Privacy Notice

WAMID (“Company”, “We”, “us” or “our”) is committed to protecting your privacy and ensuring compliance with the KSA Personal Data Protection Law approved by the Royal Decree No. 19/m, dated 1443/2/9 (corresponds to 16 September 2021) (“Law”) and its Implementing Regulation. This Privacy Notice will explain how we collect, store and protect your personal data as a customer while providing you innovative services focused on data and AI, market infrastructure, and disruptive technologies.

We determine how and why your personal data about you as a customer is collected and used. Therefore, we act as the controller of your personal data under the Law.

Address: WAMID, King Abdullah Financial District (KAFD) - Parcel 1.17, Financial Blvd, Al Aqiq, Riyadh 13519, Kingdom of Saudi Arabia.

Policy update

This Privacy Notice may be updated at any time to reflect changes in legal, regulatory, or operational requirements. Updated versions will be communicated to you (e.g., publishing on the website).

Sources of personal data

We collect and process personal data throughout providing services to you. This includes, but is not limited to:

• Personal data collected on our website (e.g., “Contact Us” form).
• Personal data collected from our information systems.

Categories of personal data collected

We collect various types of personal data, including, but not limited to:

• Identification details: first name, last name, age, date of birth, nationality.
• Contact information: address, phone number, email.
• Governmental IDs: national ID, Iqama.
• Financial details: bank account details, transaction history.
• Other identifying information: Any other information collected that could identify you.

In case we may collect sensitive data about you (e.g., processing security data and criminal related data through KYC platform) we will ensure necessary safeguards (e.g., your explicit consent, fulfilling judicial or security requirements).

This data is processed only were permitted by the Law and subject to appropriate security and confidentially measures.

Legal basis for processing personal data

We will collect and process your personal data under the following legal basis, in accordance with the Law:

• For legitimate interest.
• To fulfill contractual obligations.
• To comply with applicable legal and regulatory requirements.
• With your consent to the collection and processing of personal data, where required.

We will ensure that our legitimate interest doesn’t override your rights and freedom. If consent is used as the legal basis for personal data processing, you may withdraw it at any time.

We will uphold the legal basis for data processing. However, we have the right in accordance with the Law to process your personal data for other than the legal bases defined above; which are included in the following cases:

• If your personal data is publicly available and/or has been collected from publicly available source.
• If processing your personal data will serve a vital interest.
• If collection or processing of your personal data is necessary to protect public health or safety, or to protect the life or health of you or other individuals.
• If your personal data is recorded or stored in a form that makes it impossible to identify you directly or indirectly (anonymized data).

Purpose of processing

We will collect and process your personal data only when there is a legal basis to do so, and solely for purposes necessary for providing services to you, including but not limited to:

• Performing data classification.
• Executing and validating algorithmic processes to ensure legitimate sharing of public and private investor profiles on behalf of our sister companies, EDAA, Saudi Exchange, and Muqassa.
• Conducting acceptance testing to validate the system and code controls in place to effectively protect personal data.
• CCTV for security purposes.

We may update or modify our processing activities from time to time to reflect changes in operational requirements, legal obligations, or technological developments. When such changes affect the way we collect, use or share your personal data, we will notify you through the appropriate channels (e.g., via phone number or email, i.e. SMS, or by updating Privacy Notice on the website).

Data sharing and disclosure

As necessitated by the processing purposes above (section 6), we have the right to disclose your personal data to STG Subsidiaries and/or entities within STG group to allow them to access, collect and process your personal data.

Any disclosure of personal data will be in accordance with the Law and in the following circumstances:

• You consent to the disclosure.
• Your personal data has been collected from a publicly available source.
• The entity requesting disclosure is a public entity, and the collection or processing of your personal data is required for public interest or security purposes, or to implement another law, or to fulfill judicial requirements.
• The disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals.
• The disclosure will only involve subsequent processing in a form that makes it impossible to directly or indirectly identify you (anonymized data).
• The disclosure is necessary to achieve our legitimate interests (in this case no sensitive data (e.g. health data) will be processed).

We store and process personal data within the Kingdom of Saudi Arabia. If it becomes necessary to transfer your personal data for processing outside of the KSA. In such cases we will comply with the requirements of the Law regarding cross-border personal data transfers, as well as with the requirements of other laws and regulations, where applicable, we will:

• Ensure an adequate level of protection in the recipient country, and/or
• Implement safeguards in line with the Law and its Implementing Regulations governing cross-border data transfer (if required).

Data retention

We keep all personal data only for as long as it is necessary to:

• Fulfill the purpose for which personal data was collected.
• Comply with legal, regulatory, or contractual requirements.

Once retention periods have expired, data will be securely deleted or anonymized.

Data subject rights

Under the Law, you have the certain rights regarding your personal data, including:

• You have the right to be informed about your data is collected, stored, processed and retained.
• You have the right to access your data.
• You have the right to obtain copy of your data.
• You have the right to request correction of inaccurate or incomplete data.
• You have the right to request destruction of your personal data, subject to legal or contractual restriction.
• You have the right to withdraw consent where processing is based on consent.

Data security measures

At WAMID we are committed to protecting the data entrusted to us. We have implemented appropriate administrative security policies, rules and technical measures to protect personal data. All security measures are designed to prevent unauthorized access, discloser, modification and unlawful destruction or loss of data. All security measures are aligned with the applicable laws in the Kingdom of Saudi Arabia.

Cookies

We use cookies to understand how you interact with our services, collect information about visits, and to enhance performance of our website. Most cookies do not collect information that identifies you, but collect general information (entry method, use of our website) instead.

You can manage cookies, which are placed on your devices (tablet, smartphone, PC, etc.): delete cookies, set permissions for them, and withdraw your consent to our use of cookies. Instructions for deleting or blocking cookies on various browsers are available at the links ( Google Chrome, Internet Explorer, Opera, Mozilla Firefox, Safari ).

We use Google Analytics services on our website.

You can refuse to provide this information by downloading and installing the browser plugin at the link Google Analytics Opt-out Browser Add-on.

You should be aware that in this case some functions and services will not be able to work properly.

Contact information

If you have any questions or comments regarding our use of your personal data, or you wish to exercise any of your rights as a data subject, please contact us by using the following contact details:

• Email: Customerservicecenter@Wamid.Sa