Privacy Policy & Client Data Protection

This policy applies to users of the Al-Khaber website, clients communicating to request a service, users of the client portal, and individuals providing their data for inquiries, evaluation, execution, or tracking of a transaction.

This policy does not govern the practices of external websites and platforms accessible via links on our site; those sites are subject to their own privacy policies.

The required data varies depending on the type of communication or service. Mentioning a category of data does not mean we collect it from all users.

Identity and Contact Data

• Name or establishment name.
• Phone number and email address.
• City or region when relevant to the service.
• Data of the authorized person or legal representative when applicable.

Transaction and Service Data

• Type of transaction and the competent authority.
• Request or transaction number, date, and status.
• Notes, reasons for rejection, or completion requests.
• Documents necessary to evaluate or execute the service.
• Correspondence, instructions, and approvals related to the request.

Technical Data

• IP address automatically.
• Device type, browser, and operating system.
• Pages visited and time of visit.
• Security and technical error logs.
• Cookies when used or approved according to their type.

Payment Data

The office may retain transaction details such as the amount, date, and transfer or invoice reference. The client is never asked to send the card’s secret PIN, verification code, or bank account login details.

Data is collected in ways appropriate to the nature of the service and communication, primarily:

• Data sent by the user via the contact form.
• Information shared by the client through approved communication channels.
• Data entered by the user in the client portal.
• Documents and information provided during service execution.
• Technical data generated when using the site.
• Official or public sources when necessary to verify information related to a client’s request in a lawful manner.

We process personal data to achieve a clear purpose related to the nature of user communication or the requested service, including:

• Receiving and responding to inquiries.
• Evaluating the feasibility of providing the service and determining its scope.
• Verifying the client’s identity or capacity when needed.
• Reviewing documents and organizing the transaction file.
• Executing the service, tracking the request, and updating the client on developments.
• Managing the relationship with the client and issuing quotes and invoices.
• Providing technical support and managing the client portal.
• Improving site performance and user experience.
• Protecting the site and accounts, and preventing fraud and unauthorized use.
• Complying with legal requirements and responding to requests issued by competent authorities.
• Managing complaints, privacy requests, and dispute resolution.

Data is processed according to the appropriate legal basis for each case, which may include:

• Consent of the data subject when consent is the appropriate basis.
• Taking steps at the client’s request prior to contracting or executing the service agreement.
• Executing obligations related to the agreed-upon service.
• Fulfilling a legal obligation binding upon the office.
• Protecting the legitimate interests of the office or users without prejudicing the rights of data subjects.
• Establishing, exercising, or defending a legal claim when necessary.

When processing relies solely on consent, the data subject may withdraw their consent, without affecting the lawfulness of processing carried out before the withdrawal.

Some data is necessary for the office to respond to an inquiry, verify a request, or execute a service, while other data is optional and used to provide additional details or improve communication.

Failure to provide essential data may result in the inability to evaluate the transaction, provide the service, or track the request. The required data will be clarified according to the case whenever possible.

Personal data is not disclosed unless there is a legitimate purpose, a necessity related to the service, or a legal requirement, and only to the extent necessary to achieve the purpose.

Specific data may be shared with the following categories:

• Government entities or official platforms associated with the client’s request.
• Hosting, technical service, and tech support providers.
• Payment and billing service providers when used.
• Translation, authentication, or shipping offices when the client requests the associated service.
• Professional or legal advisors when there is a legitimate need.
• Competent authorities when there is a legal obligation or a binding request.
• Parties the client agrees to share with to achieve a specific purpose.

Al-Khaber Office does not sell personal data, nor does it treat it as an independent commercial product.

Some technical services, such as hosting, email, or cloud storage, may rely on providers with technical infrastructure inside or outside the Kingdom of Saudi Arabia.

When transferring personal data or disclosing it to an entity outside the Kingdom, legal requirements and appropriate safeguards applicable to data transfer are observed, and only to the extent necessary to provide the service or operate the site.

Data is stored using operational systems and means relied upon by the office or contracted service providers, taking appropriate measures to limit unauthorized access.

The retention period varies according to the type of data, the purpose of collection, the nature of the service, and legal, accounting, or contractual requirements.

• Inquiry data is kept for the period necessary for reply and follow-up.
• Client files are kept throughout the execution of the service and for a necessary period after its completion.
• Financial records are kept according to applicable legal requirements.
• Specific data may be kept to manage a claim, dispute, or legal obligation.
• Data is deleted, destroyed, or anonymized when the need for it ends, unless there is a legitimate reason to retain it.

The office takes appropriate administrative, organizational, and technical measures depending on the nature of the data and the associated risks, which may include:

• Restricting access to data based on functional need.
• Using protective measures for accounts and systems.
• Updating used software and technical components.
• Backing up data when operationally needed.
• Reviewing permissions and revoking unnecessary ones.
• Raising awareness not to share passwords and verification codes.
• Handling security incidents and taking appropriate action upon discovery.

No electronic transmission or storage method guarantees absolute security, so the user must also protect their device and accounts and not share login details.

The site may use cookies or similar technologies to operate pages, save certain preferences, enhance security, and measure site performance when analytics tools are enabled.

Essential Cookies

These help operate the basic functions of the site or client portal, and some parts may not work correctly when disabled.

Preference Cookies

These help remember some of the user’s choices to improve the browsing experience.

Analytics Cookies

These may be used to understand how pages are used and improve performance, when analytics services are enabled and subject to available consent settings.

The user can manage cookies through browser settings, though disabling some may affect certain site functionalities.

When using the Client Portal, the user is responsible for maintaining the confidentiality of their account details and for the usage that occurs through it.

• Use a strong, unique password.
• Do not share account details with an unauthorized person.
• Log out when using a shared device.
• Notify the office if unauthorized access is suspected.
• Update the phone number or email when they change.

The office may use contact data to send updates related to the client’s request or requested service, such as completion requests, transaction status, appointments, or invoices.

Marketing messages are only sent according to the appropriate basis, and the user can request to stop them through the available communication method, while necessary messages for an ongoing service or legal obligation will continue.

The site is primarily directed at persons capable of requesting services or their legal representatives. When a transaction involves a minor, the data must be provided by their guardian, legal representative, or a person with a legitimate capacity.

Documents of a minor or another person should not be sent without a need related to the service and a valid capacity allowing for their sharing.

The site may contain links to government entities, payment platforms, maps, communication services, or independent websites. The use of these services is subject to their own policies and terms, and Al-Khaber Office does not control how they process data.

The user must verify the official domain before entering sensitive data and read the privacy policy of the external service.

The user must provide correct and up-to-date data and inform the office when information related to the service changes, such as a phone number, email, or transaction status.

The office may request a supporting document when needing to verify a correction or update request, which will be handled within the limits of the required purpose.

Upon discovering an incident affecting personal data, the office works to evaluate, contain, and take appropriate action, including notifying authorities or data subjects when notification is required by applicable regulations.

The user can notify the office if they suspect unauthorized access or a fraudulent message impersonating the office through the Contact Us page.

This policy may be updated when services, processing methods, systems, or technical tools change. The updated version will be published on this page with an amended update date.

Users are advised to review the policy periodically, especially before providing new data or requesting an additional service.

The data subject can submit a request to inquire about their data or exercise a right through the Contact Us page, providing the necessary information to verify their identity and determine the request.

• Name of the data subject.
• Communication method associated with the request.
• Type of request or right to be exercised.
• Service or transaction associated with the data.
• Any information helping to locate the requested record.

The office may request additional information to verify identity and protect data from disclosure to an unauthorized person.

To submit a privacy-related request, use the Contact Us page.