Privacy Notice

1.   Privacy Notice

1.1.           Introduction about Albilad Capital
Albilad Capital, the investment arm of Bank Albilad, was established in 2008 with a current capital of, licensed by the Saudi Capital Market Authority (License No. 08100-37) to provide dealing activities, arrangement, advisory, custody, investment management and funds operations as well as investment management of securities. Albilad Capital seeks to meet the needs of individual and institutional investors by providing innovative and Sharia-compliant investment products and services, including Investment Banking Advisory, Corporate Finance, Custody and Brokerage Services, in addition to Asset Management Services through Investment Funds and Discretionary Portfolio Management (DPM).

1.2.           Our Vision:
To be a premier choice in the capital market by providing innovative financial solutions & investment products.

1.3.           Our Mission:
Providing and developing advanced financial solutions that create value to stakeholders, in alignment with the group objectives.

1.4. Introduction
This Privacy Notice (together with our Agreements, Terms and Conditions and any other documents referred to on it) describes how Albilad Capital (hereinafter referred to as “Albilad Capital", "we", "us", or "our") the operator of this website or mobile app or service collects, uses, discloses, and protects your Personal Data and respects the privacy of Albilad Capital's channel users (herein referred to as “you" and “your". We are committed to ensuring the privacy and security of your Personal Data and comply with the applicable data protection laws in Saudi Arabia, including but not limited to the Saudi Arabia Personal Data Protection Law (KSA PDPL), the Data Management & Personal Data Protection Standards of the National Data Management Office (NDMO), and the Capital Market Authority (CMA).

1.5. Purpose
This Privacy Notice has been developed in accordance with the applicable laws and regulations to which Albilad Capital is subject, including the Saudi Personal Data Protection Law, Royal Decree No. M/148 dated 5/9/1444H, herein referred to as “PDPL".

We process your data in an appropriate and lawful manner in accordance with the applicable laws and regulations of Albilad Capital.

1.6. Objective
The objective of this Privacy Notice is to clearly outline how Albilad Capital handles Personal Data to ensure it is processed in a lawful, fair, and transparent manner. We aim to provide clear and concise information about our data processing practices, ensuring Data Subjects understand how their Personal Data is collected, used, and protected. This Privacy Notice is designed to foster trust and confidence by demonstrating our commitment to privacy and compliance with relevant data protection regulations example; NDMO, CMA. It also aims to inform Data Subjects of their rights concerning your Personal Data and how you can exercise these rights.

Acronyms and Abbreviations

Term	Definition
Customer Care / Customer Service	The support, assistance, and advice provided by a company to its customers both before and after they buy or use its products or services.
Electronic Services	Any of the services provided by Albilad Capital in connection with all Albilad Capital website.
Personal Data	Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature.
Sensitive Personal Data	Personal Data revealing racial or ethnic origin, or religious, intellectual, or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual's parents are unknown.
Data Minimization	Refers to the principle of limiting data collection and retention to the bare minimum necessary to accomplish a given purpose.
Personal Data Breach	Any incident that leads to the Disclosure, Destruction, or unauthorized access to Personal Data, whether intentional or accidental, and by any means, whether automated or manual.
Data Subject	Dat subject refers to the individual the personal data relates to.
Personal Data Processing	Any operation conducted on Personal Data by any means, whether manual or automated, including collecting, recording, saving, indexing, organizing, formatting, storing, modifying, updating, consolidating, retrieving, using, disclosing, transmitting, publishing, sharing, linking, blocking, erasing and destroying data.
Data Subject Consent	Consent of the data subject refers to any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of their personal data.
Data Protection Officer, “DPO"	A DPO is an appointed expert on data protection that informs and advises on applicable data protection laws and regulations, monitors compliance with applicable laws and regulations, and acts as a point of contact with relevant regulatory authorities.
Data Controller	A natural or legal person, public authority, agency, or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
Know Your Customer, “KYC"	Standards designed to protect financial institutions against fraud, corruption, money laundering and terrorist financing.
Transactions	Refers to any transaction involving the exchange of money, financial assets or services for monetary consideration between two or more parties.

