Privacy Policy

Saveto — Version 0.1 — Dated: July 2026

1. Introduction

Saveto ("we", "us", "our") is committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and other applicable regulations for the purposes of providing our products ("service"), and access to use our application ("product").

For the purposes of this document the term "Law" shall refer to the Personal Data Protection Law brought into effect by the Saudi Data & AI Authority (SDAIA). The term "Regulation" refers to the Personal Data Protection Regulations published by SDAIA to aid the implementation of the Law.

2. Data Controller

Saveto is the data controller of all personal information provided to us through our platform or collected during your interaction with our services.

Saveto is committed to ensuring that your privacy is protected and ensures that Saveto complies with all regulatory requirements regarding the protection of your personal data under the Personal Data Protection Law (PDPL). This Privacy Policy explains the measures put in place to protect your personal data and how Saveto uses the information collected.

3. Personal Data We Collect

Saveto collects personal data from customers, suppliers, business partners, website visitors, job applicants, employees, and other individuals who interact with us. The personal data we collect may include:

3.1 Information You Provide to Us

We may collect personal data that you provide directly, including:

• Identification information, such as your name and job title.
• Contact information, such as your email address, telephone number, and national address/residential address.
• Business and commercial information required to establish or manage business relationships.
• Financial and payment information where necessary to process transactions.
• Information submitted through enquiries, contact forms, surveys, events, recruitment applications, or other communications with Saveto.

3.2 Information Collected Automatically

When you visit our website or use our digital services, we may automatically collect certain technical information, including:

• Device and browser information.
• IP address and network information.
• Website usage and browsing activity.
• Information collected through cookies, analytics tools, and similar technologies.

3.3 Information Obtained from Other Sources

Where permitted by applicable laws and regulations, we may obtain personal data from third parties, including business partners, service providers, recruitment agencies, publicly available sources, government authorities, and other authorized parties.

3.4 Employee and Applicant Data

For recruitment and employment purposes, Saveto may collect and process personal data relating to job applicants, employees, contractors, and temporary staff, including:

• Identification information, such as full name, national ID, residency information, passport details, and other identity documents.
• Contact information, including telephone numbers, email addresses, and national addresses.
• Recruitment and employment information, including resumes, qualifications, employment history, references, job applications, and interview records.
• Payroll and financial information, including salary details and bank account information.
• Emergency contact and dependent information where required.
• Information required for insurance, medical coverage, government registrations, and other employment-related obligations.

Where necessary for employment-related purposes, workplace security, attendance management, insurance administration, or compliance with legal and regulatory requirements, Saveto may also process:

• Health information required for employment, insurance, or occupational health and safety purposes.
• Biometric data used for attendance management and access control.

Such personal data will be processed only for legitimate employment-related purposes and in accordance with applicable legal and regulatory requirements.

4. Purposes and Legal Basis for Processing

Saveto processes personal data only for legitimate business purposes and where a lawful basis for processing exists under applicable laws and regulations.

We may process personal data for the following purposes:

• Managing customer, supplier, contractor, and business partner relationships.
• Processing enquiries, quotations, orders, deliveries, payments, and other commercial transactions.
• Establishing, administering, and maintaining customer and supplier accounts.
• Managing recruitment activities, employment relationships, payroll, benefits, attendance, and workforce administration.
• Responding to enquiries, requests, feedback, and complaints submitted through our website, email, telephone, or other communication channels.
• Sending marketing communications, newsletters, and information about our products, services, events, and promotions where permitted by law or where consent has been obtained, where required.
• Operating, maintaining, and improving our website, systems, products, and services.
• Protecting the security of Saveto's facilities, systems, assets, employees, customers, and business operations.
• Complying with legal, regulatory, contractual, and governmental requirements.

Depending on the nature of the processing activity, Saveto may rely on one or more of the following legal bases:

• Your consent.
• Processing necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Compliance with legal or regulatory obligations applicable to Saveto.
• Legitimate interests pursued by Saveto, provided such interests do not override your rights and interests.
• Processing necessary to protect the actual interests of the data subject where communication with the data subject is not possible or is difficult.
• Any other legal basis permitted under applicable laws and regulations.

5. Data Minimization and Accuracy

• We collect only the minimum amount of information necessary to provide our services and fulfill our legal obligations. We ensure this by only collecting the data necessary to access your information directly from government portals. We also take steps to ensure that the personal data we process is accurate, complete, and kept up-to-date, including regular retrieval of data from medical insurance websites government portals, Government authorities, regulators, and law enforcement agencies, where required by law.

6. Data Subject Rights

In accordance with the PDPL, individuals whose personal data is processed by Saveto may have the following rights, subject to applicable legal and regulatory requirements:

• The right to be informed about the legal basis and purpose of collecting and processing their personal data.
• The right to access their personal data held by Saveto.
• The right to request a copy of their personal data in a clear and readable format, where technically feasible.
• The right to request correction, completion, or updating of inaccurate or incomplete personal data.
• The right to request the destruction of their personal data when it is no longer required for the purpose for which it was collected, subject to applicable legal, regulatory, or contractual retention obligations.
• The right to withdraw consent where processing is based on consent, unless another lawful basis for processing applies.

