SAHL

Last Updated: January 18, 2026

1. Introduction

SAHL Ownership Company ("the Company," "we," or "SAHL") recognizes the importance of protecting the privacy of users of its website, application, and related services ("the Platform").

This policy explains how your personal data is collected, used, protected, and shared, in addition to clarifying your rights.

By opening an account on the Platform or using any of its services, you agree to the use of your personal data in accordance with the Terms and Conditions and this Privacy Policy.

The SAHL Platform operates within the Regulatory Sandbox of the Real Estate General Authority and complies with all applicable regulations and laws in the Kingdom of Saudi Arabia.

2. Personal Data Protection Officer

Personal Data Protection Officer: Customer Service Team

Phone: +966550806072

Email: info@trysahl.sa

Address: Riyadh, Kingdom of Saudi Arabia

You may contact us at any time to exercise your rights related to your personal data or for any inquiries regarding this policy.

3. Personal Data We Collect

The Company collects and processes certain data directly from users, as well as some data indirectly.

A. Data We Collect Directly From You

Identity Data: Full name, national ID or residency number, date of birth, nationality, national address.

Contact Data: Email address, mobile phone number, mailing address.

Financial Data: Bank account information (IBAN), payment method details.

Verification Data (KYC/AML): Copies of identification, proof of address, and any documents required for identity verification.

Investment Data: Investment preferences, experience level, financial goals.

B. Data We Collect Indirectly

Technical Data: IP address, browser and device type, operating system, device identifier.

Usage Data: Pages visited, visit duration, browsing and interaction patterns.

Geolocation Data: Approximate location based on IP address (with your consent).

Cookie Data: Session information and preferences.

Data from External Sources: Information from government authorities for identity verification, and information from business partners.

4. Purposes of Personal Data Processing

We use your personal data for the following purposes:

A. Account and Services Management

• Creating and managing your account on the Platform

• Verifying your identity in accordance with KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements

• Executing fractional ownership transactions

• Processing payments and distributing returns from rental income

• Ensuring your rights in the real estate opportunities you invest in

B. Communication and Notifications

• Sending notifications about your investments, return status, and distributions

• Informing you of new real estate opportunities and important updates

• Responding to your inquiries and support requests

• Sending marketing materials (with your consent)

C. Improvement and Development

• Improving our services and developing new products

• Analyzing usage patterns to enhance user experience

• Conducting research and statistical analysis (with anonymized data)

D. Security and Compliance

• Preventing fraud and protecting the security of the Platform and users

• Complying with legal and regulatory requirements

• Responding to official requests from competent authorities

5. Legal Bases for Processing

In accordance with the Personal Data Protection Law, the Company relies on the following legal bases for processing your data:

A. Your Explicit Consent

Processing of some data is based on your explicit consent provided when registering on the Platform and accepting this policy. You may withdraw your consent at any time.

B. Performance of a Contractual Obligation

Processing of personal data is necessary to perform contracts to which you are a party, including fractional ownership contracts or other real estate opportunities, to ensure your rights and distribute returns from rental income.

C. Compliance with Legal Obligation

Processing is necessary for compliance with the regulations and laws of the Kingdom of Saudi Arabia, including:

• Anti-Money Laundering and Counter-Terrorism Financing Law

• Companies Law

• Real Estate General Authority regulations related to real estate activities

• Personal Data Protection Law and its Implementing Regulations

D. Legitimate Interests

We may process your data to achieve our legitimate interests, such as service development, user experience improvement, fraud prevention, and protection of our legal rights, provided these interests do not conflict with your fundamental rights and freedoms.

6. Disclosure and Sharing of Personal Data

The Company may disclose your personal data to the following parties:

A. Government and Regulatory Authorities

• Real Estate General Authority (REGA)

• Capital Market Authority

• Tax and Zakat authorities

• Law enforcement agencies upon request or for compliance with legal requirements

B. Service Providers

• Payment processing and financial transfer companies

• Identity verification service providers (KYC)

• Hosting and cloud service companies

• Analytics and marketing service providers

These providers are required to protect your data and use it only for the specified purpose.

C. Business Partners

• Property owners and real estate development companies

• Property management and maintenance companies

• Accredited real estate appraisers

Sharing is limited to the extent necessary to execute investments and manage properties.

D. Other Cases

• In cases of merger or acquisition, while maintaining the same level of protection

• With your explicit consent in any other cases

• To protect our legal rights or user safety

7. Data Transfer Outside the Kingdom

We strive to store and process your personal data within the geographical boundaries of the Kingdom of Saudi Arabia whenever possible.

If it becomes necessary to transfer your data outside the Kingdom, we commit to:

• Obtaining your prior consent where required

• Ensuring an adequate level of data protection exists in the receiving country

• Entering into binding agreements with receiving parties to ensure your data protection

• Complying with the Personal Data Protection Law requirements regarding cross-border data transfer

We will inform you of the party or parties to whom your personal data will be disclosed and whether this data will be transferred outside the Kingdom.

