Protecting your personal data

1. Data Controller and Scope

1.1 Fared — an entity duly registered in the Kingdom of Saudi Arabia — is the data controller for personal data processed through the app and website, and is responsible for determining the purposes and means of processing.

1.2 This policy applies to all personal data collected from Platform users — sellers, buyers, bidders and visitors — through the Fared app on the App Store and Google Play, the website, and our support channels.

1.3 This policy forms an integral part of the Terms & Conditions and is to be read together with them.

1.4 In processing your data we adhere to the principles of lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and confidentiality and security.

2. Definitions

• Personal data: any information — whatever its source or form — that may lead to identifying an individual specifically, or that makes identifying them possible directly or indirectly.
• Processing: any operation carried out on personal data by any means, including collection, recording, storage, amendment, use, disclosure, transfer and destruction.
• Controller: the entity that determines the purpose and manner of processing — that is, Fared.
• Processor: the entity that processes data on behalf of and for the account of the controller.
• Data subject: the individual to whom the personal data relates — that is, you.
• Competent authority: the authority supervising the application of the Personal Data Protection Law in the Kingdom.

3. Personal Data We Collect

We collect the minimum data necessary to operate the Platform and protect the parties to a transaction:

• Account data: name, mobile number, email address, city, and profile photo if you add one.
• Identity verification data: what is needed to verify your identity before enabling you to sell, bid or receive proceeds, including national ID or residency number where requested.
• Plate data: the letters and digits of the listed plate, its category, city and asking price.
• Transaction data: records of Listings, offers, bids, and completed and cancelled Transactions.
• Payment transfer data: the bank transfer receipt or its image that you upload as proof of payment, the bank name, and the account number to which proceeds are paid.
• Communications data: the content of your in-app chats with the other party, support tickets and your correspondence with us.
• Technical and usage data: device type, operating system, app version, device identifier, IP address, and login, crash and browsing logs.
• Approximate location: the city inferred from your settings or IP address, used to show plates available near you. We do not collect your precise location except with your explicit consent through your device settings.

4. Sources of Collection

• Directly from you: on registration, publishing a Listing, submitting an offer, bidding, or contacting support.
• Automatically from your use of the Platform: through server logs and performance and crash-detection tools.
• From third parties: identity verification providers, government authorities or banks, to the extent necessary to complete a Transaction and verify the correctness of procedures, and as permitted by law.

5. Purposes of Processing and Legal Basis

We process your data only for a specified, explicit and legitimate purpose, on one of the following bases:

• Performance of a contract: creating your account, publishing your plate, managing offers and auctions, operating escrow payments, following up ownership transfer, and disbursing proceeds.
• Your explicit consent: sending marketing messages, enabling notifications, and accessing your camera, photos or precise location.
• Legal obligation: identity verification, retaining transaction records, responding to requests from competent authorities, and complying with anti-money laundering and tax laws.
• Legitimate interest: preventing fraud and abuse, securing the Platform, improving its performance and user experience, and producing aggregate statistical analyses that do not identify individuals.
• Protection of life or vital interests: in exceptional cases requiring it.

We do not use your data for a purpose different from those above without notifying you and obtaining your consent where legally required.

6. Disclosure and Sharing

We do not sell, rent or trade your personal data to any party. Sharing is limited to the following cases and to the extent necessary in each:

• The other party to a Transaction: only the data necessary to complete the plate ownership transfer is shared. Your mobile number is not disclosed to the other party as long as communication takes place through in-app chat.
• Processors and service providers: cloud hosting, notifications, analytics, fraud prevention and technical support providers, under written agreements binding them to confidentiality and to processing data only on our instructions and for our account.
• Banks and financial institutions: to the extent necessary to execute and verify transfers.
• Government and judicial authorities: where there is a lawful request or judicial order from a competent authority in the Kingdom, or to protect our rights or those of our users.
• Corporate restructuring: in the event of a merger, acquisition or transfer of business, data is transferred to the successor entity and this policy continues to apply to it.

7. Transfers Outside the Kingdom

As a rule, your data is stored and processed inside the Kingdom of Saudi Arabia. Where technical necessity requires the use of a service provider outside the Kingdom, the transfer is carried out in accordance with the controls set out in the Personal Data Protection Law and its Implementing Regulations — after verifying the level of protection at the receiving party, putting the necessary contractual safeguards in place, and limiting the transfer to the minimum data required for the purpose.

8. Retention and Destruction

• 8.1 We retain your data for as long as necessary to achieve the purpose of its collection, and for the duration your account remains active.
• 8.2 After account deletion, we retain completed transaction records and financial documents for the periods required by accounting, tax and anti-money laundering laws in the Kingdom.
• 8.3 Once the purpose of processing ends and the statutory periods expire, data is securely destroyed or de-identified so that it can no longer be traced back to you.
• 8.4 We may retain data necessary to establish or defend a legal claim in an ongoing dispute until it is concluded by a final judgment.

