Jiwar Privacy Policy

Effective date: 16 October 2026

1. Introduction

Jiwar Digital Solutions Company ("Jiwar", "we", "us", or "our") operates the Jiwar platform: a mobile application for iOS and Android and a web-based command centre that connect residential communities and their Owners' Unions (اتحاد الملاك) with property management, asset management, and maintenance companies, together with our public website.

We take the protection of personal data seriously. This Privacy Policy explains what personal data we collect, why we collect it, the lawful bases on which we process it, with whom we share it, where it is stored, how long we keep it, how we secure it, and the rights available to you.

This Policy is drafted to comply with the Saudi Personal Data Protection Law issued by Royal Decree No. M/19 (the "PDPL") and its Implementing Regulations, including the Regulation on Personal Data Transfer outside the Kingdom, as supervised by the Saudi Data and Artificial Intelligence Authority ("SDAIA"). It also reflects our obligations under the Saudi E-Commerce Law, the Electronic Transactions Law, the Anti-Cyber Crime Law, the VAT and e-invoicing rules of the Zakat, Tax and Customs Authority ("ZATCA"), and the regulatory framework administered by the General Authority for Real Estate ("REGA") in relation to owners associations.

2. Who we are and how to contact us

• Data controller: Jiwar Digital Solutions Company
• Unified National Number (UNN): 7050481188
• VAT registration number: 311084426300003
• Address: Al Qashashiyah, Al Nada District, Riyadh 13317, Kingdom of Saudi Arabia
• Privacy contact: support@jiwarcom.com

For all privacy enquiries, requests to exercise your rights, or complaints, please contact our Privacy Office through the in-app support channel or at the privacy contact above.

2.1 Controller and processor roles

Jiwar acts as the data controller for the personal data described in this Policy — including account registration data, authentication data, subscription, billing, and invoicing records, platform usage data, and website enquiries.

For certain limited processing, an Owners' Union or a company may determine its own purposes for personal data it uploads or accesses through the Platform (for example, a union's own membership register or a company's own workforce records). In those cases the union or the company is an independent controller of that data and is responsible for its own compliance with the PDPL. Jiwar processes such data on their behalf in accordance with our contractual terms.

3. Scope of this Policy

This Policy applies to:

• The Jiwar mobile application (iOS and Android);
• The Jiwar web command centre;
• Our public website, including its contact form;
• Communications we send to you, including SMS one-time passcodes, push notifications, transactional emails, and invoices.

The Jiwar Toolbox browser extension is covered by this Policy together with its own Toolbox Terms of Use. This Policy does not apply to third-party services you may access from within the Platform, nor to the internal processing carried out by a company or an Owners' Union outside the Platform. Those parties operate under their own privacy notices.

4. Categories of personal data we collect

4.1 Identity and contact data

• Full name
• Mobile telephone number in E.164 international format (this is your primary account identifier)
• Email address, and whether you have verified it
• Date of birth
• Gender
• Language and display preferences
• National ID / Iqama number — collected for identity verification and ownership validation. We store this value only as a salted cryptographic hash. We do not retain the plaintext national ID number at rest. The hash is used solely to confirm that a claimed identity matches a record; it cannot be reversed to recover the original number.

4.2 Property and ownership data

• Unit and property details (complex, building, unit number, floor, area, unit type)
• The location of the complex (map coordinates, region, city, district)
• Title deed references (صك) and associated identifiers
• Ownership shares and voting weight within the Owners' Union
• Residency and tenancy contract details for residents and tenants
• Your role within a community: Union Chairman, Union Board Member, Unit Owner, Resident/Tenant, Company Owner, or Company Employee

4.3 Operational and service data

• Maintenance tickets, their descriptions, categories, priority, status history, and resolution notes
• Photographs, video recordings, and audio recordings attached to tickets
• Chat messages exchanged between residents, union representatives, and company personnel through the Platform
• Shared-area bookings, the booking terms you accepted, and electronic signatures you gave on them
• Ratings, reviews, and feedback you submit about companies
• Union governance records such as announcements, meeting notices, and voting participation
• Notifications sent to you, and your notification preferences

