1. Introduction
Credx Capital Company ("Credx Capital", "Credx", "we", "us" or "our") respects your privacy and is committed to protecting your Personal Data.
This Privacy Policy explains how we collect, use, store, disclose and otherwise process Personal Data when you visit or interact with our website, submit information to us, communicate with us, or use any digital service made available by Credx Capital.
Credx Capital Company is a Saudi limited liability company registered in the Kingdom of Saudi Arabia under National Number 7055225192.
This Privacy Policy is intended to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia ("PDPL"), its Implementing Regulations, regulations relating to transfers of Personal Data outside the Kingdom, and other applicable laws and regulatory requirements.
2. Who Is Responsible for Your Personal Data?
For purposes of the PDPL, Credx Capital will generally act as the Controller of Personal Data collected through this website.
Controller:
Credx Capital Company
Riyadh, Kingdom of Saudi Arabia
General enquiries: info@credx.sa
Privacy enquiries and data-subject requests: privacy@credx.sa
3. Personal Data We May Collect
Depending on how you interact with Credx Capital, we may collect:
- Identity information: name, nationality, date of birth, national ID, Iqama or passport information, where required.
- Contact information: email address, telephone number, address and other contact details.
- Professional and corporate information: employer, job title, company details, Commercial Registration information and beneficial ownership information.
- Investor or client information: investor classification, investment objectives, financial circumstances, risk profile and other suitability or appropriateness information, where relevant to a service.
- Compliance information: information required for know-your-customer ("KYC"), anti-money laundering ("AML"), sanctions, beneficial ownership and other regulatory checks.
- Financial information: bank account or other financial information where required in connection with a service or transaction.
- Communications: emails, enquiries, requests, complaints and other correspondence with us.
- Technical information: IP address, browser type, device information, operating system, website usage data, logs and similar technical information.
- Cookie and analytics information: information obtained through cookies and comparable technologies.
- Any information you voluntarily provide through forms, meetings, correspondence, applications or other interactions with us.
We seek to limit Personal Data collection to information reasonably necessary for the relevant purpose.
4. How We Collect Personal Data
We may obtain Personal Data:
- directly from you;
- when you submit a website form or contact us;
- when you apply for or express interest in a product or service;
- during KYC, onboarding or client due diligence;
- from your employer, authorised representative or other persons acting on your behalf;
- from public and governmental records where permitted;
- from compliance, identity verification, credit-information or screening service providers;
- through cookies, server logs and website analytics; and
- from other lawful sources where permitted by applicable law.
5. Why We Process Personal Data
We may process Personal Data for the following purposes:
Website and communications
- operating, administering and securing the website;
- responding to enquiries and requests;
- providing requested information;
- managing our relationship with you.
Client onboarding and services
- assessing potential clients;
- conducting identification and verification;
- performing KYC, AML and sanctions checks;
- assessing suitability, appropriateness or investor classification where applicable;
- providing products or services requested by you;
- administering contracts and transactions.
Legal and regulatory compliance
- satisfying obligations imposed by the Capital Market Authority or other competent authorities;
- maintaining regulatory and compliance records;
- responding to lawful requests from courts, regulators or government authorities;
- preventing fraud, money laundering, misuse and other unlawful activity.
Business administration
- audit, risk management and internal control;
- information-security monitoring;
- business continuity;
- statistical and operational analysis;
- improving our services and digital channels.
Marketing
- providing updates, publications, invitations or marketing communications where permitted by law and, where required, with your consent.
6. Legal Basis for Processing
Depending on the circumstances, we process Personal Data on one or more legal bases permitted under Saudi law, including:
- your consent;
- taking steps at your request before entering into a contractual relationship;
- performance of a contract to which you are a party;
- compliance with a legal or regulatory obligation;
- protection of legitimate interests where permitted under the PDPL and provided your rights and interests are appropriately protected; or
- another legal basis permitted under applicable law.
Where processing is based on consent, you may withdraw that consent subject to applicable legal and regulatory requirements.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
7. Mandatory and Optional Information
Certain Personal Data may be mandatory in order for Credx Capital to comply with legal or regulatory requirements or provide a requested service.
