Privacy Policy

Special Services Company and its affiliated platforms

Contents

1 Purpose of Policy 2 Scope & Application 3 Definitions 4 Regulatory Responsibilities 5 Policy Details 6 Data Subject Rights 7 Electronic Marketing 8 Policy Updates 9 Contact Data Protection Officer
1

Purpose of the Policy

This Privacy Policy ("Policy") outlines the principles and procedures followed by Special Services Company and its affiliated platforms ("the Company" or "we") in collecting the personal data of individuals who use our electronic platforms or receive our services through any of our applications available within the vip.sa ecosystem (collectively, "the Platform"). Protecting your personal data is a firm priority for us, and we fully acknowledge our responsibility to handle it carefully, maintain its confidentiality and security, and comply with the legal requirements applicable in the Kingdom of Saudi Arabia. Please read this Policy carefully, as it contains essential information about how we use your data and explains your established legal rights.

2

Scope & Application

  1. This Policy applies to all platforms and applications operated by Special Services Company within the vip.sa ecosystem, and does not extend to websites of other companies or organizations that may be operated by third parties and may appear as external links. It is the user's responsibility to review the privacy policies of those parties.
  2. By visiting any of our platforms or requesting any of our services, you consent to the collection, use, and transfer of your data in accordance with the provisions of this Policy.
  3. For the purposes of personal data protection regulations, Special Services Company, registered in the Kingdom of Saudi Arabia at: 8918 Uthman Ibn Affan Road, King Salman District, Riyadh, is the controller of your personal data when you use the website or any of its platforms.
3

Definitions

Term Definition
Personal Data Any data, regardless of its source or form, that may lead to the identification or recognition of a specific person, directly or indirectly, including: name, ID number, address, contact numbers, geographic location data, vehicle plate number, and any other data of a personal nature.
Sensitive Data Personal data that reveals ethnic origin, religious, intellectual, or political belief, or biometric, genetic, or health data, or data related to criminal convictions.
Data Subject The natural person to whom the personal data relates, whether an end user or an institutional subscriber.
Legitimate Interest Any interest necessary for the Company's operations that requires the processing of personal data for a specific purpose, provided it does not override the rights and interests of the data subject.
Institutional Subscriber The entity or establishment that enters into a subscription agreement with the Company to benefit from its platform services for the benefit of its end users.
End User The individual who is the actual beneficiary of the service provided through the Company's platforms, whether directly or through the Institutional Subscriber.
4

Regulatory Responsibilities

The Company appoints a dedicated personal data protection team responsible for the following tasks:

  • Acting as a direct point of contact with the competent authority (Saudi Data & AI Authority - SDAIA) and implementing its decisions and instructions.
  • Overseeing data protection impact assessment procedures and periodic audit reports.
  • Enabling data subjects to exercise their established rights under the Personal Data Protection Law.
  • Notifying the competent authority of any personal data breach incidents in accordance with the specified regulatory procedures.
  • Responding to data subject requests and handling their complaints within the stipulated timeframe.
  • Monitoring and continuously updating processing activity records.
5

Policy Details

5.1 Data We Collect

  • End user geographic location data - solely for the purpose of managing field services and coordinating the work of the Institutional Subscriber's representatives.
  • Communication and correspondence records, including recorded customer service calls and conversations via unified business WhatsApp.
  • Information provided through subscription and registration forms on our electronic platforms and applications.
  • Technical device and connection data: IP address, device type, operating system, device ID - for system management and security purposes.
  • Responses to surveys and service evaluations when the user participates voluntarily.

5.2 Minors

The Company does not intentionally collect any personal data of persons under the age of eighteen (18) years. In the event that a minor's data is discovered to have been collected without parental consent, the Company is committed to deleting it immediately upon notification via: care@vip.sa

5.3 Cookies

The Company's platforms use cookies to distinguish users, improve the user experience, and measure platform performance. Users have the right to adjust their browser settings to control the acceptance or rejection of these files.

5.4 Data Retention Period

The Company retains personal data for the duration of the Institutional Subscriber's active subscription, plus an additional period not exceeding what is required by the legal obligations in force in the Kingdom of Saudi Arabia. Retention periods are reviewed periodically, and we will not retain any data longer than necessary. Data subjects have the right to request immediate deletion via: care@vip.sa

5.5 Disclosure of Data to Third Parties

The Company only discloses user data in the following cases:

  • Technical Service Providers:Infrastructure hosting companies and communication solution providers under binding contractual agreements consistent with the provisions of this Policy.
  • The Subscriber:Receives operational functional data related to service execution for the benefit of their end users exclusively.
  • Regulatory & Judicial Authorities:When there is a legal obligation or a judicial order issued by a competent authority.
  • In Cases of Acquisition or Merger:Data is transferred to the acquiring entity.

5.6 Data Storage & Transfer

Special Services Company is headquartered in Riyadh, Kingdom of Saudi Arabia; accordingly, the information we collect from you will be transferred, stored, and processed within the Kingdom. Some of our service providers are located outside the Kingdom - one of our service providers is located in Germany as of the date of this Policy. This may change if we decide to use different service providers; consequently, the data we collect from you may be transferred, stored, and processed in a destination outside the Kingdom of Saudi Arabia.

6

Data Subject Rights

In accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations, the data subject enjoys the following rights:

Right to be Informed

Know the purposes for which their personal data is being used.

Right of Access

Access the personal data held about them.

Right to Rectification

Request updating or correcting any inaccurate data.

Right to Erasure

Request the destruction or deletion of personal data subject to regulatory conditions.

Right to Portability

Obtain data in a clear, readable format.

Right to Withdraw Consent

At any time regarding data processed based on explicit consent.

To exercise any of these rights, please contact us at: care@vip.sa

7

Electronic Marketing

Marketing messages and communications are sent exclusively to users who have given their prior consent under this Policy, with the option to unsubscribe via: care@vip.sa. The Company uses targeted digital advertising online in general in accordance with the policies of approved advertising platforms.

8

Policy Updates

We will make changes to this Policy from time to time , to keep it up to date or to comply with legal requirements or changes in the way we operate our business. We will make sure to inform you of any significant changes by sending a message to the email address you most recently provided us or by posting a notice on the website. We encourage you to review this Policy regularly so that you are always aware of the information we collect, how we use it, and with whom we share it.

9

Contact the Data Protection Officer

Email

care@vip.sa

Phone

00966112223333

Mailing Address

8918 Uthman Ibn Affan Road,
King Salman District, Riyadh