Privacy Policy

Last updated: 27 November 2025

Hatham Investments Company (“Hatham Investments”,  “Hatham”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data that we collect and process in the Kingdom of Saudi Arabia.

This Privacy Policy explains how we collect, use, disclose, store and protect your personal data when you:

• Visit or use our website (the “Website”);
• Communicate with us via email or other channels; or
• Interact with us in connection with our services.

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) (Royal Decree No. M/19) and its implementing regulations, as supervised by the Saudi Data & Artificial Intelligence Authority (SDAIA).

Please read this Privacy Policy carefully. By using the Website, you acknowledge that you have read and understood this Policy.

For the purposes of the PDPL, Hatham Investments Company is the data controller in respect of personal data collected and processed through the Website and related channels.

Entity: Hatham Investments Company

NID: 7041944815

Registered in: Kingdom of Saudi Arabia

Contact email for privacy matters: privacy@hatham.sa

Depending on how you interact with us, we may collect the following categories of personal data:

3.1 Data you provide directly

For example, when you:

- Contact us via forms, email or phone

• Name, job title, company name
• Email address, phone number
• The content of your message or enquiry

- Request information about our services or investment opportunities:

• Identification and contact details
• Professional information (e.g. role, sector, area of interest)

- Subscribe to updates / newsletters (if applicable):

• Name and contact details
• Communication preferences

3.2 Data we collect automatically

When you visit the Website, we may automatically collect:

• Device information (e.g. IP address, browser type, operating system, language settings)
• Usage data (e.g. pages visited, time and date of visit, time spent on pages, clickstream data)
• Approximate location (e.g. country/region) derived from IP address

This information is typically collected using cookies and similar technologies (see Section 6).

3.3 Data from third parties

Where permitted by law, we may receive personal data from:

• Service providers (e.g. analytics or hosting providers)
• Business partners and advisors
• Publicly available sources (e.g. professional or corporate websites)

Under the PDPL, we must have a lawful basis for processing personal data and clearly specify our purposes. Saudi Personal Data Protection Law+2https://secureprivacy.ai/+2

We may process your personal data for the following purposes and on the following bases:

- Responding to enquiries and providing our services

• To respond to your questions, requests or complaints.
• To communicate about existing or potential business relationships.
• Legal bases: your consent; necessity for entering into or performing a contract; or legitimate interests when appropriate under PDPL.

- Operating and improving the Website

• To operate, maintain and secure the Website.
• To analyze usage and performance to improve user experience.
• Legal bases: legitimate interests in operating and improving our Website, balanced against your rights; or your consent where required (e.g. non‑essential cookies).

- Compliance with legal obligations

• To comply with applicable laws, regulations, supervisory requirements or court orders.
• To respond to lawful requests from competent authorities.
• Legal basis: compliance with a legal obligation.

- Protecting our rights, security and assets

• To prevent fraud, misuse of the Website, or security incidents.
• To protect our legal rights, privacy, safety, or property, and that of our users or third parties.
• Legal bases: legitimate interests; protection of vital interests; compliance with legal obligations.

- Marketing and communications (if applicable)

• To send you information about our services, events or insights that may be relevant to you.
• You can opt out at any time by following unsubscribe instructions or contacting us.
• Legal basis: your consent, or legitimate interests where permitted.

We do not intentionally collect or process sensitive personal data (such as health data, biometric data, religious or political beliefs, or criminal records) through the Website.

If you voluntarily submit sensitive personal data (for example in a free‑text enquiry), you explicitly consent to our processing of that data for the purpose of handling your request. We will limit the use and sharing of such data strictly to what is necessary for that purpose and in line with PDPL.

We may use cookies and similar technologies on the Website to:

• Enable essential website functions (e.g. security, session management)
• Measure and analyse how visitors use the Website (e.g. page views, traffic)
• Remember your preferences where applicable

Where required by law, we will seek your consent for non‑essential cookies. You can usually manage or disable cookies in your browser settings, though some Website functions may not work properly if certain cookies are disabled.

A more detailed cookie notice can be provided separately and linked from this section if needed.