2. Privacy Notice Statement

2.1 Collection of your Personal Data
We collect your personal data in a direct manner (such as through electronic forms, drop-down lists, and radio buttons) and indirectly, such as through cookies, automatic data collection, and website analytics. We will collect, use, store and transfer different elements of Personal Data about you through various channels, including when:

You apply for our products or services, visit our website, use our mobile application, and communicate, make a request, or provide feedback with us electronically or in person, or through third-party sources as permitted by applicable laws and regulations.
You open an investment account ( Brokerage trading account, Mutual Fund) or perform transactions and/or services provided by Albilad Capital.
You seek information from our Customer Care concerning inquiries, complaints, and disputes.
You provide investment account information such as your personal details or information concerning your identity.
When using your login credentials for online services and application,
We seek information about your credit history from credit bureaus.
We conduct necessary investigations i.e., due diligence checks, and Anti-money Laundering and Counter-Terrorism Financing (AML/CTF) checks and obtain information that we need to support our regulatory obligations, e.g., information about transaction details, and detection of any suspicious and unusual activities.
Subscribe to our service or publications.
Enter a competition, promotion, or survey.

The types of Personal Data we may collect include:

Individual identity data: such as full name, gender, date and place of birth, country of residence, and identification information like IDs that may contain a photo, details, and information from the passport, national ID, residency, and nationality.
Contact details: such as home, work or delivery address, proof of address, email address, telephone numbers.
Financial Information: Such as credit information, financial and banking information, and information obtained from other financial institutions.
Family details: Such as number of children, marital status and details of family members.
Employment and income details: Such as Annual income, monthly salary and net worth.

Technical information: information includes your internet protocol (IP) address, login data to our website/ application, browser type and version, time zone setting and location, operating system, platform, and other technology on the devices you use to access this website. We use this information for system administration or our commercial purposes.
Profile Data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback, survey responses.
Usage information: includes information about how you use our website, application, and assorted services.
Marketing and communications information: information includes your preferences in receiving marketing from us and any third-party companies on our behalf and your communication preferences.

Use of your Personal Data

We use your Personal Data or when Albilad Capital has a lawful basis or is required by the applicable laws to do so. For example, to protect the public interest and to detect and prevent cyber and financial crimes, including fraud, terrorism financing, AML, and other illegal activities.
We use the Personal Data we collect to provide our customers with investment products and services, to manage our business and customer relationships, as stipulated in our Terms and Conditions, and to offer an enriched and enhanced customer experience.
When applying for employment, your Personal Data will be processed upon submitting the application, in accordance with our Candidate Privacy Policy.
For complaints or violation reports, your Personal Data will be processed when you submit your request.
We also collect, use, and share aggregated data such as statistical or demographic data. Non-Personal Data may be derived from your Personal Data but is not considered Personal Data for the purposes of law as such does not directly or indirectly reveal your identity in any way whatsoever.
For security and safety purposes, we may use closed-circuit television (CCTV) cameras and surveillance systems on our premises. The recorded footage may be used to monitor and investigate security incidents, prevent fraud, and ensure the safety of our customers, employees, and assets.
To ensure quality control, assurance, training, and compliance purposes, we may monitor and record telephone calls, including customer service calls and calls with our representatives as well as record electronic communications, such as emails and instant messages, exchanged between you and our representatives. We will notify you if a call is being recorded, and the recorded calls will be overseen in accordance with applicable data protection laws and regulations. These measures are taken to ensure the security of our systems, prevent fraud, and maintain regulatory compliance.
We may engage with you on social media platforms to provide information, respond to inquiries, and promote our products and services. Please note that any information you post or disclose on our social media pages may be visible to the public, and you should exercise caution when sharing Personal Data or Sensitive Personal Data, as defined in the Saudi Arabia Personal Data Protection Law.
When we obtain your consent, we may use your personal data for marketing.

