Privacy Policy

The Royal Commission for Riyadh City (RCRC) is committed to protecting the privacy and personal data of visitors and users of its digital platforms, websites, and applications. RCRC aims to provide high-quality services to all beneficiaries while maintaining the highest standards of privacy and data protection. This Privacy Policy explains how RCRC collects, processes, uses, and protects data relating to visitors and users of the Riyadh Digital Innovation District (RDiD) Initiative webpage and its interest registration forms (collectively, the “RDiD Initiative Website”).

Please read this Privacy Policy carefully to understand your rights regarding your personal data and how we handle it. This policy and the information below are part of the RDiD Initiative Website’s Terms and Conditions of Use.

If you have any questions, comments, requests, or would like more information about this Privacy Policy, please feel free to reach us via the “Contact Us” form. We may change this Privacy Policy from time to time, and we will post any changes on this page. Any amendment or update to any of the provisions of this Privacy Policy will be effective immediately upon posting, and you should regularly check this page for updates.

Acceptance of the Privacy Policy

This policy was prepared in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443 AH, amended by Royal Decree No. (M/148) dated 05/09/1444 AH, and its implementing regulations. Therefore, your use of the RDiD Initiative Website constitutes your agreement to this Privacy Policy, and the data you enter may be processed or shared with other parties for legitimate purposes based on a legal basis, a justified operational need, or to verify the accuracy of the data, in a manner that serves the RCRC’s interest and the public interest without causing harm to the activities of other entities, the privacy of individuals, or environmental safety.

Legal Basis for Processing Personal Data

Personal data is processed or shared with other parties based on your consent to this Privacy Policy. You may withdraw this consent at any time unless there is another legal basis. To do so, you can contact us via the “Contact Us” form.

Mandatory Data Collection

Essential data is collected to enable users to benefit from the services of the RDiD Initiative Website, and its use is limited to the specific purposes for which it was collected. This includes data submitted when creating your profile or your establishment’s profile, including — but not limited to — your personal and professional data, your establishment’s commercial registration and regulatory licenses, your employment data, and your establishment’s financial and credit data (if you are applying on behalf of a company). Such data is also verified with the relevant government authorities and private entities.

Optional Data Collection

Additional data may be requested to improve the user experience, but providing it remains entirely optional and does not affect access to or use of the services of the RDiD Initiative Website.

By agreeing, I fully and comprehensively authorize the Royal Commission for Riyadh City – upon submission of the application – to inquire about and verify any of my personal and professional data (if applying as a talent), and the commercial, employment, financial, and credit data of my establishment (if applying on behalf of a company), with the relevant government authorities and private entities.

The Purpose of Collecting and Using Data

We use this data to evaluate your application within the scope of the Royal Commission for Riyadh City’s mandate and responsibilities under its governing law, and in furtherance of the objectives of the Riyadh Digital District Initiative to attract technology companies and global talent and enable them to establish, operate, and grow from Riyadh. This includes the preparation of studies and indicators, responding to requests from regulatory, judicial, and security authorities, verifying user identities and the accuracy of data, customizing, developing, and improving the services we currently provide or may provide in the future to suit your interests or needs, applying the Terms of Use, communicating with you, and keeping you informed of the latest developments regarding our products, services, events, news, and other information, to ensure our services are provided in a manner appropriate to your interests.

Categories of Personal Data That Are Collected

You can provide us with your personal data when registering through the Company Interest Registration form or the Talent Interest Registration form, submitting your application, contacting us through the “Contact Us” form, email, phone, social media, or otherwise, or by subscribing to our mailing lists or notification service, as follows:

First: Data Submitted by Company Applicants

• Company name and official website.
• Sector or field of activity.
• Type of products or services the company offers.
• Number of employees and annual sales volume.
• Areas of interest in the Initiative.
• Contact person details: first and family name, job title, email address, and mobile number.
• The company’s business plan or pitch deck (PDF or PPT format).

Second: Data Submitted by Talent Applicants

• First and family name, and nationality.
• Email address and mobile number.
• Field of work, and LinkedIn and GitHub profile addresses (if any).
• Years of professional experience.
• CV/resume (Docx or PDF format).

Third: Data Obtained from Other Parties (at later stages of application review, not at initial registration)

• Commercial data and the establishment’s commercial registration data.
• Employment and professional data.
• Licensing and regulatory accreditation data.
• The establishment’s financial and credit data (for company applicants).
• Entity or country of establishment.
• Analysis of data related to your expression of interest in the Riyadh Digital District Initiative.

