Legal

Privacy Notice

What we collect, why, who sees it and your rights under the Personal Data Protection Law.

Version 1.0

Effective 2026-10-24

Draft — pending review by qualified Saudi counsel

This wording was drafted from the laws cited in the Al Mikial Law Firm assessment (15 October 2026). It becomes binding only once counsel has reviewed it and the operator details are completed.

At a glance

Who is responsible

The Tamreer operator is the controller; a privacy contact is listed below.

What we collect

Legal names, ID number, contact details, and the records of your holdings.

Why we use it

To run the record you and your co-owners rely on — nothing else.

Who sees it

Your co-owners and manager, assigned valuers, our hosting provider — not advertisers.

Your PDPL rights

Access, copy, correct, withdraw consent, complain to SDAIA — answered within 30 days.

Kept safe

Encrypted in transit, hashed passwords, role-based access, hash-chained audit record.

Full text

Legal references

As cited in the RBVA report; article-level checks are part of counsel review.

Personal Data Protection Law — Royal Decree M/19 (9/2/1443H), as amended by Royal Decree M/148 (5/9/1444H), and its Implementing Regulations: privacy notice, lawful basis, data-subject rights, retention, breach notification, transfers.
Saudi Data & AI Authority (SDAIA) — competent authority and guidance on privacy notices.
National Cybersecurity Authority — Essential Cybersecurity Controls.
Anti-Money Laundering Law — Royal Decree M/20 (5/2/1439H): record-keeping duties where applicable.

At a glance

Full text

1Controller and contactThe operator of Tamreer decides how your data is processed.

2Personal data we collectIdentity, contact, account, ownership and governance records, documents, technical data.

3Why we process it and on what basisTo provide the service you asked for, meet legal duties and keep the record secure.

4Who we share it withCo-owners and the manager of the same holding by design; providers under contract; authorities when required.

5Hosting and transfers outside the KingdomHosting is being aligned with PDPL transfer rules before public launch.

6How long we keep itAccount data while you are active; holding records for the life of the holding plus the statutory period.

7Your rights under the PDPLBe informed, access, obtain a copy, correct, destroy where permitted, withdraw consent, complain.

8SecurityEncryption in transit, hashed passwords, access by role, lockouts, a tamper-evident audit record.

9MinorsNo accounts for minors; their shares are recorded by a guardian.

10Cookies and local storageOne session cookie and your display preferences — no advertising or tracking cookies.

11Changes to this noticeVersioned; material changes are presented for acceptance.

Legal references