This Privacy Policy explains how the Sharqia Development Authority (the "Authority", "we") collects, processes and protects personal data across its e-services portal and the related applications and services (together, the "Platform"). By using the Platform you acknowledge that you have read this Policy and consent to the processing described in it, to the extent permitted by the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations.

1. Scope

This Policy applies to all visitors and registered users of the Platform, and to the representatives of entities and establishments who use the services provided, including traffic study permit services, traffic data requests, study and qualification permits, and business, committee and meeting management.

2. Data Controller

The controller of personal data is the Sharqia Development Authority. The Authority's data protection officer can be reached through the official contact channels published on the Platform.

3. Types of Personal Data We Collect

We collect the following data depending on how you use the Platform:

• Account data: full name, email address, mobile number, job role and the entity you belong to.
• Identity data verified through Nafath: national ID or iqama number, date of birth, nationality, and the attributes returned by the national "Nafath" service on single sign-on.
• Entity data: the establishment's legal name, commercial registration, classification, and the details of its authorised representative.
• Request and study data: the content of submitted requests, attachments, comments and correspondence between the applicant and the Authority, and the related committee decisions.
• Uploaded files: traffic studies, plans, supporting documents, and any documents required by the service.
• Technical data: IP address, browser type and operating system, pages accessed, visit times, and session identifiers and cookies.

4. Purposes of Processing and Their Legal Basis

Data is processed for the following purposes, on the legal bases shown alongside each one:

• Providing and administering the services: creating the account, verifying identity, receiving requests and running the workflow between the applicant and the competent committees. (Performance of a contractual/service relationship with the user.)
• Legal obligations: compliance with the laws and regulations issued in the Kingdom of Saudi Arabia, including retention of statutory records relating to permits and decisions. (Legal compliance.)
• Information security and auditing: fraud detection, protection of the Platform, and logging of access and change operations. (Legitimate interest in protecting the Platform and its users.)
• Communicating with the user: sending operational notifications, request status updates and security alerts. (Performance of the service.)
• Improvement and statistics: analysing usage to develop the services, in aggregate form that does not identify individuals. (Legitimate interest.)
• Optional purposes: any processing outside the scopes above is carried out on the basis of your explicit consent, which you may withdraw at any time.

5. Data Sharing and Disclosure

We do not sell or trade personal data. It may be shared, only to the extent necessary, with the following parties:

• Relevant government entities, based on their statutory mandate or under approved data exchange agreements.
• Technical service providers who process data on our behalf as "processors", under contracts that bind them to confidentiality and protection controls.
• Regulatory and judicial authorities upon a binding statutory request.
• Any other party on the basis of your prior explicit consent.

6. Data Retention Period

We retain data for as long as is necessary to fulfil the stated processing purposes, and in line with the statutory retention requirements for government records. The period varies according to the type of data and its sensitivity:

• Request, decision and permit data: retained in accordance with the official retention requirements for government documents.
• Account data: retained throughout the life of the active account, and for a reasonable period after closure for audit and compliance purposes.
• Technical logs: retained for short, limited periods for security and troubleshooting purposes.

At the end of the retention period, data is destroyed or irreversibly anonymised.

7. Your Rights as a Data Subject

The Personal Data Protection Law of the Kingdom of Saudi Arabia guarantees you the following rights, as applicable:

• The right to be informed: to know the legal basis and purpose for collecting your data.
• The right of access: to view the data we hold about you.
• The right to request correction: to amend or update any data that is inaccurate.
• The right to request destruction: to request deletion of your data where the processing is no longer necessary, within the limits of statutory retention duties.
• The right to withdraw consent: in respect of processing based on your consent.
• The right to object: to particular processing, to the extent permitted by law.

To exercise these rights, please contact us through the channels set out in clause 13 below. We will respond to your request within the period prescribed by law.

8. Cookies and Local Storage

We use cookies and similar technologies (browser local storage) for the following essential purposes:

• Session and authentication cookies: to keep you signed in and to verify your permissions on the Platform.
• Language preference: through the NEXT_LOCALE cookie, which stores your chosen language (Arabic or English).
• Session security: to detect unauthorised use attempts and protect your account.

These cookies are necessary for the Platform to function, and disabling them may cause some services to stop working.

9. Children's Data

The Platform is not directed at children under the age of eighteen. The services require full legal capacity and are aimed at representatives of entities and establishments and at adult individuals. We do not knowingly collect children's data, and if we become aware of any such data we will delete it immediately.

10. Transfer of Data Outside the Kingdom

The default principle is that data is processed and stored inside the Kingdom of Saudi Arabia. Where it is necessary to transfer any data outside the Kingdom for technical operating purposes, this is done in accordance with the controls set out in the Personal Data Protection Law and its Implementing Regulations, and with appropriate contractual safeguards.

11. Security Measures

We apply technical and administrative controls to protect personal data against unauthorised access, alteration, disclosure or destruction, including for example:

• Encryption of communications over HTTPS.
• Permission management on a least-privilege basis.
• Audit logs of access and modification operations.
• Periodic security reviews of the systems and infrastructure.

No information system is absolutely secure, and you must therefore also keep your sign-in credentials confidential and not share them with any party.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our services or in legal requirements. The updated version will be published on this page along with a revised "last updated" date, and we will notify users of material changes through appropriate channels where required.

13. Contact and Complaints

For any enquiry or request relating to this Policy, or to exercise your rights in respect of your personal data, please contact the Authority through the official channels published on the Platform. You also have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), as the competent authority for personal data protection in the Kingdom of Saudi Arabia.