Fourth: Cookie Data

Fifth: Location Data

We will only use your personal data collected from you in the manner specified in this policy or for the purposes stipulated by the Personal Data Protection Law and its implementing regulations.

I also acknowledge that all data, information, and documents submitted by me are true, complete, and reflect reality, and I have not concealed any information I was asked to disclose. I undertake to update this information immediately upon any change occurring during the application review period and until the final decision is issued on my application.

Technical Data

When you visit the RDiD Initiative Website, we automatically collect data sent to us by your computer, mobile phone, or any other device you use to browse. This data includes your Internet Protocol (IP) address and device data, including, but not limited to, your device identifier and name, operating system type, mobile network data, and standard browsing data such as the type of browser used and the pages you visit.

We collect the above data to ensure that the RDiD Initiative Website’s content and services are delivered in a manner appropriate to your interests and device capabilities, to improve the user experience, enhance performance, detect and fix errors, analyze data, conduct tests and research, perform statistical and investigative analysis, maintain information security across the internet, measure and understand the effectiveness of the content we provide to you and others, and resolve any problems that arise on our servers.

Secure Data Processing

We are committed to protecting and securely handling the personal data entrusted to us in accordance with this policy. We also implement the necessary physical, administrative, and technical controls, measures, and safeguards to protect your personal data against loss, theft, unauthorized use, unlawful access, or alteration. However, the security of the internet cannot be guaranteed absolutely, and therefore, we cannot confirm or guarantee the security or protection of any personal data submitted through the RDiD Initiative Website, by email, or by other means. Accordingly, any processing of data through the RDiD Initiative Website is done at your own risk.

Cookies

The RDiD Initiative Website uses cookies for the purposes of personalizing content and ads, providing social media features, and analyzing website traffic. We also share data about your use of the RDiD Initiative Website with our social media partners, advertising agencies, and data analytics companies, who may combine it with other data you have provided to them or that they have collected from your use of their services.

Geographic Location

We may occasionally ask you to consent to the determination of your geographical location, and your consent to this constitutes explicit consent to the use of your location data to facilitate your use of some of the services provided on the RDiD Initiative Website.

Personal Data Protection

Access to your personal data is restricted to authorized public officials whose positions permit them to access it, and it will not be made publicly available under any circumstances without your prior consent. Furthermore, we will not share, trade, or sell any of this data to any other party without your prior consent, and access to your data will be restricted to authorized employees and experts providing the services of the RDiD Initiative Website.

How Long Will Your Personal Data Be Stored?

We will retain your personal data until the purpose for which it was collected, as explained above, has been fulfilled. Thereafter, we will retain it and remove anything that could specifically identify you, in accordance with the controls specified by the regulations and to the extent necessary to fulfill our legal obligations, resolve disputes, or enforce our policies. Following the end of your use of the RDiD Initiative Website, we will store your data in aggregated and anonymized form.

Where Is Your Personal Data Stored?

Data is processed and stored at STC’s data center in Jeddah, operating within a cloud environment based on OpenStack (bluvalt). It may also be processed by a third party in accordance with applicable regulations. We will take all necessary steps to ensure your personal data is handled securely and in accordance with this Privacy Policy.

How to Destroy Data

We are committed to protecting your personal data and ensuring it is processed according to the highest security standards. Once the purpose for which it was collected or processed has been fulfilled, upon satisfying the regulatory requirements for its destruction based on your request, or as soon as your personal data is no longer necessary for the purposes for which it was collected, the necessary measures will be taken to securely destroy your data. We use several methods to ensure the secure destruction of data, as follows:

• Digital Data: Digital data will be deleted or destroyed from our databases and storage systems in a way that ensures it cannot be recovered or accessed again. This includes deleting electronic files using permanent deletion technologies.
• Paper Data: For data collected in the form of paper documents, it will be destroyed by shredding the documents using approved paper shredding machines to ensure that it cannot be recovered or reused.

Sharing and Disclosing Personal Data

The RCRC is committed to protecting your personal data and handling it in accordance with the highest standards of privacy and data security. Some necessary data may be shared with relevant government entities in accordance with SDAIA’s Data Sharing Policy, for legitimate purposes, legal requirements, or justifiable operational necessities, such as verifying the accuracy of submitted data in a manner that serves the RCRC’s interest and the public interest, while ensuring that national interests, the activities of other entities, the privacy of individuals, and environmental safety are not harmed.

