Privacy Policy

Rawaj Alaamal Company (a limited liability company) is the controller responsible for the personal data collected through its websites. The company provides real estate brokerage (FAL licence No. 1200050209), marketing and advertising, information technology and AI agents, and general contracting to individuals and businesses in the Kingdom.

This policy applies to the following websites:

• rawaj-alaamal.com — the company website
• rawajestate.com — Rawaj Alaamal – Real Estate Brokerage
• rawajads.com — Rawaj Alaamal – Marketing & Advertising
• rawajit.com — Rawaj Alaamal Information Technology
• assistant.rawaj-alaamal.com — the AI assistant and the statistics tool built into the sites above

a) Data you give us directly through our forms:

b) Data collected automatically while you browse:

• Visit statistics through Rawaj's own tool: the pages you view and time spent, the site that referred you, device, browser and operating system type, browser language, and approximate country and region. The region is worked out from your IP address on our own servers; we do not store the IP address itself, only a one-way coded (hashed) form that does not reveal it.
• A random identifier saved in your browser (local storage) so we can tell repeat visits apart. It contains no name or anything that directly identifies you.
• Technical server logs (including IP address and request time), created automatically for security and to run the sites.
• Cookies: we only use necessary cookies, such as remembering your display language and staff sign-in sessions for admin panels. We use no advertising cookies, no Google Analytics and no third-party tracking tools.

If you turn on "Do Not Track" or Global Privacy Control in your browser, the statistics tool will not record your visit.

If you do not provide required data, we will not be able to answer your request or review your job application. There is no other consequence.

We do not collect sensitive data (such as health, religious or biometric data); please do not include it in your messages or CV. We will not later process your data for a purpose that conflicts with the one it was collected for.

• Collection: when you send a form or a chat, the data is saved in that website's database and a notification reaches the company mailbox.
• Use: only the staff handling your request see it, to contact you and follow up.
• AI assistant: when chat is enabled, your messages are sent to our AI provider (Anthropic) to generate the reply; under its commercial terms the content is not used to train its models.
• Storage: data is kept for the retention periods in section 8.
• Destruction: data is permanently deleted when the period ends or when you ask.

We make no decision that affects you based solely on automated processing.

We do not sell your data or disclose it to anyone for direct marketing. We only use the following service providers (processors), who handle data on our behalf and on our instructions:

When you contact us by WhatsApp or email, those channels are also subject to their providers' policies.

We may disclose data to competent government authorities when required by law, or to protect rights and safety. Such disclosure is occasional, not regular.

Your data is stored on our providers' servers in the United States as described above. This is a transfer of personal data outside the Kingdom under Article 29 of the Law and the Regulation on Personal Data Transfer outside the Kingdom. When we do this, we commit to:

• transferring only the minimum data needed to provide the service;
• relying on our providers' contractual data protection terms;
• encrypting data in transit (HTTPS) and encrypting backups with AES-256 before upload;
• limiting access to the staff who need it.

If the processing location changes, we will update this policy.

When a period ends, the data is permanently deleted from our databases so that it cannot be recovered or viewed, and it disappears from backups within 30 days of deletion. Deletion runs automatically on a regular schedule. We keep data longer only if a law requires it or it is closely linked to a case before a judicial authority, and we destroy it once that reason ends.

• All connections to our sites are encrypted (HTTPS), and browsers are required to use it.
• Server firewalls; server access with encryption keys only, no passwords, and automatic blocking of guessing attempts.
• Admin panels protected by passwords and role-based permissions, with sign-in locked after repeated failed attempts.
• CVs kept in a locked folder that only authorised staff can open.
• Automatic security updates and encrypted daily backups stored off the server.
• Everyone who handles data is bound to confidentiality, even after their relationship with the company ends.

If a data breach happens, we will notify the Saudi Data & AI Authority within the legal period, and notify you if it could harm your data or rights.

The Law gives you the following rights:

• The right to be informed: to know what data we collect, why and on what legal basis, as set out in this policy.
• The right of access: to see the data we hold about you.
• The right to obtain a copy: to receive your data in a clear, readable format.
• The right to correction: to correct, complete or update your data.
• The right to destruction: to have your data deleted once it is no longer needed, unless a law requires us to keep it.
• The right to withdraw consent: at any time, without affecting processing done before you withdraw.
• The right to complain to the competent authority.
• The right to claim compensation for any material or moral harm caused by a breach of the Law.

To use any of these rights, email info@rawaj-alaamal.com or WhatsApp +966 53 148 1933, saying which right you are using and the mobile number or email you used with us. We may ask you to confirm your identity first, to protect your data. We reply within 30 days of receiving a complete request, free of charge.

To leave the newsletter straight away, use the "Unsubscribe" link in any email.

If you have any concern or complaint about how we handle your data, contact our Personal Data Protection Officer at info@rawaj-alaamal.com. We will reply within 30 days.

If you are not satisfied with our reply, or we do not reply within that time, you may complain to the competent authority: the Saudi Data & AI Authority (SDAIA), Riyadh, Kingdom of Saudi Arabia — sdaia.gov.sa and the National Data Governance Platform dgp.sdaia.gov.sa.

Our services are meant for adults, and we do not knowingly collect data from anyone under 18. If you learn that a child has sent us their data, contact us and we will delete it.

We review this policy regularly and publish any change on this page with its date. If a change is material and needs your consent, we will ask for it before applying it.