Privacy Policy

1. Introduction

Arada KSA (“we”, “us”, or “our”), part of Arada Group, is committed to protecting your personal data in accordance with applicable personal data protection laws and regulatory requirements in the kingdom of Saudi Arabia, as amended from time to time, and any related guidance issued by the relevant competent authorities.

This Privacy Policy explains how we collect, use, store, share, transfer, and destroy your personal data when you use our real estate development, sales, leasing, property management, after-sales, community management, and related digital services (the “Services”), including when you enquire about, reserve, purchase, lease, or manage a property; communicate with our sales, customer care, or facilities management teams; use our website, mobile application, sales centres, communities, or other channels; or otherwise interact with us.

This Privacy Policy applies to personal data we collect from customers and prospective customers, purchasers, owners, tenants, occupants, brokers, authorised representatives, visitors to our website, mobile application, sales offices, communities, and premises, and emergency contacts provided by them.

Some of the information we process may be sensitive personal data under applicable Saudi personal data protection laws, including biometric data used for community or facility access, credit data collected in connection with financing or instalment arrangements, and precise location data. We process sensitive personal data only on the basis of your explicit consent or where applicable Saudi laws otherwise permit it. We never use sensitive personal data for marketing purposes, even if you have consented to marketing.

This Privacy Policy is made available to you for review before your personal data is collected. We encourage you to read it in full before providing your data.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Personal Data We Collect

We collect personal data that is necessary to provide and improve the Services. Depending on how you interact with us, this may include:

2.1 Identity & Contact Information

Full name, date of birth and/or age, and nationality
Saudi national identity number, Iqama number, passport number, or Gulf Cooperation Council identity document, where required for verification, registration, or check-in, and identity verification records generated through official identity-verification channels
E-mail address and phone number
Residential or billing address
Emergency contact details (where you choose to provide them)
Where you are not a Saudi national, documentation establishing your eligibility to own or lease the relevant property

2.2 Real Estate Information

Property enquiries, preferences, budgets, unit interests, reservation details, sales and purchase agreement information, lease details, handover records, NOCs, title-related documentation, and customer relationship records
Broker, authorised representative, owner, tenant, occupant, and emergency contact information where relevant to the property transaction or ongoing property management

2.3 Financial and Credit Information (sensitive personal data)

Credit data, income and source-of-funds information, financing pre-approvals, and information obtained from or shared with the Saudi Credit Bureau (SIMAH) or a financing provider, where you apply for or use instalment or mortgage arrangements
Credit data is sensitive personal data under applicable Saudi personal data protection laws. We collect it only where necessary for the transaction, only with your explicit consent or where applicable Saudi laws otherwise permit, and we never use it for marketing.

2.4 Facility Access and CCTV Information

Biometric access-control data, where used to grant access to communities, buildings, amenities, or other facilities. Biometric data is sensitive personal data and is processed only with your separate explicit consent, stored in encrypted form, and not used for any other purpose. Where you prefer not to provide biometric data, we will offer an alternative means of access.
CCTV footage captured by security cameras in sales centres, public areas, common areas, community facilities, building entrances, and other premises

2.5 Account, Billing and Payment Information

Account credentials (stored in encrypted/hashed form where applicable)
Property ownership, tenancy, occupant, or customer profile details
Payment information (processed via authorised banks and payment providers; we do not store full card numbers)
Billing history, instalment records, invoices, receipts, service charge records, and related payment correspondence
Marketing preferences and consent records

2.6 Usage, Technical and Location Data

App and website interactions (e.g., screens viewed, clicks, session duration)
Device type, operating system, app version, IP address, browser type, and device identifiers
Log data, diagnostic data, and crash reports
Location data (optional): precise location data is sensitive personal data under applicable Saudi personal data protection laws and is collected only if you enable device permissions and give your explicit consent, which you may withdraw at any time through your device settings
Cookies and similar tracking technologies (see Section 10 (Cookies & Tracking Technologies))

2.7 Customer Support and Communications

Customer care requests, maintenance requests, complaints, feedback, survey responses, and related correspondence
Records of communications with our sales, leasing, handover, facilities management, community management, finance, legal, compliance, or customer care teams

3. How We Collect Your Data

We collect your data directly from you when you:

register an account or complete a purchase, reservation, ownership, tenancy, handover, or service application
enquire about, reserve, purchase, lease, or manage a property
register for or use our mobile application, website, owner portal, tenant portal, or community platform
visit or check in at our sales centres, communities, buildings, amenities, offices, or other premises
contact us by email, telephone, online form, chat, or in person
submit customer care requests, facilities management requests, complaints, feedback forms, surveys, or competition entries

We also collect data automatically when you use our website or app (e.g., through cookies), and, where applicable, from access-control systems and CCTV cameras at our premises.

