Data Privacy Notice

General Privacy Policy

At Aljazira Bank ("the Bank", "We", "Us"), headquartered in the Kingdom of Saudi Arabia, we place the utmost importance on your privacy. This policy covers all our products and services and ensures full compliance with the Personal Data Protection Law and the standards and controls of the Saudi Data and Artificial Intelligence Authority (SDAIA). We are committed to protecting your personal information through secure mechanisms and only collect the minimum necessary data to enhance your services and overall experience, always with your explicit consent.

Data Privacy Notice

This privacy notice informs how Aljazira Bank collects, uses, stores, shares, and processes your personal data. Our goal is to offer Sharia-compliant, high-quality financial products and services, while adhering to the highest data privacy standards. We clarify the legal basis for our data processing and the security measures we take to protect your personal data from unauthorized access or any misuse or loss. Your trust in us is of paramount importance, and we are committed to transparent and responsible data handling practices, in accordance with the Personal Data Protection Law in the Kingdom of Saudi Arabia.

Location-Based Services

At Aljazira Bank, our location-based services determine your location using satellite, mobile, or other networks. These technologies may involve sharing your location data with us to offer high protection and features like finding our nearest branches or receiving location-based notifications. Your location data will not be used to identify you without your explicit consent.

Data collection

We may collect and process your personal data where necessary in accordance with the Saudi Personal Data Protection Law (see section: Lawful Basis for Processing). Collected data will be used for customized products and services of high quality. It is subject to customer awareness and consent. In case of rejection to use personal data, it may impact the ability to provide the requested products or services.

Data type that may be collected

Sources of Personal Data

In order to provide our services, we process personal data that we obtain from the following sources:

• Information provided directly by the customer through the following activities:
  • Apply for our products or services such as:
    • Accounts, cards, financing, or insurance.
  • Communicate or do business with us, such as:
    • Use our branches telephone services websites or mobile applications.
    • Entering competitions or promotions.
    • Download and use our mobile applications or website such as visiting times, internet browser types and referral sources.
    • Complete online web surveys.
  • We may collect information from other organizations or people, such as:
    • Information that is publicly available, commercially available, or shared.
    • Databases available by official authorities and government-authorized sources to update/verify your documents.
    • Get information from credit reference agencies and fraud prevention agencies to assess your creditworthiness and fraud protection.
    • Cookies and tracking technologies.
    • Authorized representatives, such as lawyers or legal guardians appointed to act on your behalf.
    • Obtaining information from other parties within Aljazira.
    • Banks and other financial institutions.
    • Verification of criminal record and data.
    • Joint account holders.
    • Any posts and interactions you have with us directly on social media channels. 

Lawful Basis for Processing

We process your personal data according to the principles outlined in the Saudi Personal Data Protection Law (PDPL) for the purposes for which it was collected. The lawful basis for processing includes:

• Contractual basis: It is the processing necessary to meet and provide any of the services contracted between Aljazira Bank and its customers, such as: conducting credit checks before processing the loan application.
• Legal basis: The purpose is to comply with the rules and regulations in the Kingdom of Saudi Arabia issued by the Saudi Data and Artificial Intelligence Authority and any legal obligations imposed by the regulatory authorities (in this case the Saudi Central Bank "SAMA") that govern the Bank's operations within the Kingdom, and the Bank is subject in all respects to its regulations.
• Legitimate interests: When the processing is necessary to achieve the legitimate Aljazira Bank, without prejudice to the rights and interests of the data subject, provided that no sensitive data is processed, for example:
  • Allow analytics to be used to improve customer experience and predict trends and patterns that in turn allow for new innovative ways to improve our services and provide you with a unique set of products and services.
  • Ensure the highest level of service and accuracy of information to our customers.
  • Better understand our clients' perspectives and act appropriately towards any feedback provided.
  • Protection against fraud through the use of dedicated tools or systems.
• Consent-based processing: Where the customer provides explicit consent to allow the processing of their personal data, for example when the customer provides consent to send us marketing communications related to the offers and services available to them.
• Automated processing: We may make decisions based on the automated processing of your personal data to improve the marketing communications you receive.
• Public interests: for processing at the requests of public bodies for the purposes of achieving public interests, public health or public safety.
• Vital interest: When data processing is necessary to protect the vital interests of the data subject or any other individual, such as in emergency situations where health or safety is at risk.
• Realized interest: When data processing is necessary to achieve a moral or material interest of the personal data subject that is directly related to the purpose of data processing, ensuring that the processing contributes to the achievement of that interest.

Data Sharing and Transfers

In alignment with the requirements of the Personal Data Protection Law, the Bank may disclose your personal data to a third party in the following cases:

• When we obtain your explicit consent, for example, we share your data with loyalty partners for marketing purposes, service providers to market products or services and promote financial investments that may be of interest to you, via channels such as telephone, email, and SMS.
• When your personal data in the domain is already in the public domain and has been collected from a publicly available source.
• When needed for security purposes, comply with another regulation, or execute a judicial or legal order such as engagement with tax authorities, and fulfill judicial requirements.
• When needed to ensure the interest of public health and public safety and the protection of the life/health of the individual(s).
• If the attributes of the data disclosed are completely anonymous and the identification of the data subject is not possible directly or indirectly, for example sharing aggregated and anonymized data with our market research suppliers.

