Privacy Policy for the Awraq platform

The Awraq Mashurah platform is operated by Al-Awraq Al-Mushaffara Company, a limited liability company registered in the Kingdom of Saudi Arabia under unified national number (7053677782).

The company is the controller of the personal data it processes to operate the platform and provide its services, and is referred to in this policy as "Awraq".

This policy explains how personal data is collected, used, stored, shared and destroyed, the rights of data subjects, and how those rights can be exercised.

This policy covers the data of the platform’s visitors, clients and service requesters, and of individuals whose data may appear within the information needed to prepare reports. Awraq processes data according to how the platform is used and the nature of the service, including:

• Account and contact data: name, mobile number, email address, account identifier, and verification and consent records.
• Order data: report type, the chosen purpose, listing numbers and links, property details, attachments, and the information provided to carry out the service.
• Transaction data: payment amount, date, status and reference, invoices, refunds, and the billing details required. Payment instrument data is processed through the payment provider used, under the relevant payment and notification arrangements.
• Support data: enquiries, complaints, correspondence, and the information needed to handle them.
• Technical and operational data: IP address, device and browser type, sign-in, error and security event logs, and the data needed to run sessions and orders and to protect the platform.
• Report data: the information, observations and conclusions associated with an order. This may include personal data relating to an owner, an advertiser or an organisation’s representative, where processing it is necessary and lawful.

1. 1
   Awraq collects data directly when an account is created, an order is placed, a payment is made, contact is initiated, or consents are set.
2. 2
   Some data is collected automatically while the platform is used, for operational and security purposes, or from payment, verification, messaging and data providers, or from advertisements and sources that may lawfully be used.
3. 3
   Collection forms indicate which data is required and which is optional. Not providing essential data may make it impossible to create or verify an account, carry out an order, issue an invoice, or handle a claim.
4. 4
   Declining marketing messages does not prevent you from using the core service.
5. 5
   If you provide data relating to someone else, you must ensure you have the authority or a lawful basis to do so. This does not relieve Awraq of its own obligations regarding lawful processing and data minimisation.

Awraq processes data for the following purposes, on the legal basis appropriate to each:

1. 1
   Creating and verifying accounts, managing orders, preparing and delivering reports, and carrying out payments and refunds — to perform the agreement to which the data subject is a party, or on the basis of consent where that is required.
2. 2
   Issuing invoices, keeping records, and responding to lawful requests from the competent authorities — to meet applicable regulatory obligations.
3. 3
   Protecting accounts, detecting fraud, resolving faults and improving service reliability — on the basis of legitimate interest where its conditions are met and it does not override data subjects’ rights, or on another appropriate legal basis.
4. 4
   Handling complaints, rights requests and claims, and defending rights — on the applicable legal basis.
5. 5
   Sending marketing messages where these are enabled — on the basis of the consent required.

Awraq assesses the legal basis for processing the data of individuals appearing in advertisements and sources independently; the consent of the client who ordered a report is not consent on those individuals’ behalf. Accepting the Terms & Conditions is not blanket consent to every use of data, and data is not used for a new, incompatible purpose without meeting the requirements for it and informing the data subject where necessary.

Authorised staff and practitioners have access to data to the extent needed to carry out their duties. Awraq may engage service providers in the following areas and share with them the data needed for the service assigned to them:

• Hosting, storage and backup.
• Verification, access codes, messaging and email.
• Payment, invoicing and accounting.
• Support, security and fault diagnosis.
• Data processing and the technical tools that support report preparation.

The relationship with processors sets out their obligations on confidentiality, security, restricted use of data, and acting on instructions and in accordance with the regulations. Data may be disclosed to the competent authorities or to professional advisers where there is a regulatory requirement or justification, and within the limits of the purpose justifying the disclosure.

1. 1
   Awraq stores and processes personal data using its own systems and its contracted service providers, to the extent needed to operate the platform and provide its services, applying appropriate measures to protect the data and restrict access to it.
2. 2
   Some data may be processed outside the Kingdom of Saudi Arabia by hosting or supporting technical service providers, for the purposes set out in this policy. This is subject to the regulatory requirements on transferring personal data, including the safeguards and assessments required in each case.
3. 3
   Accepting this policy is not an unrestricted authorisation to transfer data or use it for other purposes.

To ask about how your data is processed, or to exercise your rights, contact us at contactus@awraq.sa.

Awraq retains data for as long as is necessary to achieve the legitimate purpose for which it was collected and to meet regulatory and contractual obligations. Retention periods are set according to the type of data and the need for it, as follows:

When no longer needed, data is securely destroyed or de-identified so that it can no longer be attributed to its subject. Backups are handled on a deletion cycle, with use of data marked for destruction restricted. Where specific data must be retained for a regulatory obligation or an outstanding claim, its use is restricted to that purpose. You can request the retention period, or the criteria used to set it, for particular data via the privacy email address.

1. 1
   The service states whether a report is private or publicly available, and whether sharing it is permitted.
2. 2
   Awraq does not publish the identity or account details of the client who requested a public analysis merely because they bought the report or proposed its subject.
3. 3
   Where sharing a private report is enabled, the client is told what information the link will reveal and the scope of access to it. Anyone who obtains a public sharing link may be able to keep a copy of the content, so the data should be reviewed before sharing.
4. 4
   The verification page does not display personal data that is not needed to verify the report, and a client’s sharing does not relieve Awraq of its responsibilities.
5. 5
   The fact that listing information is publicly available does not permit using or republishing it without regard to the rights of those it concerns and the lawful purposes for processing it.