We may share your personal data with:

• Service providers and vendors
• Hosting providers, IT and security service providers
• Website analytics providers
• Professional advisers (e.g. legal, audit, consulting)

These parties are allowed to process personal data only as needed to provide their services to us and must follow our instructions and applicable data protection requirements.

Business partners and affiliates

Where necessary to respond to your requests, manage relationships, or explore transactions, we may share limited data with business partners or affiliates who are subject to appropriate confidentiality and data protection obligations.

Public authorities and regulators

• Where we are required to do so by law or competent authority.
• To protect our rights, safety or property, or that of others.

We do not sell your personal data.

Some of our service providers or partners may be located outside the Kingdom of Saudi Arabia. When we transfer personal data outside KSA, we will do so in accordance with the PDPL and its related regulations on cross‑border data transfers, including conditions set by SDAIA.

This may involve, for example:

• Ensuring the receiving country provides an adequate level of protection; or
• Putting in place appropriate contractual safeguards; or
• Relying on other legal grounds permitted under PDPL (such as explicit consent, necessity for performance of a contract, or protection of vital interests).

We will take reasonable steps to ensure that any international transfer is carried out with appropriate protections for your personal data.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including to:

• Provide our services and maintain our relationship with you
• Meet legal, regulatory, accounting or reporting requirements
• Resolve disputes and enforce our agreements

The specific retention period may depend on factors such as:

• The type of data and purpose of processing
• Applicable laws and limitation periods

When personal data is no longer required, we will delete or anonymise it in accordance with PDPL requirements.

We implement appropriate technical and organisational measures to protect personal data against:

• Unauthorized access or disclosure
• Accidental loss, destruction or damage
• Unlawful processing

These measures may include access controls, encryption where appropriate, secure storage, regular monitoring, and staff training. No system is completely secure, but we work to continuously improve our security practices.

If we become aware of a personal data breach that could significantly affect your privacy, we will take steps in line with PDPL, including notifying the competent authority and affected individuals where required.

Under the PDPL and its implementing regulations, and subject to certain conditions and exemptions, you may have the following rights regarding your personal data:

1. Right to be informed

To receive clear information about how we collect and use your personal data (including through this Privacy Policy).

2. Right of access

To obtain confirmation whether we process your personal data and to receive a copy of such data.

3. Right to rectification

To request correction or completion of inaccurate or incomplete personal data.

4. Right to deletion (erasure)

To request that we delete your personal data when it is no longer needed for the purposes for which it was collected or when processing is unlawful, subject to legal retention obligations.

5. Right to restriction or objection

To request that we restrict or stop certain processing activities where PDPL allows, for example if you contest the accuracy of the data or object to specific uses (such as direct marketing).

6. Right to data portability (where applicable)

To obtain certain personal data in a structured and commonly used format, and to request its transfer to another controller, where technically feasible.

7. Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing prior to withdrawal.

8. Right to complain to the competent authority

You may lodge a complaint with the relevant authority in the Kingdom of Saudi Arabia, such as SDAIA or any other competent regulator, if you believe your data protection rights have been violated.

To exercise any of your rights or to ask questions about this Privacy Policy, please contact us at:

Email: privacy@hatham.sa

To help us respond efficiently, please:

• State which right(s) you wish to exercise;
• Provide sufficient information to identify you;
• Provide relevant details about your request.

We will handle your request in accordance with PDPL timeframes and requirements and may need to verify your identity before acting on your request. 

Our Website and services are not directed at children under the age defined by applicable Saudi law, and we do not knowingly collect personal data from children through the Website.

If you believe that a child has provided us with personal data without appropriate consent, please contact us at privacy@hatham.sa and we will take steps to delete such data in accordance with PDPL.

The Website may contain links to third‑party websites or services that are not operated or controlled by Hatham. This Privacy Policy does not apply to those sites.

We recommend reviewing the privacy policies of any third‑party websites you visit.

We may update this Privacy Policy from time to time, for example to reflect:

• Changes in our services or internal practices;
• Changes in applicable laws or regulatory guidance, including updates to the PDPL framework.

We will indicate the date of the latest update at the top of this Policy. Where changes are material, we may take additional steps to inform you (such as prominent notice on the Website).

If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal data, please contact:

Hatham Investments Company

Email: privacy@hatham.sa