If required Personal Data is not provided, we may be unable to:
- respond fully to a request;
- complete onboarding;
- establish or continue a business relationship; or
- provide the relevant service.
8. Disclosure of Personal Data
We may disclose Personal Data where reasonably necessary to:
- our affiliates and group companies;
- professional advisers, including lawyers, auditors, consultants and accountants;
- IT, cloud-hosting, cybersecurity and technology providers;
- KYC, AML, sanctions and identity-verification providers;
- financial institutions, custodians, fund administrators and other transaction counterparties, where relevant;
- outsourced service providers processing information on our behalf;
- the Capital Market Authority and other competent regulators;
- courts, law-enforcement bodies and government authorities;
- other persons where disclosure is required or permitted by applicable law.
Service providers are required to process Personal Data in accordance with applicable contractual and legal requirements.
Credx Capital does not sell Personal Data.
9. Transfers Outside Saudi Arabia
Some technology, professional or administrative service providers may process Personal Data outside the Kingdom of Saudi Arabia.
Where Personal Data is transferred outside the Kingdom, Credx Capital will take appropriate steps to ensure that the transfer complies with the PDPL and applicable regulations relating to transfers of Personal Data outside the Kingdom, including implementing any legally required safeguards.
10. Data Retention
We retain Personal Data only for as long as reasonably necessary to:
- achieve the purpose for which it was collected;
- comply with regulatory record-retention requirements;
- satisfy applicable legal, accounting and reporting requirements;
- establish, exercise or defend legal claims; or
- fulfil another lawful purpose.
Different retention periods may apply to different categories of information.
When Personal Data is no longer required and no legal basis exists for retaining it, it will be securely destroyed, deleted or anonymised in accordance with applicable requirements.
11. Information Security
Credx Capital implements appropriate organisational, administrative and technical safeguards designed to protect Personal Data against:
- unauthorised access;
- unlawful disclosure;
- alteration;
- loss;
- destruction; and
- other unauthorised or unlawful processing.
No electronic system is completely secure, and therefore we cannot guarantee absolute security of information transmitted through the internet.
12. Your Rights
Subject to the PDPL and applicable exceptions, you may have the right to:
- be informed about how your Personal Data is processed;
- access Personal Data held about you;
- obtain a copy of your Personal Data in a readable and clear format;
- request correction, completion or updating of inaccurate Personal Data;
- request destruction of Personal Data where the applicable legal conditions are met; and
- withdraw consent, where processing is based on consent and withdrawal is legally available.
To exercise your rights, contact:
privacy@credx.sa
We may request information necessary to verify your identity before processing a request.
13. Direct Marketing
Where required by law, we will obtain your consent before sending direct marketing communications.
You may unsubscribe from marketing communications at any time by:
- using the unsubscribe mechanism included in the communication; or
- contacting us at info@credx.sa.
Operational, legal or regulatory communications may continue where they are necessary and are not marketing communications.
14. Cookies
Our website may use cookies and similar technologies to:
- enable essential website functionality;
- maintain security;
- remember user preferences;
- understand website usage and performance; and
- improve website functionality.
Where required by applicable law, non-essential cookies will only be activated after obtaining the appropriate consent.
Further information may be provided through a separate Cookie Policy.
15. Third-Party Websites
Our website may contain links to websites operated by third parties.
Credx Capital is not responsible for the privacy practices, security or content of external websites. You should review the privacy policies applicable to any third-party website you visit.
16. Complaints
If you have concerns regarding our processing of your Personal Data, please contact us first at:
privacy@credx.sa
You may also have the right to submit a complaint to the competent authority responsible for enforcing the PDPL in the Kingdom of Saudi Arabia.
17. Changes to this Policy
We may amend this Privacy Policy from time to time to reflect:
- changes to our services;
- changes to our processing activities;
- changes in technology; or
- legal and regulatory developments.
The most recent version will be published on this website together with its effective date.
In the event of any inconsistency between the Arabic and English versions, the Arabic version shall prevail.