Claim Compensation: The data subject has the right to claim compensation for any damage suffered as a result of any violation of the provisions set out in the Personal Data Protection Law.

7.8 The data subject may exercise the rights guaranteed under the Personal Data Protection Law and set out in this Article by contacting the Company via the email address or mobile telephone number of the Personal Data Protection Officer, or by contacting Customer Service through the communication channels available on the Platform.

7.9 The customer may communicate directly with the Personal Data Protection Officer at the following email address:  [email protected] , for the purpose of exercising any of the rights set out in this Article.

Article Eight: Sharing/Disclosure of Personal Data

We disclose personal data to ensure the quality of our services. Accordingly, the Company regularly shares customers' personal data with a number of service providers responsible for managing customer registration requests on Qanoniah and providing customer support in accordance with the highest standards of security and privacy, while complying with the Regulations on the Transfer of Personal Data Outside the Kingdom. These service providers include:

• HubSpot: To ensure the provision of customer service in accordance with the highest quality standards, to manage subscription requests for Qanoniah, and to coordinate communications with customers.

• Rasayel: To ensure the provision of customer service in accordance with the highest quality standards. This service enables the Company to identify users experiencing technical issues or making inquiries regarding Qanoniah and to communicate with them in order to respond to such issues or inquiries.

Article Nine: External Links

The Company's website may contain links to other websites to accommodate the user's needs. The Company shall not be responsible for any content available on such websites, for any person's use of them, for their proper operation, or for any issues that may arise from their use. The user shall be solely responsible for all actions taken while using any websites accessed through the links available on this website.

Article Eleven: Personal Data Protection Officer

Company: Adalah Information Systems Technology Company Limited (Single-Person Company)

Name: Yahya Ahmed Al Omari

Email: [email protected]

Mobile Number: 0598733272

Article Twelve: Complaints and Objections Procedure

12.1 If the data subject has a complaint or objection, or objects to the processing of their personal data, they may contact the Platform Administration at the following email address: [email protected].

12.2 If no response is received within seven (7) business days, or if the data subject is not satisfied with the outcome of the complaint or objection, the matter may be escalated to the National Data Management Office (NDMO) via the following email address: [email protected].

12.3 Any complaints or inquiries relating to this Privacy Policy or the handling of personal data may be directed to the Platform Administration at the following email address: [email protected].

Article Thirteen: Availability and Updates of the Privacy Policy

13.1 Data subjects shall be notified of any updates to this Privacy Policy through their account page on Qanoniah, via the registered email address, or through their mobile phone number.

13.2 The Company shall periodically review this Privacy Policy and update it in accordance with the latest legal developments and any decisions issued by the competent authority. Any amendment or update to this Privacy Policy shall be recorded in the Revision History attached to this Privacy Policy.

13.3 The Company reserves the right to add to or amend any provision of this Privacy Policy. The data subject shall be notified of any such addition or amendment.

13.4 The Arabic language shall be the governing language for the interpretation and application of these terms and provisions. In the event of any discrepancy or conflict in the interpretation of any provision in any other language, the Arabic text shall prevail.

Article Fourteen: Platform Administration

Name of the Entity Operating the Platform: Adalah Information Systems Technology Company Limited (Single-Person Company).

Article Fifteen: Contact Information

Department/Team Responsible: The department responsible for implementing the provisions of the Personal Data Protection Law within the Company.

Address: Riyadh, Kingdom of Saudi Arabia.

Telephone Number: 0598733272

Email: [email protected]

Commercial Registration No.: 4030410242

Annex (1): Revision History