Sadq Privacy Policy

Sadq is committed to protecting the privacy and security of personal data in full compliance with the Saudi Personal Data Protection Law (PDPL) and all applicable national regulations. This Privacy Policy explains how Sadq collects, uses, stores, protects, and shares personal data as part of delivering its digital signature and identity verification services.

This policy applies to all users of Sadq’s platform, including customers, signers, administrators, and integrated enterprise clients.

This Privacy Policy applies to: - Personal data processed through Sadq services and portals - Data collected from users, signers, organizations, and administrators - Data shared by clients via - Identity verification data (Nafath, Absher, SMS/Email authentication)

It does not apply to third-party platforms or systems that integrate with Sadq.

Sadq collects only the minimum personal data required to deliver secure digital signing and identity verification services. This includes:

3.1 User & Signer Information

• Full name (Arabic/English)
• National ID/Iqama number (if required)
• Phone number
• Email address
• Role, permissions, and account metadata

3.2 Identity Verification Data

Used for secure access:

• Nafath authentication tokens
• Verification timestamps
• OTP validation data

3.3 Document & Signature Data

• Uploaded documents for signature
• Document metadata
• Users' signatures encrypted in our storage
• Application log data and audit trail events

3.4 System & Security Logs

• Login attempts
• User activity logs
• IP address

Sadq does not collect more data than required for operational and legal purposes.

Sadq processes personal data for the following purposes: - Identity verification (Nafath, Absher, Email, SMS) - Digital signature workflows - Generating audit trails and certificates - Sending notifications and signing invitations - Ensuring platform security, fraud detection, and compliance - Providing customer support and incident handling - Meeting regulatory and contractual obligations

Sadq processes personal data under these lawful bases: - Contractual necessity – delivering services requested by clients - Consent – notifications, identity verification steps - Legal obligations – compliance with Saudi laws - Legitimate interest – security monitoring and fraud prevention

All personal data is stored exclusively in the Kingdom of Saudi Arabia, in: - Oracle Cloud KSA (Jeddah primary region) - Oracle Cloud KSA (Riyadh DR region)

Sadq does not store or transfer any personal data outside Saudi Arabia.

Sadq enforces strong security controls including:

7.1 Encryption

• AES-256 encryption at rest for all documents and personal data
• TLS 1.3 encryption in transit for all connections
• User and document-level encryption keys managed through Sadq Key Vault

7.2 Access Control

• RBAC (Role-Based Access Control)
• Principle of Least Privilege (PoLP)
• Administrative access requires MFA and logged approvals

7.3 Monitoring & SOC

• Continuous monitoring via Sadq SOC
• Oracle Cloud Guard and SIEM integration
• Automated security alerts for abnormal activities

7.4 Infrastructure Security

Physical security is fully managed by Oracle Cloud KSA, including:

• Biometric access control
• 24/7 surveillance
• Restricted datacenter access
• Environmental and operational safeguards

Sadq retains personal data only for as long as necessary to fulfill: - Service delivery - Legal obligations - Client-defined requirements

Clients may request: - Immediate deletion after signing - Custom retention periods - Full envelope deletion via Sadq Deletion API

All deletion actions generate: - Audit logs - Confirmation receipts - Secure removal from storage and backups per policy

Sadq does not share personal data with any third parties except: - When required by law - When required for identity verification (Nafath) - When explicitly approved in writing by the client

Sadq does not use any subcontractors or sub-processors without prior client authorization.

Sadq supports the following PDPL rights for users and signers: - Right to access personal data - Right to correct, update, or complete personal data - Right to deletion - Right to withdraw consent - Right to be informed about data processing activities

These requests are processed in coordination with the client (data controller).

Requests may be delayed if they interfere with an active security investigation.

Sadq follows a formal PDPL-compliant Data Breach Response Procedure: - Immediate containment and forensic analysis - Alerting the client without delay - Supporting client notification to affected individuals - Preserving evidence for investigations - Compliance with PDPL notification timelines

Sadq does not intentionally collect or process personal data relating to children. Clients using Sadq must ensure compliance with relevant legal requirements before uploading any such data.

Sadq may update this policy periodically due to: - Regulatory changes - New features or services - Security enhancements

All updates will be communicated to clients and published in the platform.

For privacy and data protection inquiries, please contact Sadq’s Data Protection Officer function:

Email:  security@sadq.sa

This Privacy Policy is approved and effective as of the date of issuance.