Access to your data is also restricted exclusively to authorized employees within the RCRC whose job duties require access to it to provide services. In the event of cooperation with other entities based on agreements or memoranda of understanding, data is exchanged for the agreed-upon legitimate purposes within a secure and reliable environment, in accordance with the policies and controls adopted by the Royal Commission for Riyadh City and the regulatory framework for data sharing issued by the Saudi Data & Artificial Intelligence Authority (SDAIA).

We will share your data with law enforcement agencies, public government entities, or other organizations and entities if required in accordance with the provisions specified by law, and you undertake to release the RCRC and all concerned parties from any liability related to the confidentiality of the data, as long as this data is used exclusively in the context of reviewing your application.

Potential Consequences of Not Completing the Collection of Personal Data

• Operational Disruption: Incomplete or inaccurate data may disrupt the internal and external operations and procedures of the RDiD Initiative Website, negatively impacting the services provided.
• Impaired Decision-Making Ability: Failure to collect data properly may impair the ability to make informed, evidence-based decisions.
• Loss of Opportunities: Failure to complete the necessary data collection may result in the loss of potential business opportunities, missed contracting opportunities, and the loss of the ability to develop new services or products.

I understand and acknowledge that if it is found that I have provided incorrect or false information, concealed information, or failed to update my data, the RCRC has the full right to take all regulatory measures against me, including: rejecting my application and canceling any approval, permit, or registration issued based on my application. The RCRC also has the right to verify my eligibility and examine the data and documents submitted by me through all lawful means. This acknowledgment constitutes my written consent to the RCRC or its authorized representative to obtain all relevant data concerning me from the competent government authorities and private entities.

Your Rights Regarding the Processing of Your Personal Data

Under the Personal Data Protection Law, which explicitly stipulates the rights of personal data subjects, the Royal Commission for Riyadh City enables you to exercise the following rights:

• The Right to Know: This includes informing you of the legal basis for collecting your personal data, the purpose of such collection, and that your data will not subsequently be processed in a manner inconsistent with the purpose for which it was collected, or in circumstances other than those stipulated in Article (10) of the Personal Data Protection Law.
• The Right to Access Your Personal Data: You have the right to request a copy of your personal data in accordance with regulatory requirements, by contacting us through the “Contact Us” form, and it will be provided to you within thirty days.
• The Right to Correct Your Personal Data: You have the right to request the modification and updating of your personal data if it is inaccurate, incorrect, or incomplete, by contacting us through the Contact Us form. It will be reviewed, updated, and you will be notified of this within thirty days.
• The Right to Destroy Your Personal Data: You have the right to request the destruction of your personal data in accordance with regulatory requirements, by contacting us through the Contact Us form.
• The Right to Withdraw Your Consent to the Processing of Personal Data: You have the right to withdraw your consent to the processing of your personal data at any time, unless there are regulatory grounds requiring otherwise, by contacting us via the Contact Us form.

Other Sites

This Privacy Policy applies only to the websites, portals, platforms, and applications of the Royal Commission for Riyadh City. When you visit another website through our digital channels, you must review that website’s privacy policy to familiarize yourself with its information security standards and privacy policy. The RCRC accepts no responsibility or liability for any of the policies of these other websites and disclaims all liability for any harm you may incur through these websites.

Tools and External Parties

We may use third-party analytics tools, such as Google Analytics, to help us understand how users interact with the RDiD Initiative Website so that we can improve the services and the user experience. These third parties may use data about your visits to the RDiD Initiative Website and other websites to provide visit data regarding the user experience and services that interest you. You can read the privacy policies of other websites, and we are not responsible for their data collection mechanisms or policies.

Alerts, Announcements, and Newsletters

We may occasionally send you alerts, announcements, or newsletters (for example, messages related to security, privacy, or Initiative updates).

I agree to receive all notifications from the RCRC through registered electronic means, including, but not limited to, email, telephone number, and my account on the electronic portal. I assume full responsibility for monitoring these channels, and any notifications sent through these means shall constitute official notice. I understand that submitting an application does not guarantee its approval, and that the RCRC will review it and take such action as it deems appropriate in accordance with the approved procedures and controls. My application may be canceled if I cease to meet any of the eligibility requirements during the review period. Accordingly, I acknowledge my full legal responsibility for all of the above and agree to all the terms set forth in this acknowledgment and authorization.