Information Access Policy

Privacy and Data Protection

The Social Development Bank recognizes the importance of your privacy and personal data. Therefore, we are committed to keeping all sensitive information and data for all users safe, secure, and confidential.

The Social Development Bank’s Privacy Policy and e-portal procedures are governed by the Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443 AH), the Key Principles for the Protection of Personal Information, and the Key Principles and General Rules for Data Exchange issued by the Saudi Data and Artificial Intelligence Authority and the National Data Management Office.

The Personal Data Protection Law and its Implementing Regulations establish the legal framework for protecting your rights regarding the processing of personal data by all entities within the Kingdom, as well as all entities outside the Kingdom that process personal data relating to individuals residing in the Kingdom using any means, including the processing of personal data online.

The core principles of our Data Protection Policy include:

• The accountability of the entity’s head (or their representative) for the privacy policies and procedures of the data controller.
• Transparency through a privacy notice that indicates the purposes for which personal data is collected. The choice and consent obtained through implied or express approval regarding the collection, use, and disclosure of personal data prior to its collection.
• Limiting data collection to the minimum amount necessary to achieve the intended purposes.
• Use, retention, and destruction strictly for the intended purpose, retaining data for as long as necessary to achieve the intended purposes or as required by law and regulations, and destroying it securely, preventing leakage, loss, theft, misuse, or unauthorized access.
• Access to data through which any data subject can review, update, and correct their personal data.
• Restrictions on data disclosure approved by the data subject that limit third parties to the purposes set out in the Privacy Notice.
• Data security through the protection of personal data from leakage, damage, loss, theft, misuse, alteration, or unauthorized access, in accordance with controls issued by the National Cybersecurity Authority and other relevant authorities.
• Data quality after verifying its accuracy, completeness, and timeliness. Monitoring and ensuring compliance with the data controller's privacy policies and procedures, and addressing any privacy-related inquiries, complaints, and disputes.

The National Standards for Data Management and Personal Data Protection cover 15 areas of data management and personal data protection. These standards apply to all government data, regardless of format or type, including paper records, emails, data stored electronically, audio recordings, videos, maps, images, scripts, handwritten documents, and other recorded data.

The application of the Personal Data Protection Law and its Implementing Regulations does not affect the powers and responsibilities of the National Cybersecurity Authority as the competent cybersecurity authority in the Kingdom.

Privacy and Data Protection Agreement

As a user of the electronic portal and its application, you accept the privacy and data protection policies and regulations of the Kingdom of Saudi Arabia that govern the portal and its application. This agreement becomes effective immediately upon your first use or access of the portal.

If you do not agree to this policy, you must not use any of the Social Development Bank's electronic portal services.

User Data Collection

The purpose of collecting personal data is directly related to the purposes of the online portal and does not conflict with any specific provision. The methods and means of collecting personal information are appropriate to the owner's circumstances, straightforward, transparent, secure, and free from deception, misleading information, or extortion. If it becomes apparent that the collected personal data is no longer necessary to achieve the purpose for which it was collected, the Social Development Bank's online portal will cease collecting it and immediately destroy the previously collected data. Read more

The Social Development Bank's online portal will ensure that the following criteria are met before collecting your personal data:

• The justification for collecting your personal data.

• The purpose of collecting your personal data, whether all or part of it, mandatory or optional, with further information about data processing that does not conflict with the purpose of its collection or is otherwise required by law.

• The identity and reference address of the data collector, where applicable, unless for security purposes.

• The entity or entities to which the personal data will be disclosed, a description of them, and whether the personal data will be transferred, disclosed, or processed outside the Kingdom.

• The potential consequences and risks of non-compliance with the personal data collection procedure. Your privacy rights and data protection as stipulated by law.

• Other elements as defined by regulations, depending on the nature of the entity's activities.

If personal data is collected from non-owners, the following conditions will apply:

• If the data owner consents to this, in accordance with the provisions of the law.

• If the personal data is publicly available or collected from a publicly available source.

• If the entity is a public entity, and the collection of personal data is not directly owned or processed for a purpose other than that for which it was collected, such as for security purposes, to implement another system, or to satisfy judicial requirements, as defined by the regulations.

