Privacy Notice

1. Diriyah Gate Development Authority (“DGDA”) Privacy Notice

We may collect, depending on your use of the site, information about your “Personal Data”. The entity responsible for your Personal Data is Diriyah Gate Development Authority.

Diriyah Gate Development Authority is a Saudi governmental authority, established by Royal Order No. (A/295) dated 26/10/1438 A.H., address at Prince Satam bin Abdulaziz Street, AlKhuzama, Riyadh 12572, Kingdom of Saudi Arabia.

Diriyah Gate Development Authority, our affiliates (also collectively referred to as and and "us"), take your data protection and privacy responsibilities seriously.

This Privacy Notice describes how we collect, process, use, disclose and transfer your Personal Data as a "data controller"; this includes using DGDA websites and applications. A "data controller" is an entity which determines why and how Personal Data is processed.

2. Privacy Notice Updates

This notice was updated in January 2025. We reserve the right to amend it occasionally in line with legal requirements and how we conduct our business. Please check this page regularly for the latest version of our Privacy Notice.

3. Third Party Websites

DGDA Websites and Applications may link you to other websites, including those of our partners, advertisers, and affiliates. We are not responsible for how third-party websites operate or how they may process any Personal Data which you provide to them. Please check their respective privacy policies and terms of use.

We may partner with advertising networks and other online advertising providers to deliver advertisements on our behalf or on behalf of other non-affiliated parties on our websites and across the internet. These advertisements may be presented based on products and services the providers think are relevant to your interests, inferred from information collected about your browsing behavior across time on our websites and other non-affiliated sites and apps. We will always obtain your consent before engaging in such targeted advertising.

Information you post on public areas of DGDA Websites or elsewhere on the internet may be seen and used by anyone including DGDA. Please be cautious before posting such information.

4. What Personal Data We Collect and When and Why We Use it

What is Personal Data

Personal Data in this Privacy Notice means any statement, regardless of its source or form, that specifically identifies a user or makes it identifiable directly or indirectly, including but not limited to names, personal identification numbers, addresses, contact numbers, license numbers, records, personal property, bank account numbers, credit cards, still and moving user photos, and other data of a personal nature.

In this section, we describe what Personal Data we collect, how we use it and, where required under applicable laws and regulations, the legal bases for each processing activity. We do not process your Personal Data in a manner inconsistent with the purposes set out below or with applicable laws and regulations. A further description of the legal bases is set out at section 5 of this Privacy Notice. If you choose not to provide us with all or some Personal Data described below, our ability to provide services and your ability to use DGDA Websites may be affected.

Support and Online Services

If you contact us by email, forms, live chat, WhatsApp or any other provided facility with a query about our services or products, we will collect information about you (including contact details) to respond to your query/request or provide our services. This may occur when you call our customer support center or interact with our online support tools. This information includes:

• Identification data (your category, full name, whether you are a Diriyah resident or from Diriyah).
• Contact details (email address and telephone number).
• Land deed details (where applicable).
• Resume (for hiring purposes).
• Engineering office details (where applicable), address and contact information, Saudi Council of Engineers Certificate, municipality permit and commercial registration details.

These data are essential to enable us to provide the needed services. We may also keep a record of communications (including call recordings) to monitor and improve our support services and to comply with legal obligations. If you do not wish your calls to be recorded, please disconnect and contact us at [email protected].

Legal basis: Contract Performance, Legitimate Interests (to provide services and support), Legal Obligations (where applicable).

Creating registered accounts on DGDA Websites

Some sections of DGDA Websites require registration to make full use of the available services. If you register to create an account, we may process your Personal Data to manage your access to certain parts of the websites and to provide services. We collect identification (full name) and contact details (email and phone number). Any non-required information will not be retained by DGDA. We may use your Personal Data to verify identity (with your consent) and to send transactional/non-marketing account messages and maintenance notices.

Legal basis: Contract Performance, Legitimate Interests (to provide and manage your account), Legal Obligations (where applicable).

To provide you with Marketing and Advertising Communications

Subject to your preferences and with your Consent, we may market and promote our and selected partners’ products and services by post, email, SMS, social media, phone. For example, newsletters, events and promotions. For more information about direct marketing, see section 7 below.

Legal basis: Consent (for Direct Marketing), Legitimate Interest (where there is prior interaction with the targeted recipient).

Participation in DGDA as a Volunteer

If you apply to become a volunteer via DGDA Websites, we collect and use information necessary to manage your application and, if successful, your participation. This includes communications relevant to your participation. We collect: full name, gender, date of birth, city & country of residence, nationality, identification (national/Iqama ID), contact details (phone & email), health information (blood type, chronic disease, allergies), employment & education history, personal photo, and skills. These data are essential to fulfill the request.

Legal basis: Contract Performance, Legitimate Interests (to evaluate your application). For Sensitive Personal Data, we rely on Explicit Consent.

In connection with Legal or Regulatory Obligations

We may process your Personal Data to prevent fraud, protect DGDA’s business, comply with regulatory requirements or engage with regulators, which may include disclosures to third parties (to the extent permitted by law), courts and/or regulators or law enforcement in connection with enquiries, proceedings, or investigations anywhere in the world or where compelled to do so. Where permitted, we will notify you before responding, unless this would prejudice the prevention or detection of a crime.

Legal basis: Legal Obligations. For Sensitive Personal Data, we rely on Explicit Consent.

Additional Information

Sometimes we require additional Personal Data. We will explain why and how we will use it. Where we provide personalized content, we may ask your permission (Consent) to review third-party data about you (e.g., social media information) to better understand you and provide more effective personalization.