To exercise these rights or make a request, please fill in the Data Subject Request form given in the website and email to our Data Protection Officer at: [email protected]

We shall, upon receiving your request regarding your rights do the following:

• a) Act on your request exercising your rights under the Law within a period not exceeding (30) days and without delay. This period may be extended in case the implementation requires disproportionate effort, or if we receive multiple requests from you, the data subject, provided that the extension period does not exceed an additional (30) days and that you, the Data Subject, are notified in advance of the extension with the reasons for the delay.
• b) Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising your rights.
• c) Take appropriate measures to verify your identity as the requester before executing the request in accordance with relevant legal requirements.
• d) Take the necessary measures to document and keep record of all received requests including oral requests.

While you as a data subject have the right to withdraw consent for the processing of your personal data at any time, this will mean the cancellation of any services provided by Saveto related to the processing of that personal data. You as a Data Subject must also note that while processing activities may stop, your data must still be stored for a period of 10 years as required.

We may refuse a Data Subject Rights request when it is repetitive, manifestly unfounded, or requires disproportionate efforts, in which the Data Subject shall be notified of such reason.

Saveto does not intentionally collect or process personal data relating to individuals who fully or partially lack legal capacity. Where Saveto becomes aware that such personal data has been collected, it will be handled in accordance with applicable legal and regulatory requirements.

7. Data Storage & Retention

Saveto stores personal data through a combination of on-premises and cloud-based systems used to support its business operations. Depending on the services utilized, personal data may be stored or processed within the Kingdom of Saudi Arabia where Saveto's authorized service providers maintain their infrastructure. Saveto will ensure that appropriate safeguards are implemented and that such processing is carried out in accordance with applicable legal and regulatory requirements.

Saveto retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal, regulatory, contractual, or business requirements, or establish, exercise, or defend legal claims.

In certain circumstances, we may retain specific categories of personal data for extended periods where there is a documented legal, regulatory, operational, or legitimate business need to do so. Such retention will be supported by appropriate justification and reviewed periodically to ensure continued necessity and compliance with applicable laws and regulations.

When personal data is no longer required and there is no lawful basis or justified business need for its retention, Saveto will securely delete, destroy, or anonymize the personal data in accordance with its applicable data retention and disposal practices.

Where personal data is anonymized, Saveto will take reasonable measures to ensure that the data can no longer be associated with or used to identify an individual, either directly or indirectly.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include, but are not limited to:

• Regular security assessments and audits
• Access controls and authentication measures
• Secure backup and recovery processes.
• Monitoring and management of information security risks.
• Employee training on data protection and security.
• Security requirements for third-party service providers that process personal data on our behalf.

We consider privacy and data protection requirements when designing, implementing, and updating our business processes, systems, and services.

Saveto regularly reviews and updates its security measures to support the ongoing protection of personal data and compliance with applicable legal and regulatory requirements.

9. Data Sharing and Transfers

We may share your personal data with the following entities:

• Affiliated companies within the Saveto Group, including UBM and Insuwrap.
• Third-party service providers supporting hosting, cloud services, website and application maintenance, database storage, email management, customer service, marketing, and order fulfillment.
• Professional advisors, auditors, and consultants.
• Insurance websites government portals, Government authorities, regulators, and law enforcement agencies, where required by law.
• Other parties where consent has been obtained or another lawful basis for processing applies.

We ensure that any third parties processing personal data on our behalf implement appropriate safeguards and process personal data in accordance with applicable legal and regulatory requirements.

Where personal data is transferred outside the Kingdom of Saudi Arabia, such transfers will be conducted in accordance with the PDPL and applicable regulatory requirements.

10. Cookies and Marketing Communications

10.1 Cookies

We may use cookies and similar technologies on our website and digital platforms to improve user experience, maintain website functionality, and analyze website usage, and support security and performance monitoring.

Cookies may collect information such as browser type, device information, IP address, pages visited, and interactions with our website. Users may manage or disable cookies through their browser settings, however, doing so may affect the functionality of certain features of the website.

10.2 Marketing Communications

Saveto may send marketing, promotional, product, service, event, or other business-related communications to customers, prospective customers, and business contacts.

Where consent is required by applicable laws and regulations, Saveto will obtain the appropriate consent before sending marketing communications.

Personal data used for marketing communications will be processed in accordance with applicable legal and regulatory requirements and only for the purposes for which it was collected or where another lawful basis for processing applies.

Individuals may opt out of receiving marketing communications at any time or request changes to their communication preferences by contacting Saveto using the contact details provided in Section 12 of this Privacy Policy.

Saveto will review and process such requests in accordance with applicable legal and regulatory requirements.

11. Changes to Privacy Policy

Saveto may update this Privacy Policy from time to time to reflect changes in its business operations, legal obligations, regulatory requirements, or personal data processing practices.

Any updates will be published on Saveto's website and will become effective from the date of publication. Where required by applicable laws and regulations, Saveto will provide additional notice or obtain consent before implementing material changes.

12. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy, including exercising your rights as a data subject, please contact us at:

Email: [email protected]
Phone: +966 11 265 3334

For data protection specific enquiries, including Data Subject Rights requests, please contact our DPO at:

Email: [email protected]

Saveto is committed to addressing your privacy-related enquiries promptly and ensuring that your privacy preferences are respected.

13. Complaints

If you have concerns regarding the processing of your personal data or believe that your rights under the PDPL have not been respected, you may contact Saveto using the contact details provided above.

If you are not satisfied with Saveto's response, you may submit a complaint to the competent authority in accordance with applicable laws and regulations.