• If compliance with this prohibition would harm the data owner or affect their vital interests, as defined by the regulations.

• If the collection or processing of personal data is necessary to protect the health, safety, or well-being of the individual.

What Data Do We Collect?

When you visit the Social Development Bank's website, our servers automatically collect certain technical information, including your IP address, browser details, search engine information, geographic location, URL, and the date and time of your visit.

The Social Development Bank website may retrieve your personal data available through the Government Service Bus (GSB). Personal data refers to any information, regardless of its source or format, that directly identifies an individual or makes it possible to identify them directly or indirectly. This includes, but is not limited to, names, personal identification numbers, addresses, contact details, license and registration numbers, personal assets, bank account information, credit card numbers, photographs, video recordings, and other data of a personal nature.

The processing of personal data includes any operation performed on personal data by any means, whether manual or automated. Such operations include collection, recording, preservation, indexing, organization, formatting, storage, modification, updating, integration, retrieval, use, disclosure, transfer, publication, data sharing, interconnection, restriction, scanning, and destruction.

Cookies are small files stored on your mobile phone, tablet, or computer when you visit the Social Development Bank website.

Why Do We Need Your Data?

We use your IP address to help identify and resolve technical issues that may arise on our servers, as well as to generate statistical insights about the use of the portal, such as visitor numbers, browser and language preferences, and other usage-related information. Geographic location data enables us to provide location-based services and enhance the functionality of the platform and its applications.

Cookies help improve your experience when using the portal and allow us to better understand your needs and preferences. Accordingly, we use cookies to collect and store information about how you interact with the Social Development Bank website and related government digital services.

How Do We Process and Store Personal Data?

Your personal data will not be processed unless reasonable measures have been taken to ensure its accuracy, completeness, relevance, and currency for the purpose for which it was collected, in accordance with applicable regulatory requirements.

The Social Development Bank website implements the highest security standards to safeguard data and information. Sensitive data, as well as any information required by law to remain confidential, is encrypted and subject to additional controls and security measures.

Sensitive data includes information relating to an individual's racial or tribal origin, religious, intellectual, or political beliefs, membership in associations or civil institutions, criminal and security records, biometric and genetic data, insurance information, health records, location data, credit information, and any data indicating that one or both of an individual's parents are unknown.

Access to certain information is restricted to authorized technical personnel solely for the purpose of delivering and maintaining Social Development Bank website services in a manner that meets your needs. Your IP address is never disclosed to any party outside the Social Development Bank's authorized technical team.

In exceptional circumstances, your information may be made available to authorized government entities where required. However, it will never be made publicly available without your prior consent. Furthermore, your information will not be shared, exchanged, distributed, or sold to any third party without your prior approval.

When May We Disclose Your Personal Data?

Your personal data will only be disclosed in the following circumstances:

• When you have provided consent for the disclosure in accordance with applicable laws and regulations.

• When your personal data has been collected from a publicly available source.

• When disclosure is requested by a public authority for security purposes, to implement another legal requirement, or to satisfy judicial obligations in accordance with applicable regulations.

• When disclosure is necessary to protect public health, public safety, or the life or health of an individual or specific individuals.

• When the disclosure is limited to subsequent processing in a manner that does not identify the owner of the personal data or any other individual, either directly or indirectly.

Circumstances Where Personal Data Will Not Be Disclosed

The Social Development Bank will not disclose your personal data if such disclosure would result in any of the following:

• Threatening national security, harming the reputation of the Kingdom, or conflicting with its interests.

• Adversely affecting the Kingdom’s relations with other countries.

• Hindering the detection or investigation of a crime, compromising the rights of an accused person to a fair trial, or affecting the integrity of ongoing criminal proceedings.

• Endangering the safety of an individual or a group of individuals.

• Violating the privacy rights of another individual other than the owner of the personal data, as specified by applicable regulations.

• Conflicting with the interests of a minor or an individual lacking legal capacity.

• Breaching established professional obligations or duties of confidentiality.

