OUR PRIVACY NOTICE

This privacy notice (“Privacy Notice”) describes how SEVEN, registered in the Kingdom of Saudi Arabia with our office located at Building S3, Riyadh Front 8942 – King Khalid International Airport, RIYADH – 13413 – 3670-Kingdom of Saudi Arabia, Tel: +966 11 219 6444, (hereinafter referred to as "we," "us," "our," or “SEVEN”) collects, uses, discloses, and protects information relating to you (your “Personal Data”) in relation to all of our digital platforms and physical locations, including our website at www.seven.sa and mobile application and or other interactive equipment we operate at our physical locations (together, “Platforms”). For the purpose of data protection laws, we are the data controller with respect to Personal Data we collect or receive from you. We are committed to ensuring the privacy and security of your Personal Data and complying with the applicable data protection laws in the Kingdom of Saudi Arabia, including but not limited to the Kingdom of Saudi Arabia Personal Data Protection Law (“KSA PDPL”) and its Implementing Regulations (the “Regulations”).

Please read this notice carefully to understand our practices regarding your Personal Data. If you do not agree with this notice in general or any part of it, you should not access the website or application or otherwise provide your Personal Data to us.

This Privacy Notice should be read alongside our Cookies Statement and Terms of Use.

Collection of Personal Data

At SEVEN, we may collect Personal Data about you through various channels, including but not limited to:

When you interact with our Platforms, including any Personal Data that you provide yourself, or that we solicit from you, through the Platforms
When you contact us, communicate with us electronically or in person.
We may also automatically collect certain Personal Data pursuant to applicable laws and regulations.

There are two ways to collect your Personal Data:

1. Directly from you, which include but not limited to:

When you register for our Services:

Your personal details, such as your first and last name, email address(es), phone number(s), address, date of birth, gender, nationality and any relevant identification numbers.
Your account login details, such as your username and the password (encrypted) that you have chosen.
Your consent on receiving the marketing communications

When you shop online, browse, use or download from our Platforms:

Information about your actual or potential online purchases (for example: what, when, where you ordered / bought and how you paid).
Information about your online browsing behavior on our Platform, public networks and information about when you click on one of our adverts.
Information about devices you have used to access our services (including the make, model, operating system, IP address, browser type, and mobile device identifiers).

When you contact us, or participate in promotions, surveys or questionnaires:

Personal Data you provide about yourself or that we may ask from you.
Details of communications we send to you include information about the emails you open and links in them that you click on.
Your feedback and contributions, including through any voice interactions with our Platforms.
We may collect and process Personal Data concerning your authorized representative(s) if you have designated another person to act on your behalf concerning our services or interactions with us. It is your responsibility to ensure that you have obtained the necessary consent from your representative(s) to provide us with their Personal Data.

2. Indirect Personal Data collection:

We may also obtain your Personal Data from other sources, such as specialist companies that supply information, online media channels, our partners, and public registers. We may collect the following types of Personal Data about you from other sources including but not limited to: contact details, purchases, interests, preferences, or other types of procured or publicly available information. This helps us to review and improve the accuracy of the data we hold about you and improve and measure the effectiveness of our operations and marketing communications, including advertising.

What are the purposes and legal bases for collecting and processing your Personal Data?

We may use or process your Personal Data for the following purposes but are not limited to:

To Make Our Services Available to You such as:

Processing your orders and refunds.
Responding to any inquiries you have about our Services.
Confirming your payment and any purchases linked to your use of our Services.
Managing the accounts you hold with us.

We process your Personal Data for the above category of purposes as necessary to be able to fulfil our contractual obligations to you and otherwise on the basis of our legitimate interest in managing our commercial relationship with you and administering our business and operations.

To Personalize Your Experience

We may use your Personal Data to personalize the marketing messages we send to you and make them more relevant. We may use your Personal Data for this purpose in the following ways:

Using your online browsing behavior as well as you're in-store and online purchases to better understand you as a customer.
Providing relevant marketing communications (including by email, post, telephone, SMS, or online advertising).
Conducting market research and statistical surveys; and
Combining Personal Data from various sources to tailor our marketing communications to your interests.

We process your Personal Data for the above category of purposes only to the extent that you give us your consent, which you can withdraw at any time.

To Contact and Interact with You

We may use your Personal Data when we communicate with you to:

Manage promotions.
Participation in invitations in customer surveys and market research activities.

To Manage and Improve Our Day-to-Day Operations

We analyze information about how you use our Services to:

Manage and improve our Platforms and Services.
Develop and improve our product range and how we communicate with you.
Detect and prevent fraud or other crime.

We process your Personal Data for the above category of purposes on the basis of our legitimate interest in managing our commercial relationship with you and administering our business and operations.

Do We Share Your Personal Data?

We may share your Personal Data with third parties under the following circumstances:

To Qiddiya subsidiaries and affiliates, on the basis of our legitimate interest in pursuing opportunities for business development, improving operational efficiency, Studying the users' behavior to offer better experience, for ticketing & payments, infrastructure and so on, unified data governance and enhanced collaboration throughout our corporate family. We may share your Personal Data with companies within our corporate family.
Our service providers and vendors on the basis of our legitimate interest in managing our business and providing services to you.
with law enforcement, government and judicial authorities for legal and security reasons and to protect our services and business or as required by law. We will share your Personal Data with regulators, law enforcement agencies, public authorities, or any other relevant organizations: (i) in response to a legal obligation; (ii) if we have determined that it is necessary to share your Personal Data to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries; (iii) for our legitimate interest in protecting the interests of, and ensuring the safety and security, of us, our users, a third party or the public; (iv) to exercise or defend legal claims; and (v) to enforce our Terms of Use, other applicable terms of service, or other agreements.

