Privacy Policy

Effective 1 September 2026 Last reviewed: 14 September 2026

1Introduction & scope

Welcome to Zainab Properties ("the Company", "we", "us"). This Privacy Policy explains how we collect, use, share, and protect personal data when you use our real-estate platform, website, and services across the Kingdom of Saudi Arabia.

We comply with the Saudi Personal Data Protection Law (PDPL) issued under Royal Decree No. (M/19) of 1443H, its implementing regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA), and all other applicable KSA laws and regulations.

By using the platform, you acknowledge that you have read and consent to the processing of your personal data in accordance with this policy. If you do not agree, please do not use the platform.

2Data we collect

We collect the following categories of data to deliver safe, professional real-estate services:

A. Information you provide directly

Identity data: full name, national ID (Saudi) or Iqama number, national address, and date of birth when you create an account or sign contracts.
Contact data: e-mail address, mobile number, and current residential address.
Transaction data: details of properties offered for sale or rent, pricing, and payment schedules when you list a property or complete a deal through us.

B. Information collected automatically

Technical and usage data: IP address, browser and device type, operating system, pages visited, and session duration.
Cookie data: we use essential, functional, and analytics cookies as detailed in our Cookie Policy.

C. Information from other sources

We may verify your identity via the National Single Sign-On (NSSP) / Absher or SADAD platforms, and consult relevant authorities such as the Ministry of Justice or the Real Estate General Authority (REGA) to confirm property ownership and transaction integrity.

3How we use your data

We process personal data on the appropriate lawful basis, in particular:

Contract performance: to deliver brokerage services, match properties to your requirements, and complete sales and rentals — including registering contracts through the Ejar platform for residential and commercial leases.
Legal compliance: to comply with Anti-Money Laundering regulations, ZATCA requirements (including 15% VAT collection), and property registration processes with the Ministry of Justice.
Legitimate interests: to improve user experience, personalise property recommendations, maintain system security, and prevent fraud — always balanced against your fundamental rights and freedoms.
Consent: for sending periodic property newsletters and marketing messages by e-mail or SMS, which you may withdraw at any time.

We do not use your data for purposes inconsistent with the above without first obtaining your explicit consent.

4Sharing & disclosure

We share your personal data with the following parties and only to the extent necessary for the purposes described in this policy:

Real-estate business partners: agencies and brokers involved in your transaction, under confidentiality agreements.
Service providers: hosting, secure payment gateways, and e-mail services — all bound to approved protection standards.
Government authorities: where legally required, such as the Ministry of Justice, REGA, ZATCA, or AML supervisory authorities.

We never sell or rent your personal data to any third party for marketing purposes.

Cross-border transfers: where data is transferred outside the Kingdom, we follow the transfer safeguards of the PDPL implementing regulations, including impact assessments and protective measures.

5Data retention

We retain personal data only for as long as necessary to fulfil the purposes of processing and in line with statutory retention periods, notably:

Commercial and financial records for ten (10) years under the Commercial Books Law and ZATCA requirements.
Real-estate contract data in line with Ejar platform requirements and our brokerage records.
Marketing data until you withdraw consent or request deletion, whichever comes first.

Once the retention period ends, data is securely and permanently destroyed or anonymised.

6Your PDPL rights

The PDPL grants you the following rights, which you may exercise free of charge at any time:

The right to be informed about how your data is processed.
The right to access your data and the processing record.
The right to correct, update, or complete inaccurate or incomplete data.
The right to request destruction or deletion where retention is no longer necessary.
The right to withdraw consent at any time without retroactive effect.
The right to compensation for harm caused by a breach of the law.

To submit a request, contact us using the details below. We will respond within thirty (30) days as required by the regulations. If you are not satisfied, you may file a complaint with SDAIA.

7Data security

We implement appropriate organisational, technical, and administrative safeguards to protect your data, including:

Encryption of data in transit (TLS) and encryption of sensitive data at rest.
Strict access controls built on the principle of least privilege for data storage.
Periodic security reviews, regular penetration testing, and an incident-response plan including regulator notification where applicable.
Confidentiality and non-disclosure commitments by our staff and contractors.

Despite these measures, no electronic system is 100% secure. We advise you to keep your password strictly confidential and follow safe browsing practices.

8Contact us

For any enquiry or to exercise your rights under the PDPL, please contact us:

Company: Zainab Properties
Address: King Fahd Road, Riyadh, Kingdom of Saudi Arabia
Commercial Registration: 1010XXXXXX
REGA License No.: 12-XXXXXXX
E-mail: privacy@zainabproperties.com
Complaints: contact_us