• Violating a legal obligation, judicial procedure, or court order.

• Revealing a confidential source of information where disclosure would not serve the public interest.

The Social Development Bank will dispose of your personal data once the purpose for which it was collected has been fulfilled.

However, the Bank may retain such data after the purpose of collection has ended if all information that could lead to the identification of the data subject has been removed, in accordance with the controls and requirements set out in the applicable regulations.

Exceptions to Data Retention and Disposal

The Social Development Bank may retain personal data after the purpose for which it was collected has been fulfilled only in the following circumstances:

• Where there is a legal or regulatory justification requiring the data to be retained for a specified period. In such cases, the data will be destroyed upon the expiry of that retention period or once the purpose of collection has been fulfilled, whichever occurs later.

• Where the personal data is directly related to a matter before a judicial authority and its retention is necessary for that purpose. In such cases, the data will be destroyed once all judicial proceedings relating to the matter have been concluded.

Terms of Use

The Social Development Bank website is available to all users. By accessing and using this website, you acknowledge and agree to comply with these Terms of Use, as well as all applicable laws and regulations of the Kingdom of Saudi Arabia.

As a registered user, you have the right to:

• Access your personal information.

• Obtain a copy of your personal information.

• Correct or update your personal information.

• Withdraw your consent and request the deletion of your personal information by contacting us through the Contact Us page.

As the owner of the personal data, you have the right to know, including being informed of, the legal or practical basis for the collection of your personal data. You also have the right to ensure that your personal data is not processed in a manner inconsistent with the purpose for which it was collected or otherwise contrary to applicable regulations.

Furthermore, you have the right to request the destruction of your personal data held by us, without prejudice to any legal requirements or obligations that may require its retention.

User Restrictions

By accessing and using this website, you agree not to:

• Upload, post, or transmit any files, software, materials, data, or other content that is unauthorized or that may contain viruses, malicious code, or other harmful components.

• Use the website to send unsolicited or commercial emails (spam), or otherwise misuse the website in any manner.

• Publish, advertise, distribute, or circulate defamatory materials, content that violates the laws and regulations of the Kingdom of Saudi Arabia, or any other unlawful, offensive, or objectionable information.

• Use the website to engage in any illegal or unauthorized activities within the Kingdom of Saudi Arabia.

• Use the website to advertise or promote any product or service that may result in a violation of applicable laws or regulations within the Kingdom.

• Use any tool, software, device, or process that interferes with, disrupts, or may disrupt the operation or security of the website.

• Perform any action that imposes an unreasonable or disproportionately large load on the website’s infrastructure, systems, or storage resources.

Suspension and Termination of Access

The Social Development Bank reserves the right, at its sole discretion, to restrict, suspend, or terminate a user's access to the website without prior notice and for any reason, including but not limited to a violation of these Terms of Use or any conduct that is deemed unlawful or harmful to others.

During the period of suspension or termination, you will not be permitted to access or use the website.

Consent to the Processing of Personal Data

Except in circumstances permitted by law, personal data may not be processed, nor may the purpose of its processing be changed, without the consent of the data subject.

Applicable regulations determine the conditions for obtaining consent, the circumstances in which consent must be provided in writing, and the requirements related to obtaining consent from a legal guardian where the data subject is a minor or lacks legal capacity.

However, consent may not be made a condition for receiving a service or benefit unless that service or benefit is directly related to the processing of the personal data for which consent is being requested.

Standards for Comments and Electronic Participation

All comments submitted through electronic participation channels or social media platforms are reviewed to ensure compliance with the applicable standards, policies, and regulations governing public engagement.

The platform administration reserves the right to remove or reject any comment deemed inappropriate. Users are required to:

• Observe public etiquette and refrain from using offensive, inappropriate, or abusive language.

• Ensure that comments remain relevant and focused on the topic under discussion.

• Avoid bias, personal attacks, or criticism that does not contribute constructively to the discussion.

• Verify the accuracy of any references to Quranic verses or religious opinions and leave the discussion of such matters to qualified specialists.

• Refrain from publishing personal information, including contact details, within comments.