1. 1
   Awraq may use technical and automated tools to organise and analyse information and to prepare drafts or supporting elements for reports.
2. 2
   The personal data used is minimised to what is necessary, and provider terms, protective safeguards and processing locations are taken into account.
3. 3
   Using client data to train general models for purposes unrelated to providing the service is not permitted without an appropriate legal basis, clear disclosure, and consent where required.
4. 4
   Professional responsibilities remain with the company and its practitioners according to their roles. You can request a human review of an output relating to your order that you believe contains a material error.

1. 1
   Awraq uses cookies, local storage and similar technologies to the extent needed to operate the platform, including sign-in, session management, account protection, completing orders and payment operations.
2. 2
   These uses are limited to the necessary operational purposes. At this stage Awraq does not use optional cookies or tracking technologies for advertising, retargeting, or analysing user behaviour.
3. 3
   Data associated with these technologies is processed on the legal bases and for the purposes set out in this policy, and is not retained longer than it is needed.
4. 4
   You can delete or control cookies from your browser settings; disabling the necessary ones may make some platform functions unavailable.
5. 5
   If Awraq later adds optional technologies that require consent, it will explain their purposes and obtain the necessary consent before enabling them, together with a means of refusing them and withdrawing consent.

1. 1
   Verification, security, order confirmation, payment, delivery and complaint-handling messages are sent as operationally required.
2. 2
   Operational messages are not used to circumvent a user’s choice not to receive marketing.
3. 3
   Consent to marketing is requested clearly and separately where required, stating the contact channels covered.
4. 4
   Marketing messages identify the sender and provide an easy way to unsubscribe. Unsubscribing can also be requested at contactus@awraq.sa.
5. 5
   Consent-based marketing processing stops when consent is withdrawn, without undue delay and in line with applicable requirements, though messages necessary to carry out an existing service or meet a regulatory obligation may continue.

1. 1
   Awraq takes appropriate technical and organisational measures to protect data from unlawful access, disclosure, alteration or destruction, proportionate to the nature of the data and the risks of processing it.
2. 2
   These measures include controlling access permissions, protecting communications, managing updates and backups, and incident response.
3. 3
   Please do not share access codes or confidential payment details through support correspondence.
4. 4
   If a personal data incident occurs, Awraq assesses its effects and takes the containment, remediation and notification steps required for the competent authorities and for data subjects, under the applicable conditions and timeframes.
5. 5
   This policy contains no guarantee that an incident is impossible, and no exemption from the duties of protection and response.

Subject to the applicable regulatory controls and exceptions, you may:

• Know the purposes for which your data is processed, their bases, and how it is used.
• Access your data and request a clear, readable copy of it.
• Request that your data be corrected, completed or updated.
• Request destruction of data for which there is no longer a legitimate need.
• Withdraw your consent to processing that relies on it.
• Submit a complaint to the competent authority and claim compensation where grounds for it exist.

Withdrawing consent does not affect the lawfulness of prior processing, and does not stop processing that rests on an independent legal basis. If it makes a service that depends on it impossible to provide, Awraq explains the effect. Requests are submitted at contactus@awraq.sa; your identity may be verified to the extent needed to protect the data, without requesting excessive information. Rights requests are handled free of charge, in accordance with the regulations. Awraq responds within thirty days of receiving the request, and may extend by a further period of no more than thirty days where there are regulatory grounds, notifying you of the reasons for the extension before the first period ends. If a request cannot be carried out, or is carried out in part, Awraq explains the reason and the legal basis to the extent permitted, without prejudice to your right to complain.

Privacy complaints are submitted at contactus@awraq.sa — please describe the problem and attach what is needed to examine it, avoiding sending unnecessary data.

1. 1
   Awraq acknowledges receipt of a complaint within two business days, and provides an initial response within five business days.
2. 2
   Handling is completed within ten business days of receiving all the necessary information. If a case requires more time, the complainant is told the reason and the expected date, provided that total handling time does not exceed thirty calendar days from receipt.
3. 3
   If it cannot be resolved within that period, a reasoned response is provided setting out what has been done and what remains outstanding. A complaint is not treated as resolved merely because it has been closed administratively.
4. 4
   Rights requests are subject to the periods and controls set out in the previous section, and any shorter mandatory statutory periods apply.
5. 5
   Business days means Sunday to Thursday, excluding official holidays in the Kingdom of Saudi Arabia.
6. 6
   A complaint may be submitted to the Saudi Data & AI Authority (SDAIA) through the personal data protection complaints service on the National Data Governance Platform: https://dgp.sdaia.gov.sa
7. 7
   For intrusive messages or calls, the reporting channels provided by the Communications, Space and Technology Commission or by the telecoms service provider may be used, according to the type of report and its procedures.
8. 8
   You are not required to wait for the outcome of internal handling before approaching a competent authority, and complaining to Awraq does not suspend the statutory periods for claims.

1. 1
   Client-facing services are intended for those who meet the capacity and age conditions set out in the Terms & Conditions.
2. 2
   If Awraq becomes aware that a minor’s data has been collected in a way that is inappropriate for the service, it takes the necessary steps to restrict and correct the processing or destroy the data, in line with regulatory requirements.
3. 3
   The platform may contain links to, or integrations with, independent external services. Each party’s own policy explains its processing of data, without relieving Awraq of its responsibilities for the data it collects or discloses.
4. 4
   This policy may be updated, stating the version number and the date of the update and informing users of material changes. Fresh consent is requested where a change in processing requires it.
5. 5
   Updates are not a retroactive cure for processing that had no lawful basis, and merely reading this policy is not consent to processing that requires specific consent.

To get in touch about this policy: contactus@awraq.sa