4.4 Financial and billing data

• Subscription status, trial and billing periods, billed Unit counts, and payment history
• The identity of the person who made each payment (the payer)
• The Union's billing profile printed on its invoices: buyer name, VAT number, Unified National Number (UNN), and national address
• Tax invoices and credit notes issued in accordance with ZATCA e-invoicing requirements
• Payment status and authorisation references returned by our payment gateway
• For a card the payer chooses to save: a token issued by the gateway, the card brand, the last four digits, and the expiry month and year

We never receive or store full payment card numbers or security codes (CVV). All card data is captured and processed directly by our payment gateway, Tap Payments, in its own PCI-DSS-certified environment.

4.5 Technical and device data

• Push notification tokens and the device platform they belong to
• Device model, operating system and version, application version, and language settings
• IP address
• Log data, including timestamps, request identifiers, API endpoints accessed, and error diagnostics
• Error reports (crash and exception details) and performance measurements (such as page-load timings)
• Product usage events (such as "ticket created" or "checkout started"), linked to a pseudonymous identifier rather than your name or number

4.6 Website enquiries

When you use the "Talk to us" form on our website we collect your full name, your email address, your mobile number if you choose to give it, the language of the page, and a one-way hash of your IP address (used to detect abuse; we do not store the address itself).

5. How we collect personal data

We collect personal data:

• Directly from you — when you register, complete your profile, create a ticket, upload media, make a booking, pay, send a message, contact support, or submit our website contact form.
• From an Owners' Union or its Chairman — when a union invites you to join a community, or records your unit, ownership share, or residency status, including records the Chairman saves to the Platform through the Jiwar Toolbox from the Mullak platform, as described in the Toolbox Terms of Use.
• From a company — when it invites its employees to the Platform.
• Automatically — through your use of the mobile application, the web command centre, and the website, including device, log, error, and performance data.
• From third parties — such as our payment gateway (payment outcome and card token data), our SMS and email providers (delivery status), and ZATCA (invoice validation results).

6. Purposes of processing and lawful bases

Under the PDPL and its Implementing Regulations, we rely on the following lawful bases.

6.1 Performance of a contract

• Creating and administering your account
• Authenticating you by SMS one-time passcode
• Assigning you to the correct Owners' Union, complex, and unit
• Enabling the creation, routing, escalation, and closure of maintenance tickets
• Managing shared-area bookings and their payments
• Delivering in-platform messaging and notifications by push, SMS, and email
• Running free trials, subscriptions, renewals, reminders, invoicing, and payment collection
• Answering enquiries you send us through our website

6.2 Compliance with a legal obligation

• Issuing compliant tax invoices, reporting them to ZATCA through its e-invoicing (Fatoora) platform, and retaining accounting records under ZATCA rules
• Retaining records required under the Saudi Commercial Books Law and applicable tax legislation
• Responding to lawful requests from competent Saudi authorities, including SDAIA and REGA
• Meeting disclosure requirements under the Saudi E-Commerce Law
• Cooperating with investigations under the Anti-Cyber Crime Law

6.3 Legitimate interests

Where permitted by the PDPL, we process personal data for our legitimate interests, provided these are not overridden by your rights and freedoms:

• Securing the Platform, detecting fraud and abuse (including spam sent through our website), and preventing unauthorised access
• Monitoring availability and performance, diagnosing faults, and improving Platform features, using our self-hosted monitoring systems
• Producing aggregated and de-identified statistics about Platform usage
• Establishing, exercising, or defending legal claims

6.4 Consent

We rely on your explicit consent for:

• Accessing your device camera, microphone, photo library, or location when you attach media to a ticket or set a location
• Sending push notifications
• Saving a payment card for future renewals
• Sending marketing or promotional communications
• Any non-essential cookies on our website

You may withdraw consent at any time, through your device or in-app settings or by contacting our Privacy Office. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect processing that rests on another lawful basis. Where a feature depends on the consent you withdraw, that feature may cease to function.