Amendments to the Terms of Use

Any amendments to these Terms of Use shall take effect immediately upon publication, unless otherwise stated.

Personal Data Breach Notification

The Social Development Bank shall notify the competent authority immediately upon becoming aware of any personal data breach, damage, loss, or unlawful access to personal data.

In addition, if such an incident is likely to result in significant harm to your personal data or your rights and interests, the Bank will notify you without undue delay.

Communications and Marketing

Except for awareness and informational materials issued by public entities, the Social Development Bank website may not use personal means of communication, including postal or email addresses, to send promotional, advertising, or awareness materials unless the following conditions are met:

• The prior consent of the intended recipient has been obtained.

• The sender provides a clear mechanism, as prescribed by applicable regulations, allowing the recipient to opt out of receiving such communications at any time.

With the exception of sensitive personal data, personal data may be processed for marketing purposes where it has been collected directly from the data subject and such processing has been agreed to in accordance with the provisions of applicable law.

Processing Personal Data for Research, Scientific, and Statistical Purposes

In addition, your personal data may be collected or processed for scientific, research, or statistical purposes without your consent only in the following circumstances:

• Where the personal data does not contain any information that directly identifies you.

• Where all identifying information is removed during the processing of the data and before it is disclosed to any other party, provided that the data is not classified as sensitive personal data.

• Where the collection or processing of personal data for such purposes is required under another law or regulation, or is necessary for the implementation of an agreement to which you are a party.

Copying Official Identification Documents

Official documents that identify the owner of personal data may not be copied or reproduced except where such copying is required under applicable regulations or when requested by a competent public authority, in accordance with the controls and procedures prescribed by law.

Transfer and Disclosure of Personal Data Outside the Kingdom

Except where strictly necessary to preserve your life, prevent, examine, or treat an infectious disease, the Social Development Bank may not transfer or disclose your personal data outside the Kingdom of Saudi Arabia unless such transfer or disclosure is required to fulfill an obligation under an agreement to which the Kingdom is a party, serves the interests of the Kingdom, or is carried out for other purposes permitted by applicable regulations, provided that all of the following conditions are met:

• The transfer or disclosure does not prejudice national security or the vital interests of the Kingdom.

• Adequate safeguards are in place to protect the personal data being transferred or disclosed and to maintain its confidentiality, with protection standards that are no less stringent than those prescribed under applicable laws and regulations.

• The transfer or disclosure is limited to the minimum amount of personal data necessary to achieve the intended purpose.

• The approval of the competent authority has been obtained in accordance with applicable regulations.

Notwithstanding the foregoing, the competent authority may exempt the Social Development Bank, on a case-by-case basis, from compliance with one of the above conditions where it determines, independently or in coordination with other parties, that the personal data will be afforded an acceptable level of protection outside the Kingdom and that such data does not constitute sensitive personal data.

Records of Personal Data Processing Activities

The Social Development Bank maintains records of personal data processing activities for a period specified by applicable regulations. Such records shall include, at a minimum, the following information:

• The contact details of the entity.

• The purpose of processing the personal data.

• The categories of personal data subjects.

• The parties to whom the personal data has been disclosed or may be disclosed.

• Whether the personal data has been transferred, or is intended to be transferred, outside the Kingdom of Saudi Arabia or disclosed to a party outside the Kingdom.

• The anticipated retention period for the personal data.

Violations and Penalties

Without prejudice to any more severe penalty prescribed under another law, the following penalties shall apply in accordance with the Personal Data Protection Law:

• Any person who discloses or publishes sensitive personal data in violation of the Law with the intent to harm the data subject or obtain a personal benefit shall be subject to imprisonment for a period not exceeding two (2) years, a fine not exceeding SAR 3,000,000, or either of these penalties.

• Any person who violates the provisions governing the transfer or disclosure of personal data outside the Kingdom of Saudi Arabia shall be subject to imprisonment for a period not exceeding one (1) year, a fine not exceeding SAR 1,000,000, or either of these penalties.