5. Legal Basis for Using Your Personal Data

• Contract Performance: to perform a contract or take steps to enter into a contract with you.
• Legitimate Interests: to fulfill our legitimate interests (or those of a third party) without prejudicing your rights.
• Legal Obligations: to comply with relevant legal or regulatory obligations.
• Consent: where we have your consent for a particular activity; you may withdraw consent at any time (see section 14).

For Sensitive Personal Data, we rely on Explicit Consent. You may withdraw your consent at any time (see section 14). Withdrawal may affect our ability to provide benefits/services that require such data. For more details on legal bases, contact us (section 14).

6. How We Share Information with Others

We work with trusted partners and may share your Personal Data for the purposes in section 4 (and in accordance with applicable laws), including: affiliates and advisors; banks and payment providers; and third parties who help manage our business and deliver services. Where permitted by law, we may share Personal Data with partners who may send you marketing and promotional information.

We may share information with government organizations and agencies (including international organizations) to comply with laws, regulations and legitimate requests by law enforcement/regulators, or where doing so is in our legitimate interests, even if not compelled by law.

In all cases, we implement necessary technical, organizational, administrative and security measures to safeguard Personal Data and only share the minimum necessary.

7. More About Direct Marketing, Profiling and Automated Decision Making

Direct marketing

We aim to keep you informed about DGDA and our products/services in line with your preferences. We usually send by email, but may contact you by phone, post, SMS, social media and/or other electronic means where appropriate.

Managing your marketing preferences

• We will only send marketing communications if you have provided your consent, including direct marketing.
• We limit direct marketing to a reasonable and proportionate level and only send what we believe is relevant to you.
• To stop receiving marketing, click the “unsubscribe” link in any electronic communication, or contact us (section 14) for other channels.
• You can change how your browser/device manages cookies used to deliver online advertising via your settings, as explained in DGDA’s Cookie Policy.
• Routinely review privacy notices and preference settings on social media platforms.

More about profiling and analytics

We may apply profiles to you based on Personal Data you provide, behavioral information (e.g., pages you interact with), demographic data, and lawfully obtained third-party/public data. Profiles may be used to enhance services, tailor content, personalize your experience, and for R&D. Where decisions are made solely by automated processing, we will only do so with your Explicit Consent. One method is installing or using cookies, see our Cookie Policy for details.

8. Transferring Personal Data Internationally

We store and process Personal Data in the Kingdom of Saudi Arabia. Your Personal Data may also be shared with and processed by entities outside KSA, in accordance with applicable laws. We only share with entities that provide an adequate level of protection by reference to adequacy decisions issued by the competent regulatory authority or where otherwise permitted by law.

In the absence of an adequacy decision, we only transfer to jurisdictions that afford the same standard of protection as provided in KSA or where otherwise permitted by law (e.g., necessary for contract performance, legal obligations, protecting vital interests) and/or we implement appropriate additional safeguards, including standard contractual clauses, binding rules, and transfer assessments. You can contact us for more information (section 14).

9. How We Protect and Store Your Information

Security

We implement appropriate technical, organizational, and administrative measures (physical, electronic, and administrative procedures) to safeguard Personal Data from loss, misuse, unauthorized access, deletion, disclosure, alteration, and destruction. Keep your device secure when using our mobile app. We cannot be responsible for misuse arising from unauthorized access to your device. If you have a password for parts of our websites/apps, keep it confidential and follow our security procedures.

Retention

We store Personal Data only as long as necessary for the purposes explained in this Privacy Notice and any permissible related purposes. In some cases, we may retain data longer (e.g., for legal, reporting, regulatory, accounting obligations; complaints or challenges; or where litigation is reasonably anticipated). Where data is no longer required, we will dispose of or anonymize it safely. For more information, contact us (section 14).

10. Your Rights

You have certain rights regarding your Personal Data. These may vary by location and applicable law and may be subject to exemptions. We respect data subject rights and have implemented measures to guarantee those rights, including access, deletion, portability, information, and correction (as applicable).

To exercise your rights or obtain more information, contact us (section 14). We will check your entitlement and respond in most cases within 30 days. Please notify us of any changes to keep your Personal Data accurate.

For residents in KSA: rights include being informed (purpose/legal basis), access, a copy, withdrawal of consent (for consent-based processing), correction/completion/updating, opt-out of marketing communications, and request destruction where DGDA no longer requires your Personal Data and it is not needed for legal obligations.

11. Information About your Dependent and Related Persons

If you provide DGDA with Personal Data about next of kin and/or related persons for emergency or other purposes, it is your responsibility to inform them, direct them to this Privacy Notice, and obtain their consent where required under applicable laws and regulations.

12. Collection of Data from Minors

If you are resident in KSA and under 18 (or below the age of majority where you reside), we are not permitted to contract with you directly. We do not knowingly collect/process Personal Data from individuals under 18. If you are under 18, speak to your parent(s)/legal guardian(s) before using DGDA Websites or services. We will verify parental/guardian consent where required by law. If you are a parent/guardian of someone under 18 who has provided us Personal Data, please contact us (section 14).

13. Limitation Of Liability

Under no circumstances shall DGDA be liable for any direct or indirect, special, incidental, or consequential damages arising from a claim of breach of this Privacy Notice. Some jurisdictions do not allow exclusion/limitation of liability for consequential or incidental damages; our liability is limited to the greatest extent permitted by law.

14. Contact Us

For questions, concerns, complaints about our compliance with this Privacy Notice and applicable laws, to withdraw your Explicit Consent, or to exercise your rights, email us at [email protected].

We will respond within (30) days. This may be extended by up to an additional (30) days if implementation requires disproportionate effort or multiple requests are received; you will be notified in advance with reasons. If dissatisfied, you may contact the Saudi Data and Artificial Intelligence Authority (SDAIA): https://sdaia.gov.sa/en/Contact/Pages/ContactUs.aspx. We encourage resolving issues with DGDA first.