6.5 Purpose limitation and data minimisation

We process personal data only for the purposes set out in this Policy or for a compatible purpose that you would reasonably expect. We collect only the data necessary to achieve those purposes, and we configure our systems so that each role sees only the data required to perform its function.

7. How we share personal data

We do not sell personal data, and we do not use advertising networks or third-party advertising trackers. We share personal data only as set out below.

7.1 Within an Owners' Union community

• Union Chairman and Board Members may view unit records, ownership shares, resident lists, ticket histories, bookings, and union financial records for their own community only.
• Unit Owners and Residents may view their own unit, ticket, and booking data, plus community-wide announcements.
• Personal data is never visible across communities. A user in one complex cannot see the residents, units, or tickets of another.

7.2 With companies — need-to-know basis

When an Owners' Union engages a company through the Platform, that company and its assigned employees receive only the data necessary to perform the engaged service: the relevant ticket details and attached media, the unit or common-area location, and the reporting party's name and mobile number where contact is required. Where a union appoints a company to manage it, the company sees the union's records within the scope the union grants. Companies do not receive national ID hashes, dates of birth, or ticket data from unions they do not serve.

7.3 With our service providers (processors)

| Provider | Purpose | Data involved |
|---|---|---|
| Tap Payments | Processing subscription and booking payments; tokenising cards that payers choose to save | Payer name, mobile number, email, amount and description; card data captured directly by Tap |
| Twilio | Sending SMS one-time passcodes and SMS notifications such as invitations | Mobile number, message content, language |
| SNDR | Delivering transactional email: notifications, invoices, email verification codes, and website enquiries to our team | Email address, name, message content, invoice attachments |
| Firebase Cloud Messaging (Google) | Delivering push notifications to your device | Push token, notification title and short text, in-app link |
| Oracle Cloud Infrastructure (OCI) | Hosting our servers, databases, file storage, and backups | All categories described in section 4 |

Each processor is bound by a written agreement that requires it to process personal data only on our documented instructions, to apply appropriate security measures, to impose equivalent obligations on any sub-processor, and to delete or return data at the end of the engagement.

Identity and session management (Keycloak), image processing, and our monitoring stack (application logs, metrics, traces, and error tracking) are software that we operate ourselves on the infrastructure above; they do not involve disclosure to another company.

7.4 With competent authorities

We may disclose personal data where required by Saudi law, court order, or a lawful request from a competent authority, including SDAIA, REGA, ZATCA, and law enforcement agencies. Tax invoices, which include the buyer details of standard tax invoices, are reported to or cleared with ZATCA as the e-invoicing rules require. We assess each request for validity and disclose only the minimum data necessary.

7.5 Corporate transactions

If we are involved in a merger, acquisition, or transfer of assets, personal data may be transferred to the successor entity, subject to that entity honouring commitments no less protective than this Policy and to any approval required under the PDPL.

8. Data location and cross-border transfers

Jiwar's production platform is hosted on Oracle Cloud Infrastructure in a data-centre region located in the Kingdom of Saudi Arabia. Account, property, ticket, booking, billing, and invoice data — including ticket media, identity records, logs, and backups — are stored there.

Some delivery providers in section 7.3 process a limited subset of data outside the Kingdom in order to deliver a message or a payment: Twilio (your mobile number and the SMS text), SNDR (your email address and the email content), and Firebase Cloud Messaging (your device's push token and the notification text). Tap Payments processes payment data within its own regional infrastructure.

We make such transfers only in accordance with Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, and only after we have:

• Confirmed that the transfer does not prejudice national security or the vital interests of the Kingdom;
• Satisfied ourselves that the receiving jurisdiction offers an adequate level of protection, or applied appropriate safeguards such as standard contractual clauses;
• Limited the transfer to the minimum data necessary for the purpose;
• Obtained any approval or exemption required from SDAIA or the competent authority.

