privacy
policy

1. Overview

The Social Development Bank understands the importance of your Privacy and Personal Data. Therefore, we are committed to keeping all important information and data of all users safe, secure and confidential.

2. Purpose of the Policy

This Privacy Policy is framed in accordance with the Personal Data Protection Law and applicable Regulations in the Kingdom of Saudi Arabia. The purpose of this Policy is to explain how the Bank processes your personal data, to help you understand why we collect, use, share, and store, and the steps taken to make sure it stays confidential and secure.

3. Collection of Personal Data

The purpose of collecting Personal Data is directly related to the legitimate purposes defined in the e-portal and shall be presented before collection. The methods and means of collecting personal data are appropriate to the owner's circumstances, direct, clear, secure, and free from deception, misleading information or blackmail. If it becomes clear that the personal data collected is no longer necessary to achieve the purpose of its collection, the Social Development Bank e-portal will stop hoarding it and destroy the previously collected data immediately.

The Social Development Bank e-portal will ensure that the following criteria are met before collecting your Personal Data:

1. The purpose of collecting your personal data, including whether the collection is mandatory or optional, with further information about the processing of data that does not conflict with the rights and freedom of the data subject.

2. The identity and contact details of the controller of the personal data where applicable.

3. The entity or entities to which the personal data will be disclosed and a description of whether the personal data will be transferred, disclosed or processed outside the Kingdom.

4. The potential effects and risks of non-compliance with the personal data collection procedure.

5. Your privacy and data protection rights as stipulated in the law.

6. Other elements specified by the regulations depending on the nature of the activity carried out by this entity.

In the event of collecting personal data from non-owners, Social Development Bank ensures that the following conditions are met:

1. If the owner of the personal data has consented to do so, in accordance with the provisions of the law.

2. If the personal data is available to the public or collected from a publicly available source.

3. If collection is necessary for security purposes or to implement another system or to meet judicial requirements in accordance with the provisions specified in the regulations.

4. If the collection or processing of personal data is necessary to protect the health, public safety, or the life or health of a specific individual or individuals.

5. If the personal data is not recorded or stored in a format that makes it possible to identify its owner and identify him directly or indirectly.

4.What personal data does the bank collect?

5. How Social Development Bank collect the Personal Data?

1. We collect data only for legitimate purposes either directly from you or indirectly from our authorized third parties. The data collected are using variety of sources such as from the following but not limited to:

2. Social Development Bank’s electronic portal.

3. Application forms.

4. Digital Channels.

5. Survey and Feedback Forms shared to potential customers.

6.  Direct communication channels (including phone channels, emails, or social media channels.

7. Cookies.

8. Credit Information Agencies, Government Portals, Integration Channels or Authorized Agencies.

9. Criminal record checks from organizations authorized to provide this data.

10. Databases made available by official authorities and government authorized sources to update/verify your documents.

11. Legitimate Third Parties to provide products and lawful services that may interest you.

12. Publicly available sources.

6. How Social Development Bank process your Personal Data?

We collect, use, disclose, retain or otherwise process your personal data by a variety of means including automated and manual means for following purposes but not limited to:

1. Assessing and providing banking and financial services to you or to fulfill our banking obligations including KYC checks, credit checks, identity checks, etc.

2. Establishing and maintaining banking relationships including client accounts and providing services to you including accessing internal platforms to ensure quality and security.

3. Responding to requests and queries from regulatory bodies, government agencies or any other authorized partners

4. Responding to your queries or complaints including monitoring social media conversations and posts to identify conversations sentiments, and complaints about the Bank and issuing notifications about changes to the terms and conditions of our products and service.

5. Using automated technologies such as cookies to provide services tailored to your requirements

6. Operating our business including managing authentication and user access controls for online and mobile banking, audits of business operations

7. Improving our products and services by monitoring and recording our communications with you, including phone calls, for training and quality purposes, customer surveys and provide more tailored services to you

8. Detecting, investigating and preventing financial crimes by monitoring and recording voice and electronic communications and screening applications and transactions in connection with actual or suspected fraud, financial crime or other criminal activities 

7. Why Social Development Bank need your Personal Data?

We need your personal data in accordance with providing with you the products and services as per your requirements. After you submit an application form to us or become our customer, we have certain legal obligations to process your personal data. The potential consequences and risks that may result if you do not provide us with the requested personal data such as the following:

1. We will not be able to comply with the legal or regulatory obligations.

2. We will not be able to offer our products and services to you

We make it clear on our application forms what personal data is required to be provided by you by marking the mandatory fields with the asterisk symbol (*).

