Privacy Policy

Almarai Website Privacy Notice

This PrivacyNotice (this “Notice”) explainshow to Almarai Company with registered address at: AlEzdihar Area, National Address: 12354, BO 12487 – 2380 Riyadh, Saudi Arabia Telephone: 0114700005 , Fax 0114701555 , Email:Info@almarai.com Website:https://www.almarai.com (“Almarai” “we”, “our”, or “us”) uses and processespersonal data (as defined below)pertaining to you as a website user. The purpose of this Notice is to describe the way we collect, store, use and protect personal data. This policy applies to all visitors to our website (“you” or “your”).

Almarai Company is the controller (as defined below) with respect to your personal data collected in connection with the above.

Definitions

“Applicable Data Protection Law” means the applicable data protection and privacy legislation that applies to the processing of personal data under this Notice, namely the Personal Data Protection Law (“PDPL”) of the Kingdom of Saudi Arabia (“KSA”) issued by Royal Decree No. (M/19) dated 9/2/1443AH and amended by Royal Decree No. (M/148) dated 5/9/1444AH, its Implementing Regulation and Regulation on Personal Data Transfer outside the Kingdom (together, the "Regulations") and any related regulations or guidelines issued by the competent authorities in Saudi Arabia.

“Controller” means the one entity that independently decides the purpose and means of processing your personal data. The controller is responsible for keeping your data secure and managing and handling it in accordance with the Applicable Data Protection Law.

“Personal data” means any information that can identify you, either alone or combined with other data. This may include data such as your name, email address, phone number, online identifiers, or geographic location.

Collection

We collect and process the following personal data about you:

• Identification data– information that identifies you as a website user. For example, your name and surname.

• Contact data– information that allows us to address, send or communicate a message to you, For example, your email address.

• Technical data– various information technology-related information, such as cookies, browser usage information and similar; and

• Optional data - we may process optional data about you where you provide this data on a voluntary basis. This includes content you decide to upload to our website, on data regarding your use of optional website features and functionality.

We usually get your personal data directly from you (e.g. when you register on our website), but we may also obtain your personal data from other sources as necessary and to the extent permitted by Applicable Data Protection Law, including from:

• Cookies –when you visit, browse, or use our website, we may use cookies to automatically collect certain information from your device; and

• Our web browser– when you use our website, we may collect information regarding your browser usage or website analytics.

Use

We collect your personal data so that we can manage our relationship with you and your use of the website.

We process your personal data with your consent (where required by Applicable Data Protection Law) or where otherwise permitted or required by applicable laws, including under the following legal bases:

• Contract (Art. 6.2 of the PDPL) – when we are implementing or executing an agreement to which you are a party.

• Legal Obligation (Art. 6.2 of the PDPL) – when we are required to comply with other laws and regulations in the KSA.

• Legitimate Interest (Art. 6.4 of the PDPL) – when it is within our legitimate interests for the purpose of processing, which include ensuring continuity of our business and effective administration and operation of our website.

Purpose for Processing

We process your personal data for the following purposes:

• to send you send administrative messages and email updates to you regarding the website (Legal basis: Contract, Legal Obligation, Legitimate Interest);

• for marketing purposes (to the extent permitted by Applicable Data Protection Laws) (Legal basis: Consent); and

Disclosure and Transfer

To the extent permitted by Applicable Data Protection Law, we only disclose your personal data outside of our business in limited circumstances. We may disclose your personal data to:

• Advertisers: We may disclose aggregate statistics about the personal data to advertisers or business partners;

• Government authorities/regulators, law enforcement and others: we may disclose personal data to government authorities/regulators or law enforcement where we are required to do so by applicable law; and

• Business transfer participants: if we undergo a change in ownership, or a merger with, acquisition by, or sale of assets to, another entity, we may assign our rights to the personal data we process to a successor, purchaser, or separate entity. We will disclose the transfer on the website.

Data transfer outside of the KSA

We may transfer personal data outside of the KSA in accordance with applicable law.

Some recipients of your personal data are located in countries that SDAIA recognizes as providing an adequate level of data protection (with reference to adequacy decisions issued by SDAIA). In such cases, transfers are compliant with the Applicable Data Protection Law.

For recipients of your personal data located in countries not recognized by SDAIA as providing an adequate level of data protection, we ensure that all such transfers are conducted in accordance with the Applicable Data Protection Law. This includes implementing appropriate safeguards (such as Standard Contractual Clauses) and ensuring that suitable technical and organizational security measures are in place. These measures are designed to protect personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and all other unlawful forms of processing. To the extent required by applicable law, only the minimum necessary personal data will be transferred outside of the KSA.

Retention

We will store personal data in accordance with applicable laws or regulatory requirements and retain data for as long as necessary to fulfil the purposes for which the personal data was collected, and to meet legal requirements.Our retention of your personal data is governed by Applicable Data Protection Law. This storage period may extend beyond the term of your relationship with us.We may need to keep your data for longer than our specified retention period for the following reasons:

• we bring or defend a legal claim or other proceedings during the period we retain your personal data, in which case we will retain your personal data until those proceedings have concluded and no further appeals are possible.

• in cases where everything that might lead to identifying you specifically has been eliminated pursuant to the controls set out in the Applicable Data Protection Law; or

• in limited cases, existing or future law or a court order or a regulator requires us to keep your personal data for a longer period.

When your personal data no longer needs to be retained, we will securely dispose of such data in a manner that prevents access or retrieval.

Storage

Your personal data is stored securely either at our headquarters/or at a cloud computing service provider.

A list of the Almarai entities andothers to whom we disclose personal data can be found in Almarai website.

Automated decision making

Please note that we do not currently use any systems or processes that leverage automated decision-making.

Your Rights Regarding Processing of Your Personal Data

You have the following rights in relation to your personal data under Applicable Data Protection Law:

• Right to be informed: A right for the data subject to be informed about the collection and use of their personal data, including, among others, the legal basis and the purpose of collection. This information should be made available to the data subject prior to personal data collection, as well as upon the request of the data subject. When collecting personal data directly from the data subject, Almarai should take appropriate measures to inform the data subject of information items listed under applicable laws.

• Right of access: A right for a data subject to access some or all of their personal data (subject to certain exemptions and restrictions).

• Right to rectification (correcting, completing or updating the data): A right for a data subject to have inaccurate personal data corrected, updated or completed. If personal data is corrected, completed or updated, Almarai shall notify such amendment to all the other entities to which such personal data has been transferred and make the amendment available to such entities.

• Right to destruction of data: A right for the data subject to have personal data destroyed, without undue delay, where the purposes for the collection cease to exist (subject to exemptions).

• Right to request a copy: The right to obtain personal data in a readable and clear format.

• Right to withdraw your consent: You are entitled to withdraw your consent for processing your personal data at any time unless there are legal bases that require otherwise.
  
  

You also have the right to lodge a complaint with the applicable data protection authority in Saudi Arabia (the Saudi Data and Artificial Intelligence Authority ("SDAIA"). SDAIA can be contacted at the SDAIA website (https://sdaia.gov.sa) or via the National Data Governance Platform (https://dgp.sdaia.gov.sa).

For further details regarding the processing of your Personal Data and how to exercise your rights, you can contact us using the contact details in the 'Enquiries' section below.

Enquiries

If you have any questions or concerns arising from this Notice or the way in which we handle personal data, please contact us. You can contact us with privacy related questions here customer.care@almarai.com

Last Updated: 6^th Jan 2025