Privacy and Personal Data Protection Policy

This policy explains how Middle East Financial Investment Company (MEFIC Capital) handles personal data that it collects or processes when providing its investment services, opening, updating, and managing investment accounts, or using its website, applications, and communication channels. The information contained herein includes the types and sources of data, the purposes and regulatory bases for its processing, the entities to which the company may disclose the data, the retention periods, and the rights of data subjects along with the methods of exercising those rights.

The provisions of this policy will be applied in compliance with the Personal Data Protection Law and its Executive Regulations, as well as other relevant laws and regulations in Saudi Arabia.

Company Name: Middle East Financial Investment Company (MEFIC Capital).

The Unified National Number: 7001528970

For the purposes of this Policy, "the Company" refers to MEFIC Capital, and "the Data Subject" refers to the natural person to whom the Personal Data relates. This Policy applies to the Company’s clients, users of its digital services, and individuals whose data is received by the Company while providing its services, subject to the nature of the relationship.

The Company collects the data necessary to provide the service or comply with regulatory obligations, and the required data may vary depending on the type of account and service where applicable, this includes:

1. Identity Data: Name, date of birth, nationality, national ID, residency (Iqama) or passport number, and any other necessary verification data.
2. Contact Data: National address, contact information, email address, and phone number.
3. Financial and Investment Data: Bank and investment account information, sources of funds, investment experience and objectives, financial solvency or status, transactions, orders, portfolios, and subscriptions.
4. Verification and Compliance Data: Documents and data required to apply “Know Your Customer” (KYC) and due diligence procedures, identity verification, anti-money laundering (AML) and counter-terrorist financing (CTF) measures, besides other regulatory requirements.
5. Communication and Service Data: Inquiries, requests, complaints, correspondence, and communication logs related to the services.
6. Technical Data: Internet Protocol (IP) address, device and browser type, login logs, website or application usage data, and cookies, where applicable.

Data is collected directly from the Data Subject upon registration, account opening, updating, or communicating with the Company. It may also be obtained from official authorities, verification service providers, or entities involved in executing services and operations, to the extent permitted by regulations. The provision of certain personal data is mandatory to complete the procedures for opening an investment account and providing related services, while the provision of other data is optional depending on the nature of the service. Failure to provide mandatory data may result in the inability to open the account or provide certain services.

The processing of personal data is limited to specific and lawful purposes associated with the company's services, including:

1. Receiving and reviewing requests to open investment accounts, verifying identities, creating accounts, as well as updating and managing their data.
2. Assessing the suitability of investment services and products, executing orders, transactions, and subscriptions, and managing portfolios, assets, and related dealings in accordance with the available services.
3. Executing know-your-customer (KYC) and due diligence requirements, combating money laundering and terrorist financing, verifying data, complying with regulatory instructions, and retaining records.
4. Communicating with clients regarding accounts, transactions, account statements, necessary notices, and security and regulatory updates.
5. Processing, following up on, and handling inquiries, complaints, and requests, as well as improving service delivery efficiency.
6. Protecting systems and accounts, monitoring security incidents, and detecting and mitigating fraud or misuse of services.
7. Analyzing usage and improving website and application performance within the scope of relevant regulatory controls.
8. Communicating with clients regarding the Company’s products, services, investment funds, and offers; sending marketing content; preparing, implementing, and measuring the effectiveness of advertising campaigns; and personalizing content and offers, based on the Data Subject’s consent. This may include engaging specialized service providers and advertising platforms that may process or store personal data outside the Kingdom of Saudi Arabia, after obtaining the Data Subject’s consent and in accordance with applicable laws and regulations. The Data Subject has the right to stop receiving marketing materials at any time through the contact channel specified in this Policy or through the unsubscribe option in the messages sent.

The company shall not use data for independent purposes incompatible with the declared purposes except based on an appropriate legal basis, and consent shall be requested when necessary.

The company relies on the legal basis appropriate to the nature and purpose of the processing when processing personal data, including: performing obligations related to the contract concluded with the client; fulfilling obligations imposed by laws, regulations, and regulatory instructions, achieving an actual interest of the data subject, achieving a legitimate interest of the company in accordance with statutory conditions without affecting the rights and interests of the data subject, or the consent of the data subject when required.

The company may disclose or share personal data to the extent necessary to achieve the purposes of processing or fulfill statutory obligations, in accordance with established provisions and controls. Depending on the necessity and the nature of the service, such disclosure may include:

1. The Capital Market Authority (CMA) and competent government, regulatory, or judicial authorities, in accordance with jurisdiction and statutory requirements.
2. Banks, financial institutions, and parties associated with custody, clearing, settlement, and the execution of investment transactions.
3. Information technology, hosting, verification, support, and operational service providers engaged by the company to perform its business operations, subject to appropriate contractual and security safeguards.
4. Any other entity permitted by law to receive disclosures, or whose sharing is required for processing after fulfilling the appropriate legal basis.