Where no specific penalty is prescribed under the Law, and without prejudice to any more severe penalty provided for under another law, any natural or legal person subject to the provisions of the Law who violates any of its provisions or implementing regulations may be subject to a warning or a fine not exceeding SAR 5,000,000. In the event of a repeated violation, the fine may be doubled, provided that it does not exceed twice the maximum prescribed amount.

The Public Prosecution shall have jurisdiction to investigate and prosecute such violations before the competent court. The competent court shall hear cases arising from the application of this provision and impose the prescribed penalties.

One or more committees, each comprising no fewer than three members, including a legal or Sharia advisor, and chaired by one of its members, shall be responsible for reviewing violations and imposing warnings or fines based on the nature, severity, and impact of the violation. The rules governing the operation of such committees, including the remuneration of their members, shall be issued by a decision of the head of the competent authority. Any person affected by a committee decision shall have the right to appeal before the competent court.

Without prejudice to the provisions of the Law, the Social Development Bank may take disciplinary action against any of its employees who violate any provision of the Law or its implementing regulations, in accordance with the applicable accountability and disciplinary procedures.

Without prejudice to the penalties prescribed under the Law, any person who suffers damage as a result of a violation of the Law or its implementing regulations shall have the right to claim compensation before the competent court for material or moral damages commensurate with the extent of the harm suffered.

Furthermore, any individual engaged in the processing of personal data shall remain bound by confidentiality obligations relating to such data even after the termination of their employment or contractual relationship.

Disclaimer

This Privacy and Data Protection Policy applies solely to the Social Development Bank website. You are advised to carefully review the applicable privacy and data protection policies when navigating to any external website through this portal.

The provisions of applicable laws and regulations shall not prejudice any right granted to the data subject or any higher level of protection provided under other legislation or international agreements to which the Kingdom of Saudi Arabia is a party.

No Liability

This portal has been developed in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia. Accordingly, the Social Development Bank does not guarantee the following:

• The accuracy or reliability of the information provided.

• Protection against external attacks, hacking attempts, or unauthorized access.

• The continuity, availability, or uninterrupted operation of the portal.

• The suitability or fitness of the portal content for any particular purpose.

• That the portal or its servers will be free from viruses or other harmful components.

• Neither the Social Development Bank nor any other government entity shall be held legally responsible for any direct or indirect loss or damage arising from the use of this portal.

Use at Your Own Risk

The portal contains links to other websites that are not operated or controlled by the Social Development Bank. Accordingly, the Bank assumes no responsibility for the content of such external websites. Any risks arising from browsing or accessing third-party websites through links provided on this portal are the sole responsibility of the user.

The portal may include links to websites or other portals that may use different tools and mechanisms to protect information and privacy. Therefore, the Social Development Bank is not responsible for the content or the privacy protection practices of such external websites. Users are encouraged to review the privacy policies of those websites.

Some Bank websites use cookies, which may enable users to access website features more efficiently. Where applicable, cookies may be used to remember login credentials and simplify access to the website. Cookies are stored on the user’s device hard drive upon acceptance and may be encrypted.

Limitation of Responsibility

Users acknowledge that online communications may be subject to interception or unauthorized access by third parties. Users also acknowledge that the portal does not alter or modify information provided by official government agencies. In addition, all applications and administrative procedures may be submitted and completed either online or in person.

The portal assumes no responsibility for any loss or damage suffered by users as a result of using or accessing the portal, including any consequences arising from information, statements, or advertisements published therein.

Furthermore, the portal shall not be held responsible for any issues arising from internet access, nor for any damage to devices or software. It shall not be liable for any misconduct or harmful comments posted by other users of the portal.

Virus Protection

Users are responsible for using appropriate antivirus software when downloading any content from the portal. The Bank shall not be liable for any loss or damage to data or user devices that may occur while using the portal or its content.

Disclaimer of Claims

The Social Development Bank website and all its services, information resources, and materials are provided for personal use only, without any representation or warranty. The portal shall not be responsible for any errors or omissions arising from the use of its content or links, whether known or unknown.

Any communications or information submitted by users through the portal are not considered confidential and are not guaranteed in terms of privacy. Furthermore, any interactive use of the portal by users does not grant any rights, licenses, or privileges.

