The Personal Data Protection Law, as amended, is the first of its kind to be enacted in the Kingdom of Saudi Arabia. The Law (PDPL) was issued by Royal Decree on September 17, 2021. It regulates how employers collect, process, and store personal data about individuals residing in the Kingdom of Saudi Arabia. SHL Finance Company processes personal data under the principles set out in the Personal Data Protection Law from SDAIA. This includes having a legal basis for processing personal data, as well as ensuring that it is processed fairly, transparently and securely. The company also puts in place safeguards to protect data from loss, damage, or destruction. This notice sets out the obligations of SHL Finance Company employees, workers, and third parties. The notice also ensures the protection of our data by adhering to local and international standards and regulations. We prioritize accuracy, integrity, and security in handling personal data. Our departments implement controls and processes to protect privacy and confidentiality. Together, we support trust and compliance in data protection.
Contact details
|
What personal data is collected?
We collect your personal data as required by the service you wish to use or obtain, including the following:
- Account data: This includes the login data you filled in when registering, such as usernames, and passwords, and contact information such as phone numbers, email, and personal address.
- Personal data: Contact information, identity information, income information, education, and employment-related data, the information you provide to us by filling out any of our forms or by communicating with us, whether face-to-face, by phone, email, online, or otherwise.
- Technical data: This includes your Internet Protocol address, which is the (IP) address used to connect your personal computer to the Internet, or imaging devices to monitor our buildings.
- Financial data: includes data collected for the purposes of making payments, such as account number and credit card number.
- Health data: includes any personal statement related to an individual’s health condition, whether physical, mental, psychological, or related to his/her health services.
- Status identification data: may include data about your social status as a beneficiary of SHL Finance Company’s services.
How personal data is collected?
The company collects and processes some personal data that is obtained directly or indirectly, using different methods including:
Direct methods:
- Services: When registering in the official channels of SHL Finance Company, including mobile applications or various products or services such as checking the criminal record by organizations authorized to provide this data.
- Web applications
- Communication: When communicating with SHL Finance Company through customer service/sales channels.
- Opinion polls.
Indirect methods:
- Data provided to us by other parties such as databases available from official and governmental bodies approved to update/verify your documents
- Cookies
- The legal basis for collecting your personal data and the purpose of collecting it
After submitting your request to us through any of our channels, we have certain legal obligations to process your personal data. If you do not provide us with the required personal data, we will not be able to comply with legal or regulatory obligations and will not be able to provide our services to you.
The collection and processing of your personal data is necessary to perform services that serve the public interest, as it is collected for the following purposes:
- Enabling and providing SHL Finance Company services and meeting its requirements.
- Issuing policies and preparing studies that serve business requirements.
- Resolving and processing inquiries and complaints from beneficiaries of the company's services
- Raising the level of service performance and developing it, improving the beneficiary's experience, and ensuring the continuity of providing services with the required quality.
- Authenticating the user's identity when registering for the company's various services.
- Meet certain legal and regulatory requirements.
Automated Processing
The way we process personal data in connection with our Services may involve data collection or other automated methods to make decisions about you.
Sharing Personal Data
Under the data sharing policy issued by the National Data Management Office, we will not share your personal data with non-governmental entities unless they are authorized to perform specific government services. Or after obtaining your consent to do so.
We may share your necessary personal data with government entities for specific purposes based on a regulatory basis or a justified practical need aimed at achieving a public interest without causing any harm to national interests, the activities of entities, the privacy of individuals, or the safety of the environment, except for data and entities exempted by royal orders.
When sharing your personal data, we ensure that it is shared through a secure and reliable environment following the relevant laws, regulations, and policies. We may take additional steps to ensure the protection of your data by signing a data-sharing agreement between the company and other entities by specific terms and conditions consistent with the data-sharing principles.
Transfer of personal data outside the geographical borders of the Kingdom
In accordance with applicable regulations, your personal data will be stored and processed in a secure manner within the geographical borders of the Kingdom of Saudi Arabia, in order to ensure the preservation of the national digital sovereignty of this data unless it is in cases of transferring or processing data outside the geographical borders of the Kingdom as described in Article (Twenty-Nine) of the Personal Data Protection Law.
Protection of personal data
Protecting your personal data and ensuring that it is handled properly is a top priority for us, ensuring that personal data is only available to those authorized to access and handle it, by implementing a number of technical and organizational measures, including - but not limited to the following:
- Controlling access to systems and networks.
- Raising awareness and training employees on data protection.
- Applying appropriate security measures to protect data - such as encryption.
- Deleting and disposing of personal data when the purpose of its collection has ended in accordance with applicable laws and regulations, and in accordance with what is stated in (Article Eighteen) of the Personal Data Protection Law.
- Providing a secure physical environment for paper copies of personal data records.
Your rights regarding the processing of personal data
- The right to be informed, including being informed of the legal or practical justification for collecting your personal data, the purpose thereof, and that it will not be processed later in a manner that conflicts with the purpose for which it was collected, or in cases other than those stipulated in (Article Ten) of the Personal Data Protection Law.
- The right to access your personal data available to the company, including reviewing it, and obtaining a copy thereof in a clear format that matches the content of the records and without financial compensation - as determined by the regulations - without prejudice to what the Credit Information Law stipulates regarding financial compensation, and without prejudice to what is stipulated in (Article Nine) of the Personal Data Protection Law.
- The right to request the correction, completion, or updating of your personal data available to the company.
- The right to request the destruction of your personal data available to the company when it is no longer needed, in accordance with what is stated in (Article Eighteen) of the Personal Data Protection Law.
Please note that some or all of these rights may be subject to certain exceptions and exemptions determined by the system and will be evaluated on a case-by-case basis to ensure their suitability.
How long do we retain personal data?
We retain your personal data in accordance with the regulations and according to the purpose for which it was collected.
What is our cookie policy?
Changes to this Privacy Notice
This Privacy Notice was last updated in August 2024. We reserve the right to make changes to this Notice at any time and for any reason. Any changes or modifications will be effective immediately upon posting of the updated Notice on the Site, and you waive the right to receive specific notice of each such change or modification.
Do you have a question or complaint regarding the Privacy Notice?
In the event of any inquiry, complaint, or request regarding your rights related to the processing of your personal data or regarding what is stated in the Privacy Notice in general, you can contact the Data Management Office at SHL Finance Company via the contact form below.