9. Data Security

• 9.1 We use encryption in transit (HTTPS/TLS) and encrypt sensitive data at rest.
• 9.2 We apply strict access controls based on the need-to-know principle, so only those who require data to perform their work can access it.
• 9.3 We carry out periodic security reviews and backups, and log access to sensitive data.
• 9.4 Our personnel and service providers are bound by confidentiality undertakings.
• 9.5 Nevertheless, no system on the internet can guarantee absolute security. We therefore recommend keeping your login credentials confidential, never sharing a verification code with anyone, and enabling your device lock.

10. Your Rights Under the PDPL

The law grants you the following rights, and we undertake to enable you to exercise them free of charge:

• Right to be informed: to know the legal basis for collecting your data and the purpose of processing it.
• Right of access: to view the personal data we hold about you.
• Right to obtain a copy: to receive a copy of your data in a clear, readable format.
• Right to rectification: to request correction, completion or updating of any inaccurate or incomplete data.
• Right to destruction: to request destruction of your data once it is no longer needed, subject to the retention periods and legal obligations set out in Clause 8.
• Right to withdraw consent: to withdraw your consent at any time to processing based on consent, without retroactive effect on what took place before withdrawal.
• Right to object: to object to processing of your data for direct marketing and to stop promotional messages.

Some requests may not be capable of being fulfilled in whole or in part where they conflict with a legal obligation, the rights of others, or an ongoing investigation or claim. In such cases we will explain the reason to you.

11. Exercising Your Rights and Complaints

• 11.1 To exercise any of the rights above, write to us at contact@fared.app from the email registered on your account, stating the right you wish to exercise.
• 11.2 We may ask you to verify your identity before acting on a request, to protect your data from disclosure to anyone other than you.
• 11.3 We respond to requests within thirty (30) days of receiving them complete; this period may be extended for complex requests, and we will notify you if so.
• 11.4 If you are not satisfied with our response, you have the right to lodge a complaint with the authority competent to supervise the application of the Personal Data Protection Law in the Kingdom of Saudi Arabia.

12. Consent and Withdrawal

Where processing relies on your consent, that consent is explicit, specific and informed, and you may withdraw it at any time as easily as it was given — through the app settings or by writing to us. Withdrawal has no retroactive effect on processing carried out before it, and may mean some related services can no longer be provided.

13. Cookies and Local Storage

• 13.1 The Fared website uses local storage in your browser to save your preferences only — such as your chosen language and light or dark display mode.
• 13.2 We may use cookies that are strictly necessary to operate the site, maintain your login session and ensure security.
• 13.3 We do not use advertising cookies to track you across other websites, and we do not sell your browsing data to advertisers.
• 13.4 You may delete or disable this data at any time from your browser settings, noting that disabling strictly necessary items may affect how some features work.

14. App Permissions on Your Device

The app requests a permission only when it is needed, and you may refuse it or withdraw it later from your device settings:

• Camera and photos: to upload a plate image, a transfer receipt or a profile photo.
• Notifications: to alert you to offers, bids, auctions nearing close, and the status of your Transaction.
• Location: to show plates available in your city — an entirely optional permission.

15. Marketing and Notifications

• 15.1 We send marketing messages only with your prior consent, and you may stop them at any time from the app settings or via the unsubscribe link in the message.
• 15.2 Operational notifications relating to your account, Transactions and auctions continue while your account is active, as they form part of delivering the service.

16. Automated Processing and Decision-Making

We may use automated tools to detect fraud and non-compliant Listings and to rank search results. We do not take any decision producing legal effects on you — such as suspending an account or cancelling a Transaction — on the basis of automated processing alone; such cases are subject to human review, and you have the right to object to the decision and request that it be reviewed.

17. Children's Privacy

Fared's services are intended for those aged eighteen (18) years and above. We do not knowingly collect data from anyone below that age. If we become aware otherwise, we delete the data and close the account immediately. If you are a guardian and believe a minor has provided us with their data, please contact us so we can take the necessary action.

18. Third-Party Sites and Services

The website or app may contain links to sites or services not operated by Fared — such as app stores, social platforms and government channels. We are not responsible for the privacy policies or practices of those parties, and we recommend reviewing their policies before providing them with any data.

19. Data Breach Notification

In the event of a leak, disclosure or unauthorised access to your personal data, we undertake to take corrective action immediately and to notify the competent authority and inform you within the periods and under the controls prescribed by the Personal Data Protection Law and its Implementing Regulations, where the incident could harm your data or your rights.

20. Updates to This Policy

We may update this policy from time to time to keep pace with the development of our services or changes in the law. The version number and last-updated date are published at the top of this page, and we notify you of material changes through the app or by email before they take effect. Continuing to use the Platform after they take effect constitutes awareness and acceptance of the updated version.

21. Contact

By using the Fared platform, you confirm that you have reviewed this Privacy Policy and understand how your personal data is processed.