Privacy Policy

1. Introduction

This policy explains the personal data that will be collected, the purpose of the collection, the method and mechanism of collection, means of storage, how data is processed and destroyed, the rights of the data subject and how to exercise them, and how to contact the Company.

"Hawyia Units" is a trademark owned by Hawyia Auctions Company, a company established in the Kingdom of Saudi Arabia (hereinafter referred to as "the Company"), whose activities include providing real estate services and conducting real estate auctions. The Company is committed to maintaining the confidentiality of information and using it in accordance with applicable regulations and this policy.

By agreeing to and using the website or the purposes referred to in this policy, you acknowledge that you have read, understood, and agreed to this Privacy Policy.

2. Personal Data Processed by the Company

2.1 Data Processed by Service

The Company processes the following personal data:

1. Personal Information (mandatory)

   • Full name
   • Date of birth
   • ID number
   • Commercial registration
   • Email address
   • National address

2. Mobile Number (mandatory)

3. Login Information (mandatory)

   • Username
   • Password

4. Bank Account Information (mandatory)

5. Employment Information (mandatory)

   • Job title
   • Employer

6. Cookies Data (mandatory)

   • Data collected via web logs, cookies, or similar technologies

7. IP Address (mandatory)

3. Purpose of Collecting Personal Data

3.1 Core Purposes

The Company collects personal data from registration applicants for the following purposes:

• Real estate and financial inquiries and consultations, communication, and delivery of the Company's services
• Verification of the user, whether a natural or legal person
• Communication with the user when needed
• Issuing and directing invoices and correspondence when needed
• Transferring funds
• Certain marketing and advertising purposes, including sending promotional and marketing messages
• Development and improvement purposes
• Troubleshooting and problem resolution

Commitment: The Company shall not process data in a manner inconsistent with the purpose for which it was collected.

3.2 Unsubscribing from Marketing Messages

If you do not wish to receive promotional and advertising messages, you may visit the Company's website and select the option to stop promotional messages, or contact the Company using the contact details provided in this policy. The Company will then cease sending such messages to you.

3.3 Failure to Provide Data

If the user does not provide their personal data as specified in this policy, this may cause technical or administrative issues for the user. To avoid this, the user must provide the Company with accurate data as required.

4. Methods of Data Collection

4.1 Various Methods of Data Collection

The Company collects personal data from service applicants or users through various methods:

• Official website/application: Whether through registration or visiting the website
• Products and services: By contacting the Company's numbers or personnel, providing the Company with personal data, or the Company providing products or services for the purpose of benefiting from its services, whether as a supplier or beneficiary
• Social media: Such as filling out submitted forms

4.2 Legal Basis for Collection

The legal basis for collecting personal data is the user's consent.

4.3 Collection Methods

Personal data is collected in two ways:

• Directly: By entering the required information or data
• Indirectly: Via cookies collected when visiting the website

4.4 Data Storage

The Company stores personal data on its contracted servers and on the Company's own servers.

5. Data Updates

5.1 Update Requests

• The Company may request data updates from the user for various purposes that will be explained at the time of the request
• The Company reserves the right to suspend services to the user if data is not updated

5.2 User's Right to Correction

The user has the right to request correction, completion, or updating of their personal data held by the Company, through:

• Requesting data modification via the designated icon on the main page
• Contacting the Company using the contact details provided in this policy

6. Amendments to the Privacy Policy

6.1 User Notification

The user will be notified when the Company modifies or updates any provision of this policy — including the purpose of collecting personal data — via:

• The website
• Registered mail
• Mobile number

6.2 Non-Acceptance of Updates

The Company reserves the right to suspend service to the user if they do not confirm acceptance of the update. If the user continues to use the website after being directly informed of a policy amendment or update without expressing any objection, they shall be deemed to have accepted the amendment or update.

6.3 Last Update

Last update to this Privacy Policy: 2025/02/16

7. Rights of the Data Subject

7.1 Right to Know

The user has the right to know the legal basis for data collection and the purpose of collection.

7.2 Right to Access

The user has the right to access or request their personal data at any time, through:

• Their personal page by registering on the Company's website
• Contacting the Company using the contact details provided in this policy

7.3 Right to Update and Destroy

The user has the right to request updating, completing, correcting, or destroying their personal data.

7.4 Right to Withdraw Consent

The user has the right to withdraw their consent to the processing of their personal data at any time, unless there are legal or contractual grounds requiring continued processing.

8. Disclosure of Personal Data

8.1 Non-Disclosure Commitment

The Company is committed to not disclosing the user's personal data to any entity or individual, whether inside or outside the Kingdom, except as stated in this policy or as required by law.

8.2 Sharing Data with Related Companies

The Company may share some personal data with its partners, such as parent or subsidiary companies, as well as service provider companies supporting the Company's operations, for the purposes of this policy. The Company is committed to ensuring that these parties are bound by confidentiality and data protection controls.

8.3 Permitted Disclosure Cases

The Company has the right to disclose the user's personal data in the following cases:

• If the data subject consents to the disclosure in accordance with the provisions of the law
• If the personal data was collected from a publicly available source
• If the requesting entity is a public authority, and the disclosure is for purposes of public interest, security purposes, enforcement of another regulation, or fulfillment of judicial requirements
• If the disclosure is necessary for the protection of public health, public safety, or the protection of the life or health of specific individuals
• If the disclosure will be limited to subsequent processing in a manner that does not lead to identifying the data subject or any other specific individual
• If the disclosure is necessary to achieve legitimate interests of the data controller, provided it does not prejudice the rights of the data subject or conflict with their interests, and the data is not sensitive data

9. Data Subject Rights and Data Destruction

9.1 Obligation to Destroy Data

The Company is committed to destroying personal data in the following cases:

• If it is no longer necessary to achieve the purpose for which it was collected as stated in this policy
• If the data subject wishes to have it destroyed, through:
  • Permanently deleting their account from the website
  • Requesting the Company to permanently delete their data from its records

9.2 Right to Retain Data

The Company may retain the user's personal data even after the purpose of collection has ended, in the following cases:

• If there is a legal basis requiring retention for a specified period
• If the personal data is closely connected to a case pending before a judicial authority and retention is required for this purpose

9.3 Destruction Guarantee

The Company undertakes to destroy the user's personal data immediately upon the occurrence of the triggering reason, by completely removing and deleting it from:

• The Company's database
• The processor's database, if applicable

10. Contact Information for Complaints and Objections

If you have any concerns or if we fail to comply with the Personal Data Protection Law, you may submit a complaint to:

Department: The Legal Department of the Company responsible for implementing the provisions of the Personal Data Protection Law

Address: Kingdom of Saudi Arabia, Riyadh

Phone: 0114607770

Email: Unit@hawyia.sa

Commercial Registration: 1010737029

---

If you are not satisfied with how we handle your complaint, you may submit a complaint to the competent authority:

Saudi Authority for Data and Artificial Intelligence (SDAIA)

Address: Kingdom of Saudi Arabia, Riyadh

Website:

• Saudi Authority for Data and Artificial Intelligence (sdaia.gov.sa)
• National Data Governance Platform (dgp.sdaia.gov.sa)