For the legitimate interests of Aljazira Bank without affecting your rights and interests and provided that the data is not sensitive data, such as:

• Engage with a debt collection agency, credit bureau or insurance business to protect the interests of the bank and prevent fraud or other illegal practices.
• Sub-processing of some or all your contracted services with Aljazira Bank to better provide these services, including but not limited to courier companies or identity verification service providers.

Please note that Aljazira Bank provides only the minimum information required to facilitate the purpose of disclosure of personal data. Some examples of cases where the Bank never shares personal data include:

• Prejudice to the rights or safety of the individual.
• Prevent the detection of a crime.
• Violation of the privacy of any individual.
• Threatening the Kingdom's security or reputation.
• Harm the interest of any person who does not have full or partial legal capacity.

In some circumstances, the transfer of your personal data outside the Kingdom of Saudi Arabia may be required, with appropriate safeguards in place to protect your data as required by applicable law.

Data Security

At Aljazira Bank, the security and privacy of your data is one of our top priorities. We pride ourselves on implementing leading security measures to protect your personal information, including advanced cybersecurity monitoring, strict access controls, encryption, and regular security assessments to ensure your data remains safe from unauthorized access, disclosure, alteration, or destruction. To maintain an updated and technically and physically up-to-date security to protect you and the bank from loss or theft. At Aljazira Bank, we are keen to, but not limited to:

• Protection from data breaches and hacking.
• Implement the relevant controls, standards and rules issued by the National Cybersecurity Authority that include best practices and cybersecurity standards.
• Comply with the requirements imposed by the Saudi Central Bank (SAMA).

It is also worth noting that the Internet is not a completely secure space, and the bank cannot be held responsible for third parties or external links.

Data Retention

Personal data will be stored for as long as necessary to achieve the purpose for which it was collected unless it is required to retain it for a longer period to comply with another system or a legal purpose such as to comply with a judicial or court order or under rules and regulations with which the Bank complies.

When storing data, Aljazira Bank takes all reasonable steps to protect your personal data from misuse, loss, unauthorized access, modification or disclosure.

Personal data is archived in a secure environment and subject to the Bank's internal best practices and restrictions for protection.

In the event of destruction, your personal data is destroyed using secure methods such as shredding or demagnetization, or the data is anonymized to prevent individuals and their data from being re-identified. 

Data Subject Rights

You have rights regarding your personal data, including:

• Right to know: You have the right to know why personal data is collected, on what legal basis it is and for what purpose their data will be used.
• Right to access: You have the right to access and provide your personal data held by the bank in a readable and clear format, and you can exercise your rights by visiting any branch of Aljazira Bank.
• Right to rectification: You have the right to request correction of inaccurate information, to complete it if it is incomplete, or to update it if it is outdated.
• Right to destruction: You have the right to request the destruction of  your personal data, in certain circumstances, subject to data retention exceptions.
• Right to withdraw consent: You have the right to withdraw consent to the processing of your personal data at any time. Withdrawal of consent shall not affect the processing of personal data based on another legal basis as stated in this notice. You can withdraw approval through the Aljazira Bank application by entering the settings > manage notifications > turn off all notifications.

Aljazira Bank shall act upon any request for such rights within thirty (30) days without delay and shall keep a record of such requests. This period may be extended to an additional 30 days in certain circumstances, depending on the nature of the request, provided that you are informed in advance of the extension with the reasons for the delay.  

To exercise any of the above data subject rights, or have any questions or wish to contact us regarding the contents of this Privacy Notice please contact us via email:

 DataPrivacyOffice@aljazirabank.com.sa .

The supervisory authority responsible for Aljazira Bank's activities is the Saudi Central Bank (SAMA) with regard to data protection complaints.

Governing Law and Dispute Resolution: This Privacy Notice is subject to the laws and regulations in force in the Kingdom of Saudi Arabia, and any dispute thereon shall be referred to the competent courts in Riyadh for adjudication.

Social Media

Please do not share personal data on Aljazira Bank social media platforms. Contact us directly via:

https://www.aljazirabank.com.sa/ar-sa/Contact-Us

Aljazira Bank is not responsible for any personal data shared over social media platforms and shall only be communicated through the official channels. 

Marketing

We may use your personal data for marketing purposes with your consent. You can withdraw your consent to receive such marketing notification through the mobile app by following these steps: 

• Go to the Aljazira app > Settings > Notification Management > Marketing Notifications. 
• You can also submit a request to withdraw your consent by visiting Aljazira’s branches. 
• OR through the “Contact Us” Service: https://www.aljazirabank.com.sa/en-us/Bank/ContactUs

Cookies

We use cookies to monitor how people use our website. A cookie is a piece of information stored on your computer's hard drive that records how you have used a website. This helps us understand how our customers use our website so we can develop and improve it. For more information, please contact our Data Privacy Office (DPO) at DataPrivacyOffice@aljazirabank.com.sa 

Review and Updates

Keeping your personal data accurate and up to date is very important for us. Please contact us for any changes to your information during your relationship with us. If you have any questions about this Privacy Notice or require further information, please contact our Data Privacy Office (DPO) at DataPrivacyOffice@aljazirabank.com.sa .

Disclaimer

This Privacy Notice is not intended to create any contractual rights, nor does it create any obligations on us to or on behalf of any third party. Aljazira Bank assumes no responsibility for third-party websites, and this Privacy Notice will not apply. We also recommend that you review the privacy notice of any other sites.