Sharing is limited to the data necessary for specific purposes, and the company observes requirements of confidentiality and protection when dealing with recipient entities. The company does not disclose personal data except in cases permitted by law, including:

1. The consent of the data subject to the disclosure.
2. Fulfilling a statutory obligation, or pursuant to a request by a public entity for security or judicial purposes.
3. If the data has been collected from a publicly available source.
4. When the disclosure is necessary to protect public health or safety, or the lives of individuals.
5. If the disclosure is limited to data that does not reveal the identity of the data subject.
6. If the disclosure is necessary to achieve a legitimate interest of the company without including sensitive data.

Personal data is kept in the approved systems and records of the company within the Kingdom of Saudi Arabia. Appropriate organizational and technical measures are applied to protect personal data against loss, destruction, alteration, unauthorized use, disclosure, or access. Depending on the nature of the systems and data, these measures include access control, system usage monitoring, account protection and incident response procedures, and the management of relevant service providers. These measures are reviewed in accordance with statutory requirements and relevant risks. In the event of a personal data breach incident, the company shall notify the competent authorities and affected data subjects in accordance with applicable laws and regulations.

The company retains personal data for as long as necessary to achieve the purposes of its collection and processing, or in accordance with the periods specified in relevant laws and regulations. The retention period varies depending on the type of data, its purpose, and the statutory basis for retaining it.

Upon the expiration of the purpose for retaining the data and the absence of any statutory obligation or legitimate justification necessitating the continued retention thereof, the company shall take the necessary measures to securely destroy the data or remove what indicates the identity of the data subject, in accordance with internal policies and relevant controls.

In the context of the company conducting its activities, operations, and providing its financial and investment services, personal data may be transferred, stored, processed, or disclosed to entities outside the Kingdom of Saudi Arabia.

The company may transfer personal data or disclose it to brokers and financial institutions outside the Kingdom of Saudi Arabia for the purposes of providing investment services and executing related transactions.

When transferring personal data outside the Kingdom, the company commits to complying with the requirements and controls stipulated in the Personal Data Protection Law and its Executive Regulations, and to taking the necessary measures to protect the data and preserve its confidentiality.

MEFIC Capital may use cookies and similar technologies on its websites, applications, and digital platforms to support core functions, improve performance, enhance security, analyze usage, and improve the user experience.

These technologies may result in the collection of certain technical information and usage data, including device information, browser type, Internet Protocol (IP) address, preferences, and interaction patterns with the website or digital platforms.

You can manage or disable cookies through the settings of your browser or device. However, disabling certain cookies may affect the performance, functionality, or availability of certain features or services.

The data subject enjoys the rights guaranteed under the Personal Data Protection Law and its Regulations, in accordance with the stipulated controls, conditions, and exceptions, which include:

1. The Right to be Informed: Knowing the statutory basis and purpose for collecting and processing personal data, and the information that must be disclosed to the data subject.
2. The Right of Access: Requesting to review the personal data held by the company, in accordance with regulatory controls.
3. The Right to Request a copy of Data: Requesting a copy of personal data in a clear and readable format, as prescribed by the law.
4. The Right to Request Rectification: Requesting the correction of inaccurate data, or the completion or updating of incomplete data.
5. The Right to Request Destruction: Requesting the destruction of data in cases permitted by the law, taking into account statutory obligations that require its continued retention.
6. The Right to Withdraw Consent: When processing is based on consent, it may be withdrawn in accordance with applicable controls without prejudice to processing that has another statutory basis.

The data subject may submit a request to exercise their rights, including the request to withdraw consent, through the privacy channel specified below. The company may request necessary information to verify the identity of the applicant and protect their data prior to responding. Requests shall be processed within the statutory periods, with the application of extension or rejection controls when their grounds are met and notifying the applicant as necessary. Account closure does not necessarily entail the destruction of all data if the retention of certain data is legally required.

Inquiries regarding the privacy policy, exercising rights related to personal data, or submitting complaints may be made via: Complaint@mefic.com.sa

For support related to investment accounts, access to digital services, or tracking transactions: meficcares@mefic.com.sa | +966 11 218 6666

The company reviews requests and complaints in accordance with its approved procedures and regulatory requirements. The data subject has the right to lodge a complaint with the competent authority in accordance with the procedures prescribed by law if their complaint is not handled as required.

The company may amend this policy when data processing procedures, services, or related regulations and laws change. The updated version shall be published through approved channels, indicating the date of the last update, and data subjects shall be notified or their consent obtained when legally required.