Privacy and Information Confidentiality

Data Office of the Entrustment and Liquidation Center (Infath)

• Email: data@infath.gov.sa
• Address: Riyadh, Al Qirawan District, Prince Saud Bin Jalawi Street
• Phone: +966 920000100

The Entrustment and Liquidation Center (Infath) places the protection of the data of users and visitors to its platforms among its highest priorities and strives to provide high-quality services to all beneficiaries. Accordingly, the Center is committed to protecting your personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued pursuant to Royal Decree No. (M/19) dated 9/2/1443 AH and Council of Ministers Resolution No. (98) dated 7/2/1443 AH, in addition to other applicable data protection laws and regulations.

The Entrustment and Liquidation Center (Infath) collects the minimum amount of personal data from users, either directly or indirectly, through any means of communication with the Center. Such data is processed only after obtaining explicit consent, as required under applicable laws and regulations. This data may also be retained for specified periods for quality monitoring purposes, as well as for legal and regulatory purposes.

If you knowingly and voluntarily choose to provide such data to the Center, the Center collects only the minimum amount of personal data necessary to fulfill the purposes for which it was collected and uses it solely for those purposes. Personal data includes, but is not limited to:

• Data provided by users: Name, identification number (National ID, Iqama, or passport), address, country, city, contact numbers, email address, and personal records. We may share necessary data with other entities or departments to enhance the quality of the services provided. We will not share your personal data with non-government entities unless they are competent entities authorized to provide specific government services.
• Communication data Data exchanged through communications with the Center, such as beneficiary support requests, inquiries, comments, and complaints.
• Cookies and Internet Protocol (IP) address data Data collected through cookies or similar technologies, including your Internet Protocol (IP) address and details of your web browser version.
• Data received by the Center from other sources, The Center may receive data about you if you use any other websites operated by the Center or any other services it provides. The Center also works closely with other entities, including, but not limited to, government entities and any other entities that may provide the Center with information about you.

We collect and use the minimum amount of mandatory data in accordance with the Personal Data Protection Law and other relevant laws and regulations.
Types of Legal Bases:

• Explicit consent.
• Processing to achieve a legitimate interest of the data subject or the public interest, where contacting the data subject is not possible or practical.
• Processing to comply with another legal obligation or for security reasons, or as part of an existing agreement to which the data subject is a party.
• Processing is necessary for security reasons or to comply with legal requirements.

Purposes of Collection:

• Judicial and government cooperation in the liquidation and sale of assets entrusted to the Center.
• Assigning liquidation and sale tasks to technically specialized entities and overseeing their activities.
• Accessing and benefiting from the services of the Entrustment and Liquidation Center (Infath), including, but not limited to, the Infath website.
• Creating and maintaining beneficiaries’ electronic accounts.
• Managing customer relationships.
• Improving your experience as a user of our platforms and ensuring the quality monitoring of our services, including the Contact Center.
• Handling inquiries and complaints.
• Sending emails to beneficiaries that may include, but are not limited to, awareness, marketing, notifications, services, and responses, in accordance with applicable controls and subscribers’ preferences.
• Monitoring platforms to identify security threats and ensure the security of our systems, platforms, employees, users, and visitors.

Personal data is securely stored and disposed of within the Kingdom of Saudi Arabia on the servers of the Entrustment and Liquidation Center (Infath) and through secure cloud computing solutions. These servers are protected using the best available technologies in accordance with the requirements established by the National Cybersecurity Authority and other applicable laws and regulations. Data is retained for 120 months or for any period necessary to fulfill our operational responsibilities, in addition to the following cases:

• Data is retained until the purpose for which it was processed has been fulfilled and is disposed of without delay, unless a legal provision or legal basis specifies a particular retention period or there are contractual requirements. In such cases, the data is disposed of after the expiry of that period or after the purpose for which it was collected has been fulfilled, whichever is longer.
• If the personal data is closely related to a case under consideration before a judicial authority and its retention is required for that purpose, the data is disposed of after the judicial proceedings related to the case have been completed.
• The Center may retain such data after the purpose for which it was collected has been fulfilled if all information that could specifically identify the data subject has been removed, in accordance with the controls specified by the applicable regulations.

• Right to Be Informed: The data subject has the right to be informed of the legal basis for collecting their personal data and the purpose for which it is collected.
• Right to Review: The beneficiary has the right to review the personal data collection process, including the purposes and duration of processing and the entities with which such data will be shared.
• Right to Access Personal Data The data subject has the right to access their personal data held by the Center in accordance with the applicable controls and procedures.

• Right to Request Personal Data, The data subject has the right to request a copy of their personal data held by the Center or request that it be completed or updated.
• Right to Rectification of Personal Data, The data subject has the right to request the correction of personal data they consider inaccurate, incorrect, or incomplete. Such data will be reviewed and updated accordingly.
• Right to Destruction of Personal Data, The data subject has the right to request the destruction of their personal data in accordance with the applicable laws and regulations in the Kingdom, unless a legal provision specifies a particular retention period or there are contractual requirements, without prejudice to the provisions of the Law.
• Right to Withdraw Consent to the Processing of Personal Data, The data subject may withdraw their consent to the processing of their personal data at any time, unless such withdrawal affects processing activities carried out on the basis of other legal grounds.