A current list of transfer arrangements is available on request from our Privacy Office.

9. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or for such longer period as Saudi law requires.

| Data category | Retention period |
|---|---|
| Account profile and identity data | For the life of the account, then 12 months after closure to handle disputes and re-activation |
| National ID salted hash | For the life of the account, then destroyed on closure unless required for an open dispute |
| Unit, ownership, and title deed references | For the duration of the union's use of the Platform, then as required by REGA and union governance rules |
| Maintenance tickets and attached media | 5 years from ticket closure, supporting warranty and liability claims |
| In-platform chat messages | 3 years from the date sent |
| Bookings and signed booking terms | 5 years from the booking date |
| Invoices, credit notes, payment records, and tax documents | 10 years from the end of the relevant tax period, per ZATCA and Saudi commercial record-keeping requirements |
| Saved card token, brand, last four digits, and expiry | Until the card is removed, the Chairman role changes, or the Union's Subscription ends |
| Website enquiries | 24 months from receipt |
| Authentication and security audit records | 12 to 24 months |
| Application logs | 30 days |
| Error reports | 30 days |
| Product usage events | 180 days |
| Performance metrics | 90 days, aggregated |
| Push notification tokens | Until the token expires, the app is uninstalled, you sign out, or notifications are disabled |
| Marketing consent records | Until consent is withdrawn, plus 2 years as proof of consent |

At the end of the applicable period we securely destroy, delete, or irreversibly anonymise the data. Anonymised and aggregated data that can no longer identify any individual may be retained indefinitely for statistical and product purposes.

10. Security measures

We implement technical and organisational measures appropriate to the risk, including:

• Encryption in transit — all communication between clients and our servers uses TLS 1.2 or above.
• Encryption at rest — databases, file storage, and backups are encrypted at rest.
• National ID hashing — national identity numbers are stored only as salted hashes, never in plaintext.
• Passwordless authentication — access relies on a mobile number plus a time-limited SMS one-time passcode, eliminating password reuse and credential-stuffing risk. OTPs are rate-limited and expire after a short validity window.
• Centralised identity management — authentication, session lifetime, and token issuance are managed by our own Keycloak deployment with short-lived access tokens and rotating refresh tokens.
• Role-based access control — permissions are enforced server-side according to your role.
• Tenant isolation — every record is scoped to its tenant, and queries are constrained at the data-access layer so that no user can retrieve data belonging to another union or company.
• Card tokenisation — card details never reach our servers; renewals use a gateway token.
• Least privilege for staff — internal administrative access is restricted, individually attributed, and logged.
• Signed, time-limited media URLs — ticket photographs, videos, and audio are served through expiring signed links rather than public URLs.
• Self-hosted monitoring and audit logging — security-relevant events are logged and monitored on our own infrastructure, with alerting.
• Secure development — code review, dependency scanning, and privacy-by-design assessment for new features.
• Backups — encrypted backups with periodic restoration testing.

No system can be guaranteed absolutely secure. You are responsible for keeping your mobile device and SIM secure and for never sharing your one-time passcode with anyone. Jiwar staff will never ask you for your OTP.

11. Your rights under the PDPL

Subject to the conditions and exceptions in the PDPL and its Implementing Regulations, you have the right to:

• Be informed — to know the legal basis and purpose of collecting your personal data.
• Access — to obtain confirmation of whether we process your data and to receive a copy of it.
• Obtain a copy in a readable, portable format — to receive your data in a structured, commonly used electronic format.
• Correct — to have inaccurate, incomplete, or outdated data rectified.
• Destroy — to request deletion of data that is no longer necessary for the purpose for which it was collected. This right does not extend to data we must retain by law (for example tax invoices) or that is required to establish or defend a legal claim.
• Withdraw consent — where processing is based on consent.
• Object or restrict — to object to processing based on legitimate interests, and to request restriction while an objection or correction request is assessed.
• Complain — to lodge a complaint with SDAIA if you believe your rights have been infringed.

