Privacy Policy

Article 1: Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

“Personal Data”"Personal Data"

Any statement — regardless of its source or form — that leads to the identification of a specific individual, or makes it possible to identify them directly or indirectly, including: name, national identity number, addresses, contact numbers, licence and registration numbers, personal property numbers, bank account and credit card numbers, still or moving images of the individual, and other data of a personal nature.

“Sensitive Data”"Sensitive Data"

Any personal statement relating to an individual's racial or ethnic origin, religious, intellectual, or political beliefs, security and criminal data, biometric data identifying identity, genetic data, health data, and data indicating that an individual is of unknown or single parentage.

“Data Processing”"Data Processing"

Any operation performed on personal data by any means, whether manual or automated, including collection, recording, keeping, indexing, arranging, formatting, storing, modifying and updating, merging, retrieving, using, disclosing, transferring, publishing, sharing or interconnecting data, blocking, erasing, and destruction.

“Collection”"Collection"

The Controller's obtaining of personal data in accordance with the provisions of the Law, whether directly from the data subject, their representative, their legal guardian, or from another party.

“Destruction”"Destruction"

Any action taken on personal data that makes it impossible to access, retrieve, or identify its owner.

“Disclosure”"Disclosure"

Enabling any person — other than the Controller or Processor as the case may be — to obtain, use, or access personal data by any means and for any purpose.

“Transfer”"Transfer"

Moving personal data from one location to another for processing.

“Publication”"Publication"

Broadcasting any personal data through a readable, audio, or visual publication medium, or making it available.

“Controller”"Controller"

The Company, in its capacity as the entity that determines the purposes and means of personal data processing.

“Data Subject”"Data Subject"

Any identified or identifiable individual to whom personal data relates.

“Consent”"Consent"

A free, specific, informed, and unambiguous indication by the data subject signifying their agreement to the processing of their personal data.

“Data Subject Rights”"Data Subject Rights"

Rights granted to individuals under the Saudi Personal Data Protection Law, including rights of access, rectification, erasure, and objection.

“Qualified Investor”"Qualified Investor"

Any natural person meeting the criteria defined by the Capital Market Institutions Regulations issued by the CMA, typically possessing significant net worth, investment experience, and financial sophistication.

“Cookies”"Cookies"

Small text files stored on a user's device when visiting the website or using the application, aimed at improving user experience, enabling certain website or application functions, and monitoring usage for analytical purposes.

“Processor”"Processor"

Any public entity, or any natural or private legal person, that processes personal data on behalf of and for the benefit of the Controller.

“Regulatory Authority”"Regulatory Authority"

The Capital Market Authority (CMA), the Financial Intelligence Unit (FIU), or any other competent governmental authority.

Article 2: Purpose and Scope

2.1 Purpose of this Policy: This Policy aims to ensure personal data is processed fairly, transparently, and lawfully in accordance with the Law and CMA regulations. The Company is also committed to collecting and processing the minimum personal data necessary to achieve specified purposes, and to maintaining the highest standards of data protection and security.

2.2 Scope of Application: This Policy applies to all personal data that Miza Capital collects, processes, or stores in connection with: account opening and client onboarding operations; “Know Your Customer” (KYC) and Anti-Money Laundering (AML) procedures; provision of discretionary investment portfolio management and investment advisory services; transaction execution and portfolio management; and platform usage and related support and customer service.

Article 3: Personal Data We Collect

We collect personal data in several categories to fulfil our regulatory obligations and deliver our services effectively:

3.1 Identity Information: Full legal name; National Identity Number (Iqama for expatriates); date of birth; nationality; gender; passport details; photographs; and signature samples.

3.2 Contact Information: Residential and business addresses; email addresses; mobile and landline telephone numbers; and alternative contact methods.

3.3 Financial Information: Annual income and sources; net worth and asset details; bank account information; investment account numbers; transaction history; portfolio holdings; fee records; and credit information verified through credit agencies.

3.4 Employment Information: Current employer name and details; job title and position; sector and industry; duration of employment; and professional experience.

3.5 KYC and Suitability Information: Risk profile assessment and risk tolerance; investment objectives; investment knowledge and experience; familiarity with financial instruments; time horizon; and liquidity needs. This information is collected to ensure compliance with CMA suitability requirements and investor protection.

3.6 Technical Information: Device identifiers and type; operating system and version; browser type; Internet Protocol (IP) addresses; cookies and similar tracking technologies; mobile application usage data; login records; and system performance metrics.

3.7 Transaction Data: Subscription and redemption records; purchase and sale transaction details; portfolio composition information; investment performance data; fee deduction records; and transaction confirmations.

3.8 Communication Records: Emails and electronic messages exchanged with the Company; telephone calls (recorded with prior consent); in-platform chat records; support ticket records; and correspondence stored in your account file.

Article 4: How We Collect Personal Information

Personal data is collected through the following means:

4.1 Direct Collection from Clients: Information provided through account opening forms; KYC documents and questionnaires; risk assessment questionnaires; suitability assessment forms; regulatory compliance documents; and any supporting documentation required for verification.

4.2 Collection through Platform Use: Data generated from your interaction with the mobile application and platform; automatic login information; transaction requests and execution; settings and preference updates; and user activity metrics.

4.3 Collection from Third Parties: Verification services (electronic verification via Nafath); credit information agencies; regulatory databases under CMA supervision; background check providers; sanctions screening databases; and financial reference providers.

4.4 Telephone Communications: Telephone calls with Company representatives are recorded for compliance, quality assurance, and dispute resolution purposes, with prior explicit consent as required by applicable regulations.

4.5 Cookies and Web Analytics: Information collected through cookies, web beacons, pixels, and similar tracking technologies to analyse platform usage, improve user experience, and monitor system performance.

4.6 Other Sources: Survey responses; client feedback and complaints; social media interactions (if any); and any other data voluntarily provided by the data subject.

Article 5: Purposes of Data Collection and Processing

We collect and process personal data for the following purposes:

5.1 Account Opening and KYC Compliance: Creating and maintaining client accounts; verifying identity and confirming client details; complying with KYC regulations; and collecting required documentation.

5.2 Client Eligibility and Qualified Investor Verification: Determining whether the client meets the qualified investor definition under CMA regulations; verifying financial capability and sophistication; assessing suitability for discretionary management services; and ensuring compliance with investor protection requirements.

5.3 Service Delivery: Providing discretionary investment portfolio management and investment advisory services; executing transactions; managing portfolios; and maintaining account operations and communications.

5.4 Suitability Assessment and Risk Profiling: Assessing the client's risk tolerance and investment objectives; determining appropriate investment strategies; monitoring changes in the client's circumstances; and ensuring the continued suitability of investment recommendations.

5.5 Transaction Processing and Execution: Processing investment transactions; executing orders; settling trades; managing custody arrangements; calculating fees; and issuing transaction confirmations and statements.

5.6 Regulatory and Legal Compliance: Complying with Capital Market Law requirements; fulfilling reporting obligations to the CMA; complying with AML and counter-terrorism financing laws; responding to regulatory enquiries; and maintaining required records.

5.7 Fraud Prevention and Detection: Detecting and preventing fraudulent activities; identifying unauthorised account access; monitoring suspicious transactions; and investigating security incidents.

5.8 Communications and Customer Service: Responding to client enquiries; providing account statements and performance reports; sending important notifications; providing service updates; and handling complaints or disputes.

5.9 Platform Development and Improvement