Indemnification

Users hereby agree not to take any legal action against the Social Development Bank or its management, including all departments, employees, or authorized agents responsible for operating or maintaining the portal. This provision constitutes a legal waiver of any claims or liabilities arising from violations of the Terms of Use or applicable regulations within or outside the Kingdom of Saudi Arabia.

Copyright Notice

This portal is supervised by the Social Development Bank, a government entity aimed at increasing the contribution of small and emerging enterprises and productive families to the national economy, enhancing social services, financial planning through savings programs, and empowering non-profit organizations.

All content available on the Social Development Bank’s electronic portal is protected under applicable national laws and regulations governing publications, trademarks, and intellectual property rights. All intellectual property rights related to the portal’s content are fully protected and remain the property of the Social Development Bank.

Unless otherwise stated, users are not permitted to sell, license, lease, modify, copy, reproduce, download, publish, transmit, distribute, or create derivative works from any content of this portal without prior written consent from the Social Development Bank.

Any alteration or modification of the portal’s content is strictly prohibited. In addition, all images and media included on the portal are protected by copyright laws, and their copying or use is not permitted without prior written approval from the Social Development Bank.

Jurisdiction

Users hereby agree that any dispute or claim arising from the use of this portal shall be subject exclusively to the jurisdiction of the Kingdom of Saudi Arabia.

Privacy Policy Updates

The Social Development Bank reserves the right to update or amend this Privacy and Data Protection Policy as deemed necessary. This Policy will be revised whenever there are changes to our data and information processing practices.

Contact Us

If you have any questions about our Privacy and Data Protection Policy, or if you require assistance or wish to submit a complaint, please contact us through the “Contact Us” page.

Data Protection Regulations

• Personal Data Protection Law

• National Data Management and Personal Data Protection Standards

• Interim National Data Governance Regulations

• Anti-Cybercrime Law

• Electronic Transactions Law

• Data Subject Rights and Data Controller Obligations

• Children and Incapable Persons Privacy Protection Policy

• General Rules for the Transfer of Personal Data Outside the Kingdom

• Other relevant legislation and regulations

Key Regulatory Frameworks

• Personal Data Protection Policy: Saudi Data and Artificial Intelligence Authority (SDAIA)

• Electronic Transactions Law: Communications and Information Technology Commission (CITC)

• Anti-Cybercrime Law: Communications and Information Technology Commission (CITC)

• Essential Cybersecurity Controls: National Cybersecurity Authority (NCA)

Children and Incompetent Persons Privacy Protection Policy

The Children and Incapable Persons Privacy Protection Policy establishes the legal basis for safeguarding children and protecting their rights regarding the collection and processing of their personal data by any means. This policy is aligned with the Personal Data Protection Law, the United Nations Convention on the Rights of the Child, and its optional protocols.

The policy aims to protect children from:

• The negative impacts of inappropriate online content and widespread advertisements across the internet.

• Assisting competent authorities in protecting children from potential risks, including violence, abuse, threats, harm, or exploitation resulting from the collection and processing of their personal data through websites and digital applications.

• Ensuring a balance between potential risks and negative impacts and the need to collect and process children’s personal data.

• This policy applies to all entities (public, private, and non-profit) within the Kingdom that collect and process children’s personal data, whether manually or electronically. It also applies to all entities outside the Kingdom that collect personal data of children residing in the Kingdom through online services.

• General Rules for the Transfer of Personal Data Outside the Kingdom
  
  

The General Rules for the Transfer of Personal Data Outside the Kingdom establish the principles and standards governing cross-border transfers of personal data to ensure national sovereignty over such data, while safeguarding the privacy and rights of data subjects. These rules define the obligations of controllers and processors when transferring personal data outside the Kingdom. This framework applies to all entities (public, private, and non-profit) within the Kingdom that transfer personal data outside its borders for processing purposes.

Remove any unused applications from the network, and ensure that your antivirus software is always kept up to date.

For any inquiries or feedback regarding the Privacy Principles, you may contact us through the “Contact Us” page.