11.1 How to exercise your rights

Submit a request through the in-app support channel or by contacting our Privacy Office. We will:

1. Verify your identity, typically by confirming control of the registered mobile number;
2. Acknowledge your request promptly;
3. Respond within 30 days of receipt, extendable by a further period where the request is complex, in which case we will explain the reason for the delay.

You can reach our Privacy Office at support@jiwarcom.com.

We do not charge a fee for a first request. We may charge a reasonable, cost-based fee for manifestly unfounded, repetitive, or excessive requests, or refuse to act on them, explaining our reasons.

Where you exercise a right in relation to data controlled by your Owners' Union or a company, we will forward your request to the relevant controller and assist them in responding.

12. Personal data breach notification

We maintain an incident response procedure covering detection, containment, assessment, notification, and remediation.

If a personal data breach occurs that may cause harm to personal data or to data subjects, we will notify SDAIA within 72 hours of becoming aware of it, in accordance with the Implementing Regulations. Where the breach is likely to cause serious harm to you, we will notify you without undue delay, describing the nature of the breach, the categories of data affected, the likely consequences, the measures we have taken, and the steps you can take to protect yourself.

We maintain an internal register of all breaches, including those not requiring notification.

13. Children's data

Jiwar is not directed at children. Accounts may only be created by individuals aged 18 or over who have the legal capacity to enter into a binding agreement.

We do not knowingly collect personal data from children. Where a Unit Owner or Chairman records household members who are minors as part of a residency record, that data is limited to what is necessary for community administration, is visible only to authorised union representatives, and is processed on the basis of the parent's or legal guardian's consent, which the recording party is responsible for obtaining.

If we learn that we have collected personal data from a child without appropriate guardian consent, we will delete it promptly. If you believe a child's data has been provided to us, contact our Privacy Office.

14. Cookies and similar technologies

14.1 Website

Our public website uses only:

• Preference cookies — one remembering your language (Arabic or English) and one remembering your light or dark display choice. They contain no personal data.
• Strictly necessary cookies — set only for our staff when they sign in to the website's content-management area.

We do not use advertising or cross-site tracking cookies. If we enable website analytics, we use a privacy-respecting tool hosted on our own infrastructure that does not use cookies or identify you across sites. We will ask for your consent before using any non-essential cookie.

14.2 Mobile applications and command centre

The mobile applications and the command centre use secure local storage for session tokens and preferences. Error reports and performance measurements are sent to our own servers to help us fix faults; they are not shared with analytics or advertising companies. We do not use advertising identifiers or track you across apps.

15. Automated decision-making

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. Automated logic is used only for operational purposes — for example, routing a ticket to a company based on its scope of work, prioritising tickets by category, calculating a subscription fee from the Unit count, or sending a renewal reminder. Decisions about tickets are subject to human review and override by union or company personnel, and you may ask us to review any billing calculation.

16. Changes to this Policy

We may update this Policy to reflect changes in our services, technology, providers, or legal obligations. The current version and its effective date are always published in the application and on our website.

Where a change materially affects your rights or how we use your data, we will notify you in advance through the Platform, by push notification, email, or SMS, and where the PDPL requires it, we will seek fresh consent before implementing the change.

17. Complaints

If you have a concern about how we handle your personal data, please contact our Privacy Office first — we aim to resolve issues directly and quickly.

You also have the right, at any time, to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent supervisory authority for personal data protection in the Kingdom of Saudi Arabia, through its official channels.

18. Governing law

This Policy is governed by the laws of the Kingdom of Saudi Arabia. Any dispute arising from it is subject to the exclusive jurisdiction of the competent Saudi courts and authorities. In the event of any inconsistency between the Arabic and English versions of this Policy, the Arabic version prevails.