As a general rule, applicable Saudi personal data protection laws require us to collect your personal data directly from you. We collect it from another source only where permitted under applicable Saudi laws, for example where you have consented, where the data is publicly available, where we obtain it from your authorised representative or legal guardian, or where a competent authority requires it. Where we do so, we will inform you of the source and the purpose.

4. Legal Basis for Processing

We process personal data only where applicable Saudi personal data protection laws provide a lawful basis to do so. Depending on the activity, we rely on:

Performance of a contract: where processing is necessary to conclude or perform a contract to which you are a party, including your reservation, sale and purchase contract, lease, or service agreement.
Compliance with a legal obligation or a judicial or regulatory requirement: including real estate registration and tenancy registration requirements, anti-money laundering and counter-terrorist financing obligations, tax and accounting requirements, and lawful requests from competent authorities.
Legitimate interests: where processing is necessary for our legitimate interests, those interests are not overridden by your rights, and the processing does not involve sensitive personal data. We rely on this basis for purposes such as fraud prevention, network and premises security, debt recovery, and internal administration. We carry out and document a balancing assessment before relying on this basis, and you may ask us for a summary of that assessment.
Consent: freely given, specific, and informed, and recorded so that we can evidence it. Consent is not bundled with our contractual terms and may be withdrawn at any time. Where we process sensitive personal data on the basis of consent, that consent is explicit and separate.
Vital interests: where processing is necessary to protect your life or vital interests or those of another person, including in a medical or safety emergency, and where we are unable to contact you.

We do not rely on legitimate interests for any processing of sensitive personal data. Sensitive personal data is processed only on the basis of your explicit consent or another basis expressly permitted under applicable Saudi laws.

If you withdraw consent, we will stop the relevant processing unless another lawful basis applies or we are required by law to continue holding the data. We will tell you which of your data we must retain and why.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

Registering and managing your account, property enquiry, reservation, purchase, lease, ownership, tenancy, or occupant profile
Providing the Services, including property transactions, handover, after-sales support, facilities management, community management, and customer care
Verifying your identity where required by law, for transaction due diligence, or for safety and security purposes
Carrying out know-your-customer and anti-money laundering checks, source-of-funds verification, sanctions and restricted-party screening, title and real estate registration, tenancy registration, service charge records, and regulatory filings
Assessing and administering financing, instalment, and mortgage arrangements, including credit checks where you have given explicit consent
Providing customer support and handling requests, complaints, maintenance requests, or community-related matters
Processing payments and managing billing, instalments, receipts, invoices, refunds, and service charges
Sending service, transaction, community, safety, and legal notices
Sending marketing communications, where you have consented, using personal data collected directly from you
Detecting and preventing fraud, misuse, unauthorised access, and security incidents
Analysing usage to maintain, improve, and develop the Services, using anonymised data wherever possible
Analysing customer, property, and community data to understand demand, plan future projects, measure performance, and improve the products and services offered across the Arada Group, as described in Section 6.2 (Group Analytics and Business Insights)
Complying with applicable legal, regulatory, and judicial obligations in the Kingdom of Saudi Arabia

We will not process your personal data for a purpose that is materially different from the purpose for which it was collected without first informing you and, where required, obtaining your consent. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

We do not sell your personal data. We may share it only in the circumstances described below.

6.1 Within the Arada Group

The Arada Group is made-up of separate legal entities operating across real estate, hospitality, food and beverage, fitness and Wellness. We update this list whenever a new business joins the Group.

Access to your personal data within the Arada Group is limited to authorised recipients on a strict need-to-know basis and only to the extent necessary for the relevant processing purposes, including real estate sales, leasing, handover, customer care, community management, facilities management, finance, legal, compliance, IT, marketing, and corporate administration.

Where you have given separate, specific consent, we may share your contact details and marketing preferences with the Arada Group companies you have selected, so that they can send you marketing about their products, services, projects, communities, property services, events, and related offers. You give consent for each brand and each contact method e-mail, SMS, telephone, and message applications separately. Your consent to cross-Group marketing is entirely voluntary and is not a condition of any product or service we provide. The unsubscribe link in a marketing message stops marketing from the brand that sent it. Every marketing message we send includes a simple mechanism allowing you to opt out.

