Privacy Notice

Legal basis and purposes for collection and the use of your personal data

We collect and use data for what is required by our business functions and services. In most cases, our legal basis and purposes include, but are not limited to:

1. Performance of a contract

   It may be necessary to process your personal data in order to perform a contract with you relating to the following purposes:

   • To create your FAB-KSA bank account.
   • To allow us to provide you with our products or services.
   • Enhance our products, services and our experience across our channels and to inform you about key updates and changes to our channels including Privacy Notice and other terms and policies.
   • For the purpose of identity management and when you sign-in to your bank account.
2. Compliance with legal obligation

   As a bank we are subject to a number of statutory and regulatory obligations that may require us to process your personal data (e.g., AML/KYC/Fraud/Litigation purposes). We also need to process your personal data to comply with any obligations and requirements issued by governmental, legal and regulatory authorities within the Kingdom of Saudi Arabia.

3. Legitimate Interests

   where necessary we process your personal data for our legitimate interests. Examples of where we rely on legitimate interests includes;

   • Understand your needs as a customer and your eligibility for products and services and to understand how you use and interact with our products and services and the people or things you are connected to and interested in.
4. Consent

   If we need to process your personal data in a way not covered by the legal basis above, we will do so based on your consent. You have the right to withdraw your consent at any time (please note that though your withdrawal will not affect the lawfulness of what we have done before you withdraw consent.). We may need your consent for the following purposes;

   • To send you marketing and advertising communications via (please note that you can opt-out of receiving such communications at any time by contacting us at the details provided below).
   • Promote new financial and investment products and services that may be of interest to you. To contact you for your opinions about our products and services, including through surveys and other market research.
   • To evaluate your profile and consider your application for a job role at FAB.

Any personal data received by us will be used for the purposes indicated in this Privacy Notice or in a separate notice provided to you. Except for where permitted by law, we will not process your personal data in a manner that is inconsistent with the collection purposes identified.

How we collect your personal data

The following are the different sources from which we may collect Personal Data about you:

1. During onboarding and service consumption

   When you become a customer and use our products and services.

2. Directly from you

   This is Personal Data you provide to us, such as through visiting our website, mobile app or through direct correspondence with us, or via other direct interactions with us such as completing a form on our website, applying for our products or services, creating an account on our website or mobile app, requesting marketing to be sent to you, giving feedback, contacting us by any means to submit an inquiry complaint, etc.

3. Exchanges

   When you complete a form and upload it on our website or mobile apps, email, social media post, via calling our call centre, or through participation in promotional campaigns.

4. Interactions (Social Media)

   Any posts and interactions you have directly with us on social media channels.

5. Browsing Pattern

   Data about how you are exploring our website, the timings of your visit, Internet Browser types, and how you were referred to our website.

6. Surveys

   Online web surveys that enable us to gather feedback regarding issues. Such as your likes and dislikes about the look and feel of our website and mobile apps. Your valuable feedback enables us to enhance the quality of experience we provide to you as an organization.

7. Where lawful

   From third parties and public sources. This includes credit bureau and government agencies.

International transfer of your personal data

We may share your personal data with our affiliates or subcontract the processing of your data to, or otherwise share your data with, service providers located inside or outside the Kingdom of Saudi Arabia. Such third parties may be engaged in, among other things, the provision of services to you, the processing of transactions, payments and/or the provision of support services. We will fulfil any requirements in relation to the international transfers of personal data under applicable laws.

Retention of your personal data

We will retain your personal data in an identifiable form only for the period necessary to fulfil the purposes outlined in this Privacy Notice (unless a longer retention period is required or permitted by law).

We may retain your personal data after the collection purposes ceases, in the following cases:

1. If there is a legal basis for retaining your data for a specific period, in which case the data shall be destroyed upon the lapse of that period or when the purpose of the collection is satisfied, whichever longer.
2. If your data is closely related to a case under consideration before a judicial authority and the retention of the data is required for that purpose, in which case the data shall be destroyed once the judicial procedures are concluded.

Data subject’s rights

With respect to your personal data you have the following rights:

1. Right to be informed.
2. Right to access your personal data.
3. Right to request your personal data in a readable and clear format.
4. Right to request corrections and/or modifications to your personal data held by us.
5. Right to object or restrict to processing when you contest the accuracy of personal information held by us.
6. Right to request destruction of your personal data.
7. Right to withdraw your consent to the extent any of your personal information is collected based on consent. (You can exercise your right by using the contact details set out below).
8. Right to lodge a complaint with the data protection authority.

Protection of your personal data

We ensure your personal data is appropriately protected by utilizing the necessary physical, technical, administrative, and procedural security measures to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal. We safeguard and protect your data in a manner that complies with the applicable data protection regulation of the Kingdom of Saudi Arabia.

In order to protect your personal data, FAB KSA has put in place a number of technical and organizational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data, or unauthorized access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organizational measures include restricting access to personal data solely to authorized persons with a legitimate need to know for the purposes of the processing operations.

Disclosure of your personal data

Your personal data is disclosed to the personnel within FAB that need to access this personal data in order to perform their duties and ultimately deliver the required service to you. We may share your personal Data with our Affiliates or other related FAB Group entities to enable fulfilling contract with you.

We may also share your personal data with our service providers involved in the provision of the information or services you have requested from us for lawful purposes in order to help us run our business. We rely on such trusted third parties for a range of our business operations and provision of services. We have agreements in place with these service providers to protect the confidentiality & privacy of your Personal Data. We do not share your Personal Data with third parties for their own marketing purposes, except with your specific consent.

We may share your data with any of the parties mentioned below:

1. Any court, regulatory body, or government authority to comply with any obligations and requirements issued by legal and regulatory authorities within the Kingdom of Saudi Arabia.
2. Any debt collection agency, credit bureau, or insurer.
3. Any professional advisors (e.g. auditors and lawyers).
4. Any agents, service providers and vendors and suppliers (e.g. IT suppliers).
5. Any member of FAB group or their service providers for the purpose of providing you with the products or services, enhancing our products, services, and your experience across our channels, and promoting new financial investment products and services that may be of interest to you and for the purposes of centralising our business operations.