We further collect data in form of cookies from our automated systems. We use cookies to collect and store information about how you use the Social Development Bank e-portal and government digital services.

SDB has identified following legal grounds (but not limited to) for collecting and processing personal data:

1. Legal Obligation: We process personal data to comply with a legal obligation, to meet regulatory and public interest obligations or mandates.

2. Contractual agreement: If we need to process the personal data to enter into or carry out a contractual agreement that we have with you.

3. Actual interests: If the processing achieves actual interests for you and it is impossible or difficult to contact you.

4. Publicly Available Data: If the personal data is publicly available or collected from public sources.

5. Legitimate interests: If we need to pursue our legitimate interests, without prejudice to your rights and interests, and provided that no Sensitive Data is processed.

6. Regulations and laws: If we have to comply with the regulations and laws that are applicable to the us.

7. Vital interests: To protect your and/or the Kingdom’s vital interests.

8. Public interests or official authorities: Achieving public interest or serving an official request from an authority according to its roles.

9. Consent: We will only process your personal data/information with your explicit consent except for reasons permitted under the Law.

8. Mandatory and Voluntary Collection of Personal Data

We need your personal data to provide you with the services or products requested by you. After you choose any of the product or service and get onboarded as a customer, we have certain legal obligations to process your personal data. If you do not provide us with the requested personal data, we will be unable to comply with the legal or regulatory obligations and will not be able to offer our products and services to you.

Whenever we collect your data using digital forms or applications, we make it clear what personal data is required to be provided by you by marking the mandatory fields with the asterisk symbol (*). For the ones non-mandatory, you can choose to not provide the data to us.

9. Cookie Policy

Cookies are pieces of information that a website transfers to the cookie file on customer’s device. Cookies deployed by the Bank’s e-portal cannot look into your computer/devices and obtain information about you or your family information. Cookies cannot read any material kept on your hard drive, only when customer logs into online banking website it identifies them, store or update certain parameters on the cookie file, and cookie does not reveal customer’s identity.

The Social Development Bank mainly publishes the following types of cookies:

10. Security of your Personal Data

Your personal data will not be processed without taking sufficient steps to verify its accuracy, completeness, timeliness and relevance for the purpose for which it was collected in accordance with the provisions of the regulations.

The Social Development Bank is committed to protecting your personal data. We implement internal technical and organizational measures to keep personal data safe and secure including encryption, anonymization and physical and logical security measures. We require our staff and any third parties who carry out any work on our behalf to comply with strict compliance standards including agreeing to contractual obligations to protect any personal data.

11. Disclosure of your personal data

Your personal data shall be processed and disclosed internally within the bank in accordance with the products and services opted by you. The Social Development Bank will disclose the data externally only as per the legal basis and purpose identified.  The bank may share your personal data externally to the following stakeholders but not limited to:

Public or Regulatory Agencies: We may be legally obligated to share your information in response to legal processes or court orders issued by government. We may also disclose your information to the relevant authorities, where we are required to disclose information by applicable law or regulation, or at their request

Business Partners: Partners with whom we collaborate, including Fintech apps and banks, enable us to enhance our Services, offering you the ability to make faster and more efficient payments.

Service Providers: Companies that provide services for or on behalf of us, such as companies that help us with insurance, companies that provide applications to the Bank to operate our services, background service providers etc. These providers are also committed to protecting your information.

Any other Third Parties: In addition to the disclosures described in this Privacy Policy, we share information about you with third parties when you separately provide consent to or request such sharing

In exceptional circumstances, your information may be made available to government officials. However, it will never be made available to the public without your prior consent. Furthermore, this information will not be circulated, exchanged, or transferred to any third party without your prior consent.

Your personal data will only be disclosed in the following cases:

1. If you agree to its disclosure in accordance with the provisions of the law.

2. If your personal data is collected from a publicly available source.

3. If the party requesting the disclosure is a public entity, for security purposes, to implement another system, or to meet judicial requirements in accordance with the provisions specified in the regulations.

4. If the disclosure is necessary to protect public health, public safety, or the life or health of a specific individual or individuals.