Health and clinical information is not shared for marketing purposes and is handled under a separate privacy policy available at at https://everwell.ae/privacy-policy/. Where an Arada Group business is established or acquired after you gave your consent, we will update the list and ask you again before that business markets to you.

6.2 Group Analytics and Business Insights

We analyse information about how our customers interact with us in order to understand demand, plan projects and communities, measure performance, and improve the products and services offered across the Arada Group.

Wherever possible, we carry out this analysis using anonymised data. take reasonable measures to ensure that anonymised data cannot be linked to, or used to identify, an individual. Once data has been anonymised in accordance with applicable Saudi personal data protection laws, it is no longer considered personal data and this Privacy Policy does not restrict our use of it.

Where Group Analytics requires identifiable personal data, we process it only in accordance with applicable Saudi personal data protection laws and on an appropriate lawful basis. We do not use sensitive personal data, including credit data, for Group Analytics unless permitted by law. Where Group Analytics involves transfers outside the Kingdom of Saudi Arabia, Section 6.9 applies. We do not disclose the underlying personal data outside the Arada Group except to our processors and service providers acting on our behalf.

6.3 Service Providers

We share data with trusted third-party service providers that help us operate the Services, such as hosting providers, customer support platforms, analytics providers, and payment providers. These parties act only on our documented instructions, are bound by written agreements imposing confidentiality, security, and compliance obligations under applicable Saudi laws, may not use your data for their own purposes, and are subject to our monitoring. We select only processors that provide sufficient guarantees of compliance with applicable Saudi personal data protection laws.

6.4 Real Estate Transaction Parties

Where relevant to a property transaction, we may share information with banks, financing providers, credit information providers, notaries, registration and municipal authorities, tenancy registration platforms, developers, brokers, and owners’ association or facilities management providers.

6.5 Government, Regulatory and Judicial Authorities

We may disclose personal data to governmental, regulatory, security, and judicial authorities where disclosure is required by law, by a judicial order, or by a lawful request from a competent authority. We disclose only the data that falls within the scope of the request, keep an internal record of each request and of what was disclosed, and notify you where we are legally permitted to do so.

6.6 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the relevant successor entity, subject to appropriate privacy protections.

6.7 Professional Advisers

We may share information with lawyers, auditors, and other professional advisers, who are bound by confidentiality obligations.

6.8 Safety and Emergency

We may share personal data with emergency services or other relevant parties where necessary to protect your vital interests or the vital interests of another person.

6.9 Transfers Outside the Kingdom

Your personal data may be transferred to, stored, or processed outside the Kingdom of Saudi Arabia, including in the United Arab Emirates, where Arada Group’s central systems and support functions are located. We make such transfers only in accordance with applicable Saudi personal data protection laws and related regulatory requirements. In particular:

we transfer only the minimum personal data necessary to achieve the purpose of the transfer, and satisfy ourselves that the transfer will not prejudice national security or the vital interests of the Kingdom;
where the destination country has not been recognised as providing an adequate level of protection, we implement appropriate safeguards permitted under applicable Saudi laws and regulations, including standard contractual clauses or binding intra-group transfer rules
;
we carry out and document a risk assessment before transfers involving sensitive personal data, or continuous or large-scale transfers, in line with applicable Saudi regulatory requirements; and
we maintain records of our transfers, the safeguards applied, and the assessments as required under applicable law.

A written data processing agreement is in place with every processor engaged to process personal data on our behalf. We do not ordinarily rely on consent as the basis for transferring personal data outside the Kingdom. Where consent is required or relied upon, we will inform you accordingly and explain any relevant risks. Where consent is used in an exceptional case, we will explain the risks to you first, and you may refuse or withdraw it.

7. Data Retention and Destruction

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, and we destroy it once that purpose has been achieved, unless a longer retention period is required by law or the data is needed to establish, exercise, or defend a legal claim. In particular:

Account data is retained for as long as your account, ownership, tenancy, occupant, or customer profile remains active. If you request deletion, we will delete or anonymise your data unless we must retain it for legal, regulatory, contractual, accounting, or security reasons.
Property transaction, title, registration, reservation, sale contract, tenancy, handover, know-your-customer, anti-money laundering, and regulatory records are retained for the period required under applicable real estate, anti-money laundering, tax, accounting, regulatory, and limitation requirements.
Credit data is retained only for as long as necessary to administer the relevant financing or instalment arrangement and to meet any statutory retention requirement and is then destroyed.
Biometric data is deleted promptly upon termination of access rights or withdrawal of consent, unless a longer retention period is required by law.
Marketing preferences are retained until you withdraw consent, unsubscribe, or delete your account, subject to any suppression-list retention required to respect your opt-out.
CCTV footage is retained for a limited period, unless required for security investigations, insurance claims, dispute resolution, or legal obligations.

