Privacy Policy

1. Scope of This Policy

This policy applies to the Company’s processing of the data of its website visitors, the users of its forms, and those who contact it directly. Each of the Company’s products has its own privacy policy, published with that product.

2. Website Visitors

The website does not use cookies, analytics or tracking tools, or scripts belonging to third parties, and the fonts used on it are hosted locally.

The website hosting provider retains technical visit logs, which are created automatically with each visit and include the Internet Protocol (IP) address, the browser type, and the page requested. These logs form part of the operation of the hosting service, and the retention period for the logs available to us does not exceed 30 days, in accordance with the published documentation of the website hosting provider.

Local storage on your device is limited to saving an indication that you have closed the terms notice.

3. Registration Forms for the Company’s Products

When you complete the registration form for one of the Company’s products on the website, your data (name, center name, mobile number, and city) is collected in order to create your account in that product, and its processing thereafter is subject to that product’s privacy policy. All of this is mandatory data, and the account cannot be created without it. A verification code is sent by text message to the mobile number you entered.

4. Requests and Complaints Form

The data you enter in this form is used solely to respond to and follow up on your request or complaint.

We do not request any sensitive data (such as health, religious, or ethnic data); accordingly, please do not include it in the details box.

On submission of the form, the request number appears on the screen and is sent to your mobile by text message through a Saudi SMS provider. Please keep the request number and quote it when contacting us about the request.

• Mandatory data: request type, full name, email, country code and mobile number, and the request details. Without this data, the request cannot be received or answered.
• Optional data: center name. Omitting it does not affect the request.

Requests & complaints page

5. Direct Contact Channels

Your data may be processed when you contact us directly through the following channels: info@madaralamal.com.sa (the Company’s official channel), support@madaralamal.com.sa (the support and complaints channel), phone +966 50 038 3287, or WhatsApp, solely in order to respond to your contact. Contacting us through these channels is optional. Email may be processed outside the Kingdom. When contact is made through WhatsApp, the processing of data by the service provider is subject to that provider’s own privacy policy.

6. Purposes of Processing and Their Legal Bases

The Company processes your data for the following purposes, each on the legal basis stated for it. We do not use your data to send marketing messages.

• Running and securing the website and preventing misuse of its forms: the Company’s legitimate interest in running and protecting its website, without processing sensitive data.
• Creating your account in the product for which you register: performing the agreement to which you are a party by accepting the product’s terms before submitting the form.
• Responding to and following up on your requests and inquiries: the Company’s legitimate interest in responding to those who write to it, in a manner consistent with your reasonable expectations, and without requesting sensitive data.
• Receiving complaints and requests to exercise rights and responding to them, and complying with applicable law and the requests of competent authorities: what the law requires.

7. Sharing of Data and Transfers Outside the Kingdom

We do not sell your data. We share data with the following parties to the extent necessary to provide the service, some of which are located outside the Kingdom, and what is transferred to them is limited to the minimum necessary. These parties process the data in order to provide their services to us.

• The website hosting provider (a US company operating a worldwide network): receives the technical visit logs.
• The database provider: holds form data on servers located in Germany.
• The email provider: processes your messages addressed to us, and this processing may take place outside the Kingdom.
• A Saudi SMS provider, through a relay service in the European Union: to send a text message to your mobile containing the verification code when you register, or the request number when you submit a request or complaint.
• Competent authorities in the Kingdom: when we are obliged to disclose data to them under a law.

8. Data Retention Period and Destruction

Data from the requests and complaints form and from the contact channels is retained until the response to your request and its follow-up are completed, and thereafter for the period required of us by applicable law. As for registration data, it is retained within the account data and is subject to the product’s privacy policy. The retention period for the technical visit logs available to us does not exceed 30 days, in accordance with the published documentation of the website hosting provider. When the purpose ends, personal data that applicable law does not require to be retained is destroyed without undue delay.

9. Breach Notification

In the event of a leak affecting your data that the Company processes, where it could harm your data, rights, or interests, the Company undertakes to notify the competent authority, the Saudi Data & AI Authority (SDAIA), within a period not exceeding 72 hours of becoming aware of the incident, and to notify you without undue delay. Where the incident affects a consumer’s data, the Company also notifies the Ministry of Commerce and the data subject within three days of becoming aware of the incident, pursuant to the Implementing Regulations of the Electronic Commerce Law; this is a separate deadline from the SDAIA deadline above and does not replace it.

10. Your Rights and How to Exercise Them

You are entitled to the following: to know how your data is processed, to access it and request a copy of it, to have it corrected, to request its destruction, and to withdraw your consent whenever the processing of your data is based on it. You are also entitled to file a complaint with SDAIA if you believe that the processing of your data was carried out in breach of the law.

To exercise your right, please submit your request, without logging in, through the requests and complaints page, write to us at support@madaralamal.com.sa, or call us on +966 50 038 3287. You may be asked for what is necessary to verify your identity before the request is carried out.

The request is carried out without delay and in all cases within a period not exceeding 30 days, which may be extended once for a similar period where necessary, with advance notice to you.

Requests & complaints page

11. Updates to This Policy

This policy may be updated as the Company’s activity or applicable law develops, and the date of the latest update will be indicated at the top of the page.