Rest assured that we ensure any third party with whom we share your Personal Data complies with appropriate data protection and confidentiality measures as mandated by the applicable laws and regulations.

Do We Transfer Your Personal Data To Other Countries?

We may transfer your personal data to countries outside of the Kingdom of Saudi Arabia, and your Personal Data may be processed by staff operating outside of the Kingdom of Saudi Arabia who work for us or one of our third-party service providers or partners. We will ensure that any such transfers comply with the PDPL and all other applicable data protection laws and regulations, including implementing adequate safeguards are in place to protect your Personal Data when the transfer is to a recipient in a jurisdiction that is not recognized by the relevant governmental authorities to have an adequate level of data protection. These safeguards may include implementing standard contractual clauses approved by relevant data protection competent authorities or relying on other legal mechanisms recognized by the competent authorities.

How We Protect Your Personal Data?

We take our responsibility to protect your Personal Data very seriously. We use physical, technical, and procedural safeguards that comply with applicable legal standards to ensure the security and confidentiality of your Personal Data from unauthorized access, use, disclosure, accidental or unlawful alteration, destruction and other unauthorized forms of processing. However, we cannot guarantee the security of your Personal Data transmitted through the website; any transmission is at your own risk.

What About Retention?

We retain your Personal Data for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. When Personal Data is no longer required, we securely dispose of, anonymize, or de-identify it.

What Are Your Rights?

• The right to access your Personal Data held by us, including reviewing it, and obtaining a copy thereof in a clear format that matches the content of the records and without financial compensation - as determined by the PDPL and its implementing regulations - without prejudice to what the Credit Information Law stipulates regarding financial compensation.

• The right to request the correction, completion, or updating of your Personal Data available to the company.

• The right to request the destruction of your Personal Data held by us when it is no longer needed, in accordance with the PDPL.

Managing Your Consent

By accessing or using the Platforms, including by providing any of your Personal Data to us through the Platforms, you hereby confirm that you have read and understood this Privacy Notice, and that you provide your consent for the processing of your Personal Data which is stated in this Privacy Notice to be based on your consent. You may withdraw your consent for any such processing of your Personal Data at any time by contacting us at described in the “Contact Us” section below, but in such case we may be unable to continue to provide to you certain services and functionalities that depend on such processing.

All marketing communications we send will provide a way to withdraw consent. However, even if you withdraw your consent for receiving marketing communications, you may still receive operational messages from us.

Please note that your rights under applicable data protection legislation may be different, if you reside outside the Kingdom of Saudi Arabia, and any such rights may be limited by law.

Do We Collect Data From Minors And Incompetent?

In accordance with applicable laws, we may process the Personal Data of data subjects that fully or partially lack legal capacity, such as minors under 18 Gregorian years of age and persons deemed incompetent under the laws of the Kingdom of Saudi Arabia, only with the verified explicit consent of their legal guardian. We will take appropriate steps to verify the identity and legal authority of the guardian. The legal guardian may exercise the rights of the minor or incompetent person under the PDPL and implementing regulations, and we will ensure that this process does not harm the such persons’ interests and that they can exercise their rights upon attaining legal capacity themselves.

Use Of CCTV And Surveillance

We process Personal Data in the context of close-circuit TV and video surveillance on the basis of our legitimate interest of ensuring security and safety (other than any “sensitive data”, such as biometric information or Personal Data revealing ethnic or racial origin, in which case we will process such “sensitive data” only as authorized or required by law, or pursuant to your express consent), and for these purposes we may use closed-circuit television (CCTV) cameras and surveillance systems on our premises. For example, the recorded footage may be used to monitor and investigate security incidents, prevent fraud, and ensure the safety of our employees, residents, visitors, suppliers.

Third-Party Links

Our website may contain links to third-party websites or services that are not operated or controlled by us. This Privacy Notice does not apply to such third-party websites or services, and we are not responsible for their privacy practices, content or their use of your information. We encourage you to review the privacy policies of those third parties before providing any Personal Data to them.

Governing Law And Jurisdiction

This Privacy Notice shall be governed by and construed in accordance with the applicable laws of the Kingdom of Saudi Arabia. Any disputes arising out of or relating to this Privacy Notice shall be subject to the exclusive jurisdiction of the courts of Kingdom of Saudi Arabia.

Please Note:

We may update this Privacy Notice from time to time and will communicate changes to registered users. We operate channels on social media sites to inform and engage with customers. We monitor comments and posts but are not responsible for third-party content. We may aggregate Personal Data to analyze patterns and improve our marketing efforts and Services.

Cookies And Similar Technologies

We use cookies to personalize your experience on our platforms improving functionality and delivering relevant advertising. Further details may be found in our Cookies Statement.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact us via Data.governance@seven.sa or by filling the Contact us form