5. If the disclosure is limited to its subsequent processing in a manner that does not lead to the identification of the owner of the personal data or any other individual specifically.

The Social Development Bank may not disclose your personal data in the event that the disclosure leads to a threat to security or harms the reputation of the Kingdom or conflicts with its interests or affects the Kingdom's relations with other countries. We will further refrain from sharing the information if endangers the safety of an individual.

12. Transfer outside the Kingdom

Social Development Bank is headquartered and is based out of Riyadh, Saudi Arabia. We may transfer your personal data to other countries for compliance purposes, or to our service providers that maintain operations in countries outside Saudi Arabia.

When we transfer personal data, we ensure it has an appropriate level of protection and that the transfer is lawful. This includes relying on adequacy decisions issued by the relevant data protection authority and using standard contractual clauses for transfers of personal data. You can obtain more details of the protection given to your information when it is transferred by contacting us using the contact details below. 

13. Your Rights

Social Development Bank is committed to ensure accountability and transparency in its operations. In accordance with the applicable Data Protection Regulations, the Bank makes all its efforts to guarantees applicable rights to its data subjects in line with the applicable regulations and standards, according to the following:

1. Right to Be Informed: You have the right to be informed about the collection and usage of your personal data including why and how we collect your personal data, the purposes for processing your data, and who will it be shared with.

2. Right to Request Access: You have the right to access your personal data available in the Bank in a structured, readable, and clear format.

3. Right to Obtain a Copy: You have the right to obtain a copy of your personal data available in the Bank in a structured, readable, and clear format.

4. Right to Correction: You can request to have your personal data corrected (if inaccurate), completed (if incomplete) or updated (if out of date).

5. Right to Request Destruction: You have the right to request that your personal data be destroyed when: 

   1. You consider that we no longer require the information for the purposes for which it was obtained.

   2. You have validly objected to our use of your personal data and the data was processed based on your consent or you decide to revoke consent on use and processing of your personal data.

   3. Our use of your personal data is contrary to the Law or any other legal obligations.

6. Right to Withdraw Consent: You have the right to modify / revoke consent to collect and process your personal data unless statutory or legal requirements, contractual necessity and public interest require otherwise. Consent withdrawal shall not affect the processing of personal data that is based on another legal basis and not consent.

14. Minor and Person with lacking Legal Capacity

The Bank’s website and applications are intended for use only by persons who are at least 18 years of age and/or legally competent. If the data subject is under 18 or legally incompetent, a parent or legal guardian should agree on behalf of him/her, as the Bank requires consent in connection with the collection and processing of the data subject’s personal data.

15. Storage, Retention and Destruction of your Personal Data

We store and retain your personal data for any period as mandated by the regulations, necessary for the purpose for which your personal data was collected, processed, required by law or where we may need it for our legitimate purposes such as maintaining records for analysis or audit purposes, responding to queries or complaints, monitoring fraud, defending or taking legal action and responding to requests from regulators

The Social Development Bank will dispose of your personal data once the purpose of its collection has ended. However, it may retain this data after the purpose of its collection has ended if everything that leads to specific knowledge of the owner has been removed in accordance with the controls specified in the regulations. 

The Social Development Bank might, in exceptional circumstances, retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by competent authorities and enforcement agencies or our regulators. This is so that we can produce records as evidence if required.

16. Your Responsibility related to Data Processing

You are responsible for making sure the personal data you give us is accurate and up to date, and you must inform us if anything changes as soon as possible.

If you give the Bank personal data that belongs to another person (for example, legally appointed on behalf of someone, dependent etc), you will need to inform them of this Privacy Policy and obtain their consent for the Bank to use their personal data for the specified purpose.

17. Updates to the Privacy Policy

The Bank reserves the right to make changes to this Policy at any time and for any reason. We will alert you about any changes by updating the “Last Updated” date on top of this Policy. Any changes or modifications will be effective immediately upon posting the updated Policy on the site.

You are encouraged to periodically review this Policy to stay informed of updates. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Policy by your continued use of the Site after the date such revised Policy is posted.

18. Contact Us

Maintaining the privacy and trust of our customers data is of utmost importance to Social Development Bank. If you have any query related to personal data processing or want to exercise any of the rights listed above, please contact us at

dmo@sdb.gov.sa