Privacy Policy

Introduction

Saudi Automobile Federation (“SAF”) is committed to protecting the privacy of users of its application and safeguarding their personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, its Implementing Regulations, and other applicable laws and regulations.

This Privacy Policy explains the types of personal data we may collect, the purposes and methods of processing, how data is used and protected, the circumstances in which it may be disclosed, retention periods, and the rights of data subjects and how they may exercise those rights.

1. Data We Collect

Depending on the services used by the customer, the Company may collect the following types of data:

• Data provided by the user: such as name, mobile number, email address, National ID or Iqama number, address, and payment information required to complete transactions.
• Vehicle data: such as license plate number, chassis/VIN number, and vehicle information related to the requested service.
• Technical data: such as IP address, device type, operating system, device identifiers, and application usage information, to the extent necessary to operate, improve, and secure the application.
• Location data: when the user enables location services and grants the application permission to access location information, for the purposes described in this Privacy Policy.
• Communication data: such as inquiries, complaints, feedback, ratings, and communications with customer service.

The Company is committed to collecting only the minimum personal data necessary to achieve specific and legitimate processing purposes.

2. Purposes and Legal Basis for Processing

Personal data may be processed, as applicable, for the following purposes:

• Providing application services and fulfilling user requests.
• Processing bookings, payments, and related transactions.
• Communicating with users regarding requests, services, and updates.
• Improving service quality and user experience.
• Protecting the application and users and preventing fraud and misuse.
• Complying with applicable legal and regulatory requirements.
• Sending marketing communications and offers where legally permitted and after satisfying the applicable requirements.

Personal data is processed based on the appropriate legal basis applicable to each processing activity, which may include the data subject’s consent or another lawful basis permitted under the Personal Data Protection Law and its Implementing Regulations. The Company does not rely on consent as the sole legal basis for all processing activities.

3. Disclosure and Sharing of Personal Data

The Company does not sell or rent users’ personal data.

Personal data may be disclosed or shared, to the extent necessary and legally permitted, with:

• Authorized service providers and partners for the purpose of delivering requested services.
• Electronic payment service providers to process transactions.
• Technology, hosting, and support service providers, in accordance with applicable legal requirements.
• Competent governmental or judicial authorities where required by law or official order.
• Other parties where disclosure is necessary to protect the rights of the Company or users, prevent fraud, or address security risks, in accordance with applicable laws and regulations.

The Company takes appropriate measures when engaging third parties to process personal data.

4. Location Data

The application may request access to the user’s location, subject to the required permission, for purposes including identifying the nearest service center, improving certain services, tracking delivery requests where necessary, and providing location-based services.

Users may control or disable location access through their device settings. Disabling location access may affect the availability of certain services that depend on location information.

5. Cookies and Similar Technologies

The application may use cookies and similar technologies that are necessary to operate services, improve performance, and analyze usage, in accordance with applicable purposes and legal requirements.

6. Data Protection and Security

The Company implements appropriate technical, organizational, and administrative measures to protect personal data against unauthorized access, use, disclosure, alteration, loss, or destruction, taking into account the nature of the data and the risks associated with its processing.

Such measures may include encryption, access controls, security monitoring, backup procedures, and protection against security threats.

However, no electronic system can be guaranteed to be completely secure.

7. Data Subject Rights

Under the Personal Data Protection Law, data subjects have, subject to applicable conditions and legal exceptions, rights that may include:

• The right to be informed of the legal basis and purposes for collecting and processing their personal data.
• The right to access their personal data in accordance with applicable requirements.
• The right to request correction, completion, or updating of inaccurate personal data.
• The right to request the destruction of their personal data where permitted by law.
• The right to withdraw consent where consent is the legal basis for processing.
• The right to request restriction of processing or object to processing where provided for under applicable laws and regulations.

Data subjects may exercise their rights by contacting the Company through the contact details provided at the end of this Privacy Policy.

8. Children’s Privacy

The application is not directly intended for children, and the Company does not knowingly collect personal data from children without an appropriate lawful basis.

If personal data relating to a child is collected in violation of applicable requirements, the Company will take appropriate measures to address the situation in accordance with applicable laws and regulations.

9. Data Retention and Disposal

The Company retains personal data for as long as necessary to fulfill the purposes for which it was collected, or for the period required by applicable laws and regulations, or where necessary to protect the Company’s or relevant parties’ rights and legitimate interests.

When the purpose for retaining the data has ended and there is no legal requirement or legitimate reason to continue retaining it, the data will be securely destroyed or anonymized in accordance with applicable legal requirements.

10. Transfer of Data Outside the Kingdom

Where the provision of services requires personal data to be transferred or disclosed to entities outside the Kingdom of Saudi Arabia, the Company will comply with the applicable legal and regulatory requirements governing cross-border transfers of personal data, including any required level of protection and safeguards under applicable laws and regulations.

11. Updates to This Privacy Policy

The Company may update this Privacy Policy from time to time to reflect changes in its services, applicable laws, or regulatory requirements.

Where material changes affect users’ rights or the way their personal data is processed, users will be notified through an appropriate means in accordance with applicable legal requirements.

Users are encouraged to review this Privacy Policy periodically.

Privacy Contact Information

Saudi Automobile Federation

Email: info@saf.com.sa

Telephone: 0138323187

Kingdom of Saudi Arabia

For privacy inquiries or requests to exercise personal data protection rights, users may contact the Company using the contact details above.