What is personal data and processing?
Personal data means any data by which you may be identified as an individual.
The personal data that we collect from you may be different, depending on the circumstances. For example, it may include the following:
full name, phone number, nationality, personal email, employment history, education history, bank account, national ID/IQAMA, national address, marital status
What is processing?
Processing means doing anything with personal data, e.g. viewing, collecting, using, storing, sharing, modifying, printing, copying, archiving, erasing, etc.
What is processing?
- We will use a legal basis to process your personal data. This means we will have a legal justification to use your personal data, as required by the Law.
- We may rely on the following lawful bases to process your personal data under the Law:
- Your consent (we will let you know on a case-by-case basis should we require your consent).
- Processing achieves a definite interest for you and it is impossible or difficult to contact you.
- Processing is required by applicable laws and is performed in accordance with them.
- Processing is performed in order to perform an agreement to which you are a party.
- Processing is necessary for the purpose of our legitimate interest.
When, how and why do we process your personal data?
- We may process your personal data in many ways. We will choose particular ways of processing your personal data depending on the purpose of processing, as specified below. The ways of how we may process your personal data may include viewing, collecting, using, storing, sharing, modifying, printing, copying, archiving, erasing, etc.
- Please see in the table below the types of possible processing activities and their purposes.
| No. | Key purposes of processing activities | Examples of processing activities |
| 1 | this type of collecting of data is only for hiring purposes | recruitment process |
- Collecting and processing your personal data is mandatory in order to complete the hiring and onboarding procedures.
-Please note that if we do not complete the collection of personal data for the above purposes, lack of data to complete the hiring activities.
- As for the method of collecting your personal data - we may collect it directly from you and, in some circumstances, from third parties, for example, We will collect your personal data from such third parties only in cases specified in section 5 below.
- If there is a change in your personal data, for example please let us know as soon as possible by contacting please contact this email address info@atmaal.sa.
Processing personal data for other purposes
- We aim to ensure that as a general rule we will use your personal data in accordance with the purposes, as specified in section 4 above.
- However please note that pursuant to the Law we may process your personal data for purposes other than specified in section 4 above. It may happen in the following cases:
- If you give your consent to such collection and processing.
- If your personal data is publicly available, or if it was collected from a publicly available source.
- If collection and processing is required for your vital interests
- If collection or processing of your personal data is necessary to protect public health or safety, or to protect the life or health of you or other individuals.
- If your personal data is recorded or stored in a form that makes it impossible to identify you directly or indirectly.
- Collection of your personal data is necessary to achieve our legitimate interests.
| No. | Data Subject Right | Right Description |
| 1. | Right to be informed | You have the right to be informed of:the valid legal or practical justification for collecting your personal data anddetails about processing of your personal data (e.g. categories of personal data processed, purpose for collecting your personal data, the period for which the personal data will be stored, etc). |
| 2. | Right to have access to your personal data | You have the right to have access to your personal data that is held by us. |
| 3. | Right to obtain personal data | You have the right to request your personal data held by us in a readable and clear format |
| 4. | Right to request correction, completion of personal data | You have the right to request correction, completion or updating of your personal data which is held by us. |
| 5. | Right to request destruction of personal data | You have the right to request destruction of your personal data available to us, which is no longer required by us (subject to compliance of the requirements of the Law). |
| 6. | Right to withdraw consent | You may at any time with draw your consent to processing of your personal data (if other legal bases for processing are not used). |
Please contact us if you would like to know more about your rights or if you would like to exercise any of them: Data Protection Officer : DPO@atmaal.sa
Storing personal data
- We will arrange safe storage of your personal data in our data storage located in Saudi Arabia .
- We will determine the period of storage of your personal data in acordance with our Data Retention Policy. In particular, when determining the period of storage of your personal data we will take into account:
- requirements to the storage period, as such requirements are specific in applicable laws and regulations;
- specific purposes for which we require your personal data.
Disclosure of your personal data
- We may, ascould be required for the purposes listed in section 4 above, disclose yourPersonal Data to the following organizations:
- our contractors who provide us with IT and other services;
- insurance, health or legal services, any member of our group, current or potential clients, suppliers, subcontractors and other business contacts in the ordinary course of our business;
- current or potential business partners in the banking and financial sector or other third parties involved in the management of our business, as a result of, for example, a joint venture or a merger;
- any applicable regulatory authorities(governmental and other public bodies, etc.) or other third parties as could be required by law or in accordance with other regulatory obligations or policies applicable to us or to you;
- We may disclose your personal data, in the following cases:
- You consent to the disclosure.
- Your personal data has been collected from a publicly available source.
- The entity requesting disclosure is a public entity, and the collection or processing of your personal data is required for public interest or security purposes, or to implement another law, or to fulfill judicial requirements.
- The disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals.
- The disclosure will only involve subsequent processing in a form that makes it impossible to directly or indirectly identify you.
- The disclosure is necessary to achieve our legitimate interests.
- When providing your personal data to the entities with whom we have contractual relations, we request a confirmation of the security measures these legal entities take to protect the personal data we provide. We do not share the personal data with public authorities or other third parties without a proper lawful request of the authorities.
- We make best efforts to ensure we have relevant contractual agreements in place with the parties with whom we share your personal data with and that they comply with the data protection requirements of Atmaal.
Cross-border personal data processing
We may be required to transfer your personal data for processing outside of the KSA. In such cases we will comply with the requirements of the Law regarding the cross-border personal data transfers, as well as with the requirements of other laws and regulations, where applicable.
Protecting personal data
- We protect your personal data by using a range of methods, procedures and techniques. For example:
- we have assigned the responsibility for the organization of personal data processing to a specific employee;
- we have in place policies and procedures in the area of protection of personal data to ensure that our personal data
processing activities comply with the Law;
- we have implemented the necessary measures to protect personal data (access control, encryption);
- we have organized a process of receiving and controlling the processing of data subjects’ requests;
- we keep up to date the Records of Processing Activities (RoPA);
- we carry out a Data Protection Impact Assessment (DPIA) for personal data processing activities, where required;
- we ensure security of third parties(controllers, processors, joint controllers);
- we carry out planned and unscheduled audits of personal data processing activities.
Disposal of personal data
- If we no longerneed your personal data and if we do not have any legal basis to hold it further, we will arrange its erasure (destruction), anonymisation or return to you (unless we must return it to any other entity based on our legal obligations).
- We will ensure that:
- in case of anonymisation: you will not be further re-identified after anonymization;
- in case of erasure (destruction): the personal data will not be reconstructed after it was erased.
With drawal of consent
In some cases, we may request your consent to processing of your personal data. When we request your consent, we will also explain to you how you can withdraw your consent. If you have any questions regarding the consent that you may provide to us (or already provided), as wellas how you can withdraw it - you may contact us with the use of the contact details, specified in Section “Contact details” of this Privacy Notice.
Contact details
If you have any questions, concerns, or wouldlike to know more about your data and how we handle it, we’re here to help:
Address:
Northern Ring Branch Road, Exit 5
Al Nafal District, Building 6238
Zip Code 13312, Riyadh Saudi Arabia
Email: DPO@atmaal.sa
We encourage you to reach out — your trust andclarity are important to us.