Disclosure of your Personal information

We may disclose your Personal Data to third parties under the following circumstances:

Where required for the purpose of providing products or services and for administrative, billing, and other business or ancillary purposes.
When disclosure is based on the Capital Market Authority's or the Committees for Resolution of Securities Disputes' request under the Capital Market Law, its Implementing Regulations, or the related laws, or based on the General Administration of Financial Investigations' or based on the relevant government authority request in accordance with the provisions of Anti-money Laundering Law and Combating-Terrorism Crimes and its Financing Law and their Implementing Regulations
When instructing service providers in or outside Albilad Capital, domestically or abroad, to process Personal Data for the permitted purposes on our behalf and in accordance with our instructions, ensuring agreements are in place as deemed relevant and applicable by the law.
When requiring services from companies in the areas of IT, platforms administration, translation of documents, support of clients, marketing, promoting our services and products, external and internal audit, storage, payment services banks and other investment companies.
When interacting with courts, law enforcement authorities, regulators, attorneys, or other parties for the establishment, exercise, or defense of a legal or equitable claim, or for the purposes of an alternative dispute resolution.
To companies who may be acting as data processors, joint-controllers, or independent controllers to Albilad Capital such as Service Providers, Financial Institutions and Regulatory bodies.

Generally, we will only disclose your Personal Data when you direct us or authorize us to do so, when we are allowed or required by applicable law or judicial or official request to do so or when your data is no longer considered as confidential.

Lawful basis of processing

AlBilad Capital relies on the following four lawful basis according to the nature of each processing activity

Contractual Necessity:

Albilad Capital processes personal data where necessary for the performance of an agreement to which the data subject is party, or to take steps at their request prior to entering into an agreement:

Opening investment accounts.
Executing instructions and financial transactions in accordance with signed agreements.
Providing investment products and services and managing billing.
Responding to inquiries and handling complaints related to services provided.
Managing the client relationship throughout the service lifecycle.

Legal and Regulatory Obligation:

Albilad Capital personal data to comply with its legal and regulatory obligations imposed under applicable laws and regulations in the Kingdom of Saudi Arabia:

Compliance with CMA requirements, its implementation regulations, and the Capital Market Law.
Implementing Know-Your-Customer (KYC) verification procedures and due diligence requirements.
Compliance with the Anti-Money Laundering Law and the Counter-Terrorism Financing Law.
Disclosure to the General Administration of Financial Intelligence and competent government authorities as required by law.
Compliance with tax reporting requirements and regulatory financial reporting obligations.
Responding to court orders and requests from competent judicial authorities.
Retaining transaction records for the periods specified under applicable regulations.

Legitimate Interests:

Albilad Capital processes personal data where necessary for its legitimate interests or those of a third party, provided such interests are not overridden by the rights and freedoms of data subjects:

Conducting statistical research and analysis to develop and improve products and services.
Managing operational risks and ensuring business continuity and systems security.
Detecting fraud and suspicious activities and protecting the Company's and clients' assets.
Conducting internal and external audits and governance and oversight activities.
Enforcing agreements and defending or bringing legal claims.
Internal administrative purposes and operational processes.

Data Subject Consent:

In cases where no other legal basis is available, the Company relies on the explicit, freely given, and specific consent of the data subject as the legal basis for processing.

Sending marketing communications and promotional advertisements via email or SMS.
Conducting optional customer satisfaction surveys and marketing research campaigns.
Sharing data with strategic partners for joint marketing purposes following consent.
Creating marketing profiles and analyzing preferences for personalization purposes.

Data Minimization

Whenever and to the extent possible, we anonymize the data which we hold about you when it is no longer necessary to identify you from the personal information which we hold about you.
Cross Border Data Transfer

In some cases, we transfer your Personal Data to countries outside of the Kingdom of Saudi Arabia, for example for global trading, some of our external third parties are based outside of the Kingdom of Saudi Arabia so processing of your Personal Data may involve a transfer of data outside of the Kingdom of Saudi Arabia on the permitted purposes.