Except where otherwise provided by law, you will not be required to pay any fees to exercise these rights.

We are committed to not selling, exchanging, or disclosing personally identifiable data. Where data is shared, it is shared only with trusted entities outside the Center that support our operational activities, in accordance with strict agreements that ensure the privacy and protection of your data, in addition to the following cases:

• Disclosure for the purpose of complying with any legal obligation or agreement, or for protecting the rights, property, and safety of the Center, its employees, or others.

• Disclosure for research purposes with entities associated with the Center’s services and activities. However, the Center will share your information and personal data for this purpose only in accordance with applicable laws and regulations and only to the extent necessary to achieve the purposes for which such information and data were collected.

• Disclosure in response to subpoenas, court orders, or any other legal process, or for the purpose of investigating, preventing, or taking action regarding unlawful activities, suspected fraudulent activities, or technical or security issues.

• Data may be shared if it has been collected from a publicly available source, or with the written consent of the data subject in accordance with applicable provisions, or where necessary to achieve a compelling public interest or to protect the interests of the data subject, or where all personal identifiers that could be used to identify the data subject have been removed.

All of our platforms are intended for use only by individuals who are at least 18 years of age. However, the Center is committed to safeguarding any data relating to individuals under the age of 18 in accordance with the highest standards and in compliance with the applicable governing policies.

The Center complies with the Personal Data Protection Law in the Kingdom of Saudi Arabia, and this Privacy Notice is governed by the applicable laws, regulations, and policies in force in the Kingdom.

This Privacy Notice has been prepared to help visitors and users understand the nature of the data collected from them when visiting the Center’s website and how such data is handled. The Center’s website management takes appropriate measures and precautions to maintain the security of the personal data it holds, ensuring protection against loss, unauthorized access, misuse, modification, and unauthorized disclosure.

Among the key measures implemented by the Center to protect visitors’ personal information are:

• Strict information security and technical measures used to prevent fraud and unauthorized access to our systems.

• Regular and periodic updates of security procedures and controls that meet or exceed industry standards.

• Training, educating, and raising awareness among the Center’s employees regarding the Personal Data Protection Law and related laws, regulations, and policies.

To help protect your personal data, we recommend the following:

• Contact us immediately if you believe that someone has obtained your username, password, or any other confidential information.

• Do not disclose any confidential information over the telephone or the Internet. Our employees are trained to respect the confidentiality of personal data and will never ask you to provide any confidential information, including, but not limited to, your password.

• Use a secure browser and a secure network, and ensure that your antivirus software is always kept up to date.

This platform and the services provided by the Entrustment and Liquidation Center (Infath) are made available for your personal use. By using the platform or any other channels of the Entrustment and Liquidation Center (Infath), you agree to this Privacy Notice and expressly consent to the storage, processing, and use of such data by the Saudi authorities. We reserve the right, at all times, to disclose any data to the competent authorities whenever necessary to comply with any law, regulation, or governmental request. Your access to and use of this platform and the services provided through it constitute your unconditional acceptance of the terms of this Privacy Notice, and such acceptance shall take effect from the date of your first use.

Visitors and users should regularly review this Privacy Notice to stay informed of any updates. The Entrustment and Liquidation Center (Infath) reserves the right to amend and update this Notice and shall not, under any circumstances, be liable for any direct, indirect, incidental, consequential, special, or exceptional damages arising from the use of, or inability to use, this platform or any other channels.

Please note that failure to complete the collection of personal data may result in potential consequences and risks, including the inability to provide the requested services appropriately or to comply with legal and regulatory obligations.

The Center’s platforms may, from time to time, contain links to and from other websites that are not affiliated with the Center. If you follow any of these links to access such websites, you should review the privacy notices of those websites. Under no circumstances shall the Center be responsible for the data collection or data protection practices adopted by such websites.

For more information on the laws, regulations, and controls referenced in this Notice, you may refer to the following:

• Personal Data Protection Law.
• Regulations and guidelines issued by the Saudi Data and Artificial Intelligence Authority.
• Anti-Cyber Crime Law.
• Controls and guidelines issued by the National Cybersecurity Authority.

The Center provides services for responding to general inquiries, media communications, and beneficiary care through its official channels, including the unified number, email, and social media channels.

• General Inquiries: info@infath.gov.sa
• Media Center: media@infath.gov.sa
• Beneficiary Care Center: care@infath.gov.sa

To Contact the Data Office:

The Data Office team is pleased to hear from you and welcomes all inquiries, questions, complaints, and requests related to the Privacy Notice, the exercise of data subject rights, or any concerns regarding the Personal Data Protection Law.

• Data Office – Infath Center
• Email: data@infath.gov.sa

If you have any concerns or believe that we have not complied with our obligations, you may submit a complaint to the Center’s Data Office.

If you are not satisfied with how we handle your complaint, if we fail to comply with the Personal Data Protection Law, or if you do not receive a response within ten (10) business days, you may submit a complaint to the competent authority (National Data Management Office):

• Saudi Data and Artificial Intelligence Authority (SDAIA): sdaia.gov.sa
• National Data Governance Platform: dgp.sdaia.gov.sa