Retention periods are reviewed periodically to ensure compliance with applicable law and the data minimisation principle.

When we destroy personal data we do so across our systems and backups, using methods that make the data unreadable and irretrievable, and we notify any third party with whom we shared it, except where retention is required by law or by a judicial order.

8. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

Encryption of sensitive data in transit and, where appropriate, at rest
Access controls and authentication measures, limiting staff access on a need-to-know basis
Additional safeguards for biometric and credit data, including role-based access controls, secure storage, and monitoring and audit logs
Regular staff training on data protection and confidentiality obligations
Documented incident response and breach notification procedures

If a personal data breach occurs, we will notify the relevant competent authority within the timeframe required under applicable Saudi personal data protection laws and related regulatory requirements. Where the breach is likely to cause serious harm to your data or to you, we will notify you without delay and explain what has happened and what you can do.

We also maintain the governance measures required under applicable Saudi personal data protection laws and related regulatory requirements, including records of processing activities, a designated data protection officer where required, regulatory registrations where required, data protection impact assessments before we launch products or services involving sensitive personal data or large-scale processing, and written agreements with all processors.

9. Your Data Protection Rights Under Applicable Saudi Laws

Under applicable Saudi personal data protection laws, you have the following rights regarding your personal data:

Right to be informed: to know the legal basis and purpose for collecting your personal data, how it is collected, used, stored, and destroyed, and to whom it is disclosed, before your data is collected.
Right to access: to access the personal data we hold about you.
Right to correction: to have your personal data corrected, completed, or updated where it is inaccurate, incomplete, or out of date.
Right to request destruction: to have your personal data destroyed where it is no longer needed, where you withdraw consent and no other lawful basis applies, or where it is being processed unlawfully.
Right to obtain a copy: to receive a copy of your personal data in a legible and clear format.
Right to opt out of marketing: to stop receiving marketing communications at any time, through the mechanism included in every message or by contacting us.
Right to withdraw consent: withdraw consent at any time where we rely on consent, without affecting the lawfulness of prior processing.
Right to complain: to lodge a complaint with the relevant competent authority if you believe your rights under applicable Saudi personal data protection laws have been infringed.

To exercise your rights, please contact us using the details in Section 14 (Contact Us). We will verify your identity before responding and will respond within the timeframe required under applicable Saudi laws. There is no charge for exercising your rights, unless a request is manifestly excessive or repetitive.

We may restrict a request where necessary to protect you or another person from harm, to preserve the security or confidentiality of information, or where required by another law or by a judicial requirement. If we restrict a request, we will explain why.

10. Cookies & Tracking Technologies

Our website and app use cookies and similar technologies (such as SDKs and pixels) to help provide, protect, and improve the Services. These include:

Essential cookies/technologies: required to operate the Services (for example, authentication and session management).
Analytics cookies/technologies: help us understand how users interact with the Services so we can improve performance and user experience.
Marketing cookies/technologies: used, where applicable and with your consent, to deliver and measure relevant promotional content.

You can manage cookie preferences through your browser settings and, where available, our in-app cookie preferences panel. Disabling certain cookies may impact functionality.

11. Children’s Privacy

The Services are not directed at persons under the age of 18. We may process personal data relating to minors where a parent, guardian, owner, or tenant provides information about children as occupants, residents, dependants, emergency contacts, or users of community facilities. Where personal data of a minor is processed, we do so only with the consent of a parent or legal guardian, or where required or permitted by applicable law, and we limit the data to what is necessary and to what serves the minor’s best interests. If we become aware that personal data of a child has been collected without appropriate consent, we will destroy it promptly.

12. Updates to This Policy

We may update this Privacy Policy from time to time, including to reflect changes in applicable Saudi personal data protection laws, related regulatory requirements, or guidance issued by the relevant competent authorities. The updated version will be indicated by an updated “Last updated” date and will be effective when posted. Where a change materially affects how we use your personal data, we will notify you and, where required, obtain fresh consent.

13. Language

This Privacy Policy is issued in Arabic and English. In the event of any inconsistency between the two versions, the Arabic version prevails.

14. Contact Us

If you have any questions, concerns, or wish to exercise your rights under this Policy, please contact legal@arada.com