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data.
Security of Personal Data

We maintain reasonable technical, organizational, physical, electronic, and procedural measures to ensure the security and confidentiality of your Personal Data against any unauthorized access, use, disclosure, accidental or unlawful alteration, destruction, and other unauthorized forms of processing. These measures include data encryption, access controls, firewalls, and regular security assessments. We provide our employees with training on the importance of data privacy and ensure their compliance with applicable policies and procedures. Albilad Capital has a code of conduct that includes a section on confidentiality of information, which requires every employee, contractor, or third-party vendor to keep business and internal information obtained in the course of their work at Albilad Capital confidential.
Personal Data Breach

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of any breach where we are legally required to do so. If you require further information on how we deal with a data breach, please contact us at DPO_ABIC@Albilad-capital.com.
Retention and Storage of Personal Data

We retain your Personal Data for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. When Personal Data is no longer required, we securely dispose of, anonymize or de-identify it.

In accordance with Article 18 of the Saudi Personal Data Protection Law, we are committed to destroying Personal Data once the purpose for which it was collected has been fulfilled (such as upon the termination of the client's relationship with Albilad Capital). However, Albilad Capital retains original paper documents related to client transactions as follows:
- For a period of ten years from the date of termination of the contractual relationship between the client and Albilad Capital, or from the date of completion of the transaction, in accordance with the Capital Market Authority (CMA) instructions.
- If the Personal Data is closely related to a case before a judicial authority and its retention is required for that purpose, in which case it shall be destroyed upon completion of the relevant judicial proceedings.
Please note that we retain a digital copy of the aforementioned documents. As for other types of documents and data, they shall be retained in accordance with applicable laws and regulations.
Authorizer Representative(s)

We may collect and process Personal Data about your authorized representative(s) to identify and provide our services if you have authorized another person to act on your behalf in relation to your accounts or transactions with us. It is your responsibility to ensure that you have your representative's consent to provide us with their Personal Data.
Your Rights and Choices

Under certain circumstances, you may have certain rights in relation to your Personal Data. For example, you may have:

The right to know about our contact details, the exact reason your Personal Data is being collected, the methods being used for Personal Data collection, and whether this collected Personal Data will be shared with third parties.
The right to access your Personal Data from us and obtain a copy of it in a clear and readable format, in conformity with the content of the records.
The right to request correction of, or update any Personal Data collected by Albilad Capital if it is incomplete, inaccurate, or obsolete by providing the necessary documents.
The right to request the destruction of your Personal Data collected by Albilad Capital. Noting that the reasons can range from the individual rescinding his/her consent for data collection to the data no longer serving the purpose for which it was initially collected. However, Albilad Capital may retain such information in accordance with the Policy and applicable laws.
The right to object to or restrict certain processing activities of your Personal Data and to withdraw your consent where necessary.

In case you have any inquiries about collecting and processing your personal data please contact us on: DPO_ABIC@Albilad-capital.com.

Your Responsibilities

While we take reasonable steps to protect your Personal Data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access or use of your accounts.
Minors and Disabilities Privacy

Our services are not designed for individuals under the age of eighteen (18) as such if you are resident in the Kingdom of Saudi Arabia and under the age of eighteen (18) or are a resident elsewhere and you are not yet at the relevant age of majority in the jurisdiction in which you reside, we are not permitted to deal with you directly. It is important to mention that we do not knowingly collect Personal Data from minors or disabilities without the consent of their parents or legal guardians.
Updating and Reviewing this Privacy Notice

We reserve the right to modify or update this Privacy Notice from time to time to reflect changes in our privacy practices, legal obligations, or as required by the applicable data protection laws and regulations.

We will provide notice of any material changes by posting the updated Privacy Notice on our website or by other appropriate means.
Contact us and our Data Privacy Officer

If you have any questions, concerns, or requests regarding this Privacy notice or our privacy practices, please contact us at:
Albilad Capital Company, licensed by the Capital Market Authority No. 08100-37 National Unified Number 7001855886.
Head Office: 8068 Muhammad Ibn Fuhayd – West Umm Alhamam Street – Riyadh 12329-2442 Kingdom of Saudi Arabia.
800 116 0002
www.albilad-capital.com
DPO Email: DPO_ABIC@Albilad-capital.com.