8. Data Protection and Security

We implement strict security measures to protect your personal data from leakage, damage, loss, theft, misuse, modification, or unauthorized access.

Technical Measures

• Data encryption during transmission and storage

• Firewalls and intrusion detection systems

• Regular security testing and vulnerability assessments

Organizational Measures

• Restricting access to personal data to authorized employees only on a need-to-know basis

• Training employees on data protection policies and information security

• Strict identity verification procedures before data access

Monitoring and Compliance

• Continuous monitoring of our systems to detect any intrusion attempts

• Periodic review of security policies and procedures

Despite our efforts, absolute security of data transmission over the internet cannot be guaranteed. We encourage you to take your own precautions to protect your data.

9. Your Rights Related to Personal Data

Right to Know

You have the right to know how your personal data is collected, the legal basis for collection and processing, how it is processed, stored, and destroyed, and to whom it will be disclosed.

Right to Access Your Personal Data

You have the right to request access to your personal data by logging into your account on the Platform and going to the "Personal Data" or "Settings" section, or by contacting the customer service team.

Right to Correct Your Personal Data

You have the right to request correction of your inaccurate or incomplete personal data by accessing the "Update Personal Data" section in your account or contacting customer service. Your request will be reviewed and data updated within 5 business days with email notification.

Right to Destroy Your Personal Data

You have the right to request destruction of your personal data in the following cases:

• Data processing is no longer necessary to achieve the purpose for which it was collected

• You have withdrawn your consent to processing

• You have objected to processing and there are no legitimate interests to justify it

• You may submit a destruction request through the "Data Destruction Request" form in the "Support" section of the Platform

Note: We may not be able to fulfill some requests in cases where data retention is required for compliance with legal obligations or to establish, exercise, or defend legal rights.

10. Data Retention and Destruction

We retain your personal data throughout your use of the Platform and for specified periods thereafter according to the following criteria:

Retention Periods

• Account and identity data: Throughout the account's active period and for 10 years after closure

• Financial transaction records: For no less than 10 years in accordance with anti-money laundering requirements

• Investment and fractional ownership data: Throughout the investment period and for 7 years after exit

• Communication and support records: For 3 years from the date of last contact

• Technical data and usage logs: For one year

Data Destruction

After the retention period expires or upon acceptance of a destruction request:

• Data is securely and permanently deleted from our systems

• Data that may be needed for statistical purposes is anonymized

• Paper copies are destroyed securely

Destruction Exceptions

We may not be able to destroy some data in the following cases:

• Compliance with legal or regulatory obligations

• Establishing, exercising, or defending legal rights

• Existence of current or potential disputes

• Audit and review requirements

11. Cookies

We use cookies and similar technologies to improve your experience on the Platform.

Types of Cookies

• Essential Cookies: For Platform operation and basic functions (login, security, remembering preferences)

• Performance and Analytics Cookies: To collect information about how visitors use the Platform and improve its performance

• Functionality Cookies: To remember your choices and customize your experience

• Marketing Cookies: To display personalized content based on your interests (with your consent)

Managing Cookies

You can control cookies through:

• Your browser settings to accept or reject cookies

• Privacy settings in your account on the Platform

Warning: Disabling some cookies may affect Platform functions and user experience.

12. Children's Privacy

• We do not knowingly collect personal data from children.

• If we learn that we have collected data from a child, we will delete it immediately.

• If you are a guardian and believe your child has provided us with their data, please contact us.

13. External Website Links

• The Platform may contain links to external websites and services.

• We are not responsible for the privacy practices of these websites.

• We recommend reading the privacy policies of any external website you visit.

• The presence of a link does not imply our endorsement of that website or its services.

14. Filing Complaints

If you have any complaints regarding the processing of your personal data, you can:

Email: info@trysahl.sa

Through the complaints form in the "Support" section of the Platform.

We will endeavor to respond to and address your complaint within 10 business days.

15. Policy Updates

We may, at our discretion, update this Privacy Policy from time to time.

Update Mechanism

• You will be notified of any material changes via email or in-app notification.

• The updated policy will be published on the Platform with the update date.

• Your continued use of the Platform after an update constitutes acceptance of the updated terms.

We recommend reviewing this policy periodically to stay informed of any updates.

The date of the last update is mentioned at the beginning of this document.

16. Applicable Law

This policy is governed by and interpreted in accordance with the laws of the Kingdom of Saudi Arabia.

In case of any dispute arising from this policy:

• Both parties shall seek to resolve it amicably within 30 days.

• If amicable resolution is not possible, the dispute shall be referred to the competent courts in the city of Riyadh.

The provisions of the Personal Data Protection Law and its Implementing Regulations shall apply to all data protection matters.

17. Contact Us

For any inquiries or requests regarding this policy or your personal data:

Personal Data Protection Officer

Email: info@trysahl.sa

Customer Service

Email: info@trysahl.sa

Phone: +966550806072

Mailing Address

SAHL Ownership Company

Al-Qairawan District, Riyadh, Kingdom of Saudi Arabia

Website: www.trysahl.sa

We will endeavor to respond to your inquiries within 10 business days.