Privacy Notice

In recognition of the importance and confidentiality of personal data, this notice has been prepared in accordance with the Personal Data Protection Law and its regulations in the Kingdom of Saudi Arabia. It reflects our commitment to delivering the highest levels of service while maintaining the confidentiality and privacy of user and input data.

This privacy notice applies to the VESA application. All users of the application, whether they are company employees, contractors, or subcontractors, working either on a permanent or temporary basis, must adhere to the specified standards.

Last Update Date: The privacy policy was last updated on: Aug 23, 2026.

1. Consent to the Privacy Notice

Your acceptance of this privacy notice signifies your agreement to the terms and conditions of privacy that apply to all services provided by VESA on its official website, as well as any ongoing modifications required by the nature of the business.

2. Changes to Privacy Notice

The VESA reserves the right to make changes to this notice at any time. You are advised to review the Privacy Notice periodically through VESA to stay informed of any updates. Any changes or modifications will become effective upon publication of the updated Privacy Notice.

3. Mechanism for Collecting Personal Data

Personal data is collected through the registration of employee, visitor, and vehicle information required via the VESA system by system administrators, company users, and contractors.

Company representatives and contractors are required to inform data subjects about the processing of their personal data and make the Privacy Notice available to them.

4. How is this Data Processed and Managed?

The collected data is integrated into the VESA system and processed to update information on vehicles, employees, users, and visitor bookings. This enables gate access and records the readings of employee cards, vehicle stickers, and visitor scan codes. Updated or new data for visitors, employees, and vehicles is used to log records or grant access based on varying permissions, and detailed reports are generated based on this information.

5. What Personal Data Does VESA Collect?

We are committed to collecting and processing only the minimum personal data necessary and directly relevant to achieving the purpose specified in this Privacy Notice, which includes:

  • Employee Data: Name, ID/residency number & Expiry Date, Insurance file & Expiry Date, gender, mobile number, email, nationality, job title, company name, Ajeer Contract File & Expiry Date.
  • Vehicle Data: Plate number, vehicle type, Driving License File & Expiry Date, and driver for visit approval.
  • Visitor Data: Name, ID/residency number, email, mobile number, and visit details.
  • Automatic Application Usage Data: IP address, login time, visited pages.
6. Legal Bases and Purposes for Collecting and Using Personal Data

In accordance with the Personal Data Protection Law (PDPL), personal data is collected and processed based on the legitimate interests of the Data Controller, without prejudicing the rights or conflicting with the interests of Data Subjects, for the purpose of verifying identities and authorizing access to the organization's sites.

7. Disclosure of Personal Data

VESA commits to not sharing personal data with other parties, except under circumstances mentioned in Article 15 of the Personal Data Protection Law. If your data is to be used for purposes other than those stated, your prior consent will be obtained.

8. How Is Personal Data Stored?

Personal data is securely stored with cloud service providers within the Kingdom of Saudi Arabia and is securely destroyed using appropriate methods once the purpose for which it was collected has been fulfilled.

However, personal data may be retained beyond this period in the following cases:

  • If legal justifications exist for retaining the data for a specified period. It will then be deleted after the longer of the stipulated period or the data collection purpose.
  • If the data is closely related to a case under judicial consideration, retention is required for this purpose. The data will be deleted after completing the judicial procedures.
  • If all identifying elements of the individual are removed.
9. Your Rights Regarding Your Personal Data
  • Be informed: This privacy notice has been prepared to inform you of all necessary details regarding the collection of your personal data.
  • Access, correct, complete, update, or obtain a copy of your personal data in a clear format.
  • Request the deletion of data no longer needed, provided it does not conflict with the regulations or legitimate interests stated in the Personal Data Protection Law.

You can submit request to access, modify, or delete your personal data, or submit complaints and suggestions by contacting us via email at: D2SWL@DIRIYAH.SA

SDAIA Address:

Kingdom of Saudi Arabia, Riyadh

Saudi Data & AI Authority: sdaia.gov.sa

National Data Governance Platform “DGP”: dgp.sdaia.gov.sa

10. Data Security

We are committed to taking appropriate measures to protect personal data, including administrative, technical, and physical safeguards to prevent data destruction, loss, alteration, unauthorized access, disclosure, or misuse.

Personal data is securely stored and processed according to standards issued by the National Cybersecurity Authority. Access to data is limited to system administrators and authorized personnel based on the principle of "need-to-know" and "minimum privileges." Before using or processing data, its necessity and alignment with its intended purpose will be assessed.

When using external service providers for data processing, we require adherence to the same standards to ensure the security of personal data, regardless of where it is transferred or stored.

11. Personal Data Confidentiality

VESA users shall maintain the confidentiality of personal data accessed or processed through the VESA and use it only within their granted permissions and for authorized business purposes. Personal data shall not be disclosed or shared with any unauthorized person or entity, exploited for personal benefit, or used for any purpose unrelated to work duties. Users shall also not retain any materials or copies of personal data in their possession or under their control, whether directly or indirectly.

General Provisions

This notice is in Arabic, which is the official language. If there are discrepancies between the Arabic version and its English translation, the Arabic version prevails.