Responsible entity & contact details
- Website name
- Zawaya Al-Tamayoz Investment
- Privacy & complaints
- info@zawaya.ltd
- Phone
- 0571010000
Policy scope & data controller
This policy explains data processing on the Zawaya Al-Tamayoz Investment website, investor portal, and related services. Website details, the controller, and contact channels appear below. It does not cover independent websites you choose to visit; consult their notices when using their services.
Reading this policy does not automatically constitute consent to all processing or marketing. Separate consent is requested where processing relies on it.
Data sources & required fields
We receive data you enter in forms, accounts, conversations, and requests; account and investment information added by authorized staff from the existing relationship with you; and transaction statuses returned by service providers when enabled.
Forms distinguish required and optional fields. Not providing necessary information may prevent a request from being carried out or verified, but does not prevent browsing public content. We do not request passwords in messages, card details, or identity document images in contact or complaint forms.
Purposes & lawful bases
We use contact information to respond to your request based on the specific consent in the contact form. Account, reservation, and contract data serve the contractual relationship or service request. Data necessary to exercise your rights or fulfil a statutory requirement is used for that obligation. Security logs are used as necessary to prevent abuse, subject to legitimate-interest requirements where applicable.
Your enquiry is not converted into a marketing subscription. We do not sell your data or change its processing purpose incompatibly without an appropriate basis and notice.
Official reference: Personal Data Protection Law — lawful bases, purpose, and data minimization
Investor account & transactions
The account includes your name, contact details, supplied organization information, preferences, and membership status. The portfolio displays approved holdings, valuations, payments, and reports. Auction participation requests, bids, reservations, consents, accepted versions, and relevant verification events are retained.
We use this data to provide services, review requests, and handle objections. Access is limited to the relevant individual and authorized staff according to their permissions.
Signing, payments & verification
When electronic contracting is enabled, the configured signature provider receives party and contract details and what is needed to sign and verify status. For payment, the configured payment provider receives the transaction reference, amount, and invoice requirements. The website stores transaction references and statuses; card details are entered on the provider's page and are not stored on this website.
Prepared integrations include Signit for signatures and Moyasar for payments. A prepared integration is not necessarily enabled for every service. A verification provider may require additional information under its notice; do not send it through a general website form.
Investment assistant, simulation & generation
Conversations, criteria, inputs, plans, and designs are stored to provide and follow up on the service. The assistant processes budget, interests, and selected cities; the simulator processes targets, duration, liquidity, savings, and priorities; architectural customization processes the concept description, unit geometry, and authorized visual reference.
When the cloud engine is enabled and you consent within the service, the specified inputs are sent to OpenAI to produce a result. The assistant does not automatically send your portfolio or financial reports. Do not include sensitive personal information in prompts. You may use a non-cloud alternative where the service provides one.
Suggestions do not make a binding purchase, financing, or award decision on your behalf. Reviews and contractual decisions remain with authorized parties. You can withdraw consent for later requests or delete conversations and plans where tools are available, subject to statutory retention exceptions.
Visual tracking & digital twins
We store the project, requested service, frequency, notes, request status, and reviews. Digital twins also process access scope, virtual-space usage requests, booking times, and organization information you provide.
Tracking materials are shown to authorized users. The portal map does not request your device location or load external tracking maps. If you choose to enter an external world or camera player, your browser may connect to its provider and be subject to its published processing notice; reading this privacy policy does not start entry to a world or camera.
Digital services, rights & complaints
For website, store, automation, or AI requests, we store contact details, project name, needs, timing, preferred contact method, and optional budget. This form does not automatically send data to an AI provider.
The rights and complaints form stores name, email, type, optional reference, description, status, response, and verification where necessary. We use them to handle the request and retain its action history. Account requests are linked to the account; guest requests are available in the submitting browser session. The confirmation link alone does not disclose the request to others.
Processing outside Saudi Arabia
Cloud services or their providers may process data outside Saudi Arabia. Any actual transfer must have a purpose, lawful basis, and safeguards meeting the law and transfer regulations, with risk assessment where required and data limited to what is necessary. AI consent does not replace these requirements.
You may request details of the entities, countries, and safeguards relevant to your data through the privacy channel. An Arabic website does not imply all processing occurs within Saudi Arabia.
Official reference: Regulation on Personal Data Transfer Outside the Kingdom
Retention & destruction
Retention periods depend on the record's purpose, contractual relationship, documentation, claims, and statutory obligations. Account deletion does not cancel a contract or erase records that must legally be retained. We do not retain unnecessary data without a lawful basis and restrict its use while retention obligations continue.
Services with specified periods state when a conversation, plan, or design expires. Access expiry may precede periodic file destruction; a record disappearing from the interface does not mean immediate deletion from all copies. Destruction requests are reviewed, including instructions to processors and backups according to destruction cycles and applicable requirements. The operating retention schedule appears below when approved.
Security & incidents
The website uses account and staff permissions, record ownership checks, form protection, anti-abuse limits, and private storage for sensitive documents. Passwords are stored as one-way hashes. HTTPS protects transmission where configured.
No measure prevents every risk. When an incident affects data, we respond according to its impact and apply statutory reporting and notification requirements. Tell us immediately if you suspect unauthorized account access, without sending your password.
Your rights and how to exercise them
Within the law's scope and exceptions, you have rights to know about processing, access your data, obtain a readable copy, request correction, completion, updating, or destruction, and withdraw consent where processing relies on it. Withdrawal does not affect the lawfulness of earlier processing, and processing may continue on an independent basis.
Use the rights and complaints form or published privacy email. We verify capacity as necessary before disclosing or changing data and explain any statutory restriction. Deadlines and objection procedures are detailed in the data rights and complaints policy.
Official reference: Personal Data Protection Law — data subject rights
Notice updates
Each published version has a date and number, and previous versions remain archived. Changing text alone does not establish new consent or retrospectively change acquired contractual rights. Material processing changes require notice and fresh consent where the lawful basis requires it.