Privacy Policy

1) Scope and Definitions

This policy applies to Osool Estate services in Saudi Arabia. "Personal Data" means any information that identifies you or can reasonably identify you directly or indirectly.

2) Data Controller and Responsibility

The data controller is Abdulaziz Alzahrani LLC, as the developer and operator of Osool Estate. We may engage vetted processors (e.g., cloud hosting, payments) under PDPL-compliant processing agreements.

3) Data We Collect

• Account and Identity: name, phone, email, ID/Iqama (if applicable), brokerage license details.
• Financial Transactions: invoices, amounts, payment status, payment instruments (we do not store sensitive card data).
• Real estate operations: units, leases, tenants, owners, collections, maintenance.
• Technical data: device identifiers, IPs, user agent, usage logs, error logs.
• Files and attachments: uploaded documents and contracts (may include sensitive information submitted by you).
• Communications: support tickets, emails, SMS, or calls.

4) Data Sources

• Directly from you when you register or use the service.
• Automatically through logs and cookies.
• From third parties you authorize (payment gateways, identity providers).

5) Legal Bases and Processing

We process data based on one or more of the following:

• Your explicit consent for specific processing (e.g., marketing).
• Performance of a contract or pre-contractual steps.
• Compliance with legal obligations (e.g., e-invoicing requirements).
• Our legitimate interests in operating and protecting the platform without overriding your rights.
• Protection of legal rights where necessary.

6) Purposes of Use

• Account creation, verification, and real estate service delivery.
• Payments, billing, collections, and issuing receipts.
• Customer support and service-related communications.
• Improving performance, analytics, and reporting.
• Cybersecurity, fraud detection, and abuse prevention.
• Compliance with Saudi laws and regulations.
• Marketing with your consent; you may opt out at any time.

7) Data Sharing

We may share data with:

• Cloud hosting providers such as Google Firebase.
• Saudi-compliant payment providers (e.g., Mada, STC Pay, Sadad) via integrated partners.
• Email and SMS service providers.
• Professional advisors (legal/accounting) when needed.
• Government/regulatory bodies when legally required or to protect rights.

We do not sell your personal data.

8) International Transfers

Some data may be transferred outside Saudi Arabia for technical and operational reasons with PDPL safeguards and appropriate contractual measures, and approvals where required.

9) Retention

• Operational records: for the duration of the contractual relationship and only as needed.
• Financial records and invoices: at least 10 years per applicable requirements.
• Support records: up to 5 years unless otherwise required.

10) Information Security

• Encryption in transit, least-privilege access controls.
• Log monitoring, alerting, and backups.
• Periodic security testing and continuous improvements.
• Breach notifications in line with applicable timelines and requirements.

11) PDPL Rights

Subject to law, you have the right to:

• Access and obtain a copy of your data.
• Request correction of inaccurate data.
• Request deletion where legally permitted.
• Request restriction or object to certain processing.
• Withdraw consent for processing based on consent, without affecting prior lawful processing.
• Lodge a complaint with the competent Saudi data protection authority.

To exercise your rights, please contact us via the channels below.

12) Cookies and Tracking

We use different types of cookies:

• Necessary: to enable core functionality.
• Functional: to remember your preferences (e.g., language).
• Analytics: to understand usage and improve performance.
• Marketing: with your consent, to measure and improve campaigns.

You can manage preferences through your browser settings; disabling may affect certain features.

13) Children's Privacy

We do not provide services to individuals under 18. If you believe a minor provided data to us, please contact us for deletion.

14) Automated Decisions

We do not make decisions producing significant legal effects solely by automated means without meaningful human involvement.

15) External Links

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their policies.

16) Policy Updates

We may update this policy from time to time. We will post changes on this page with the updated "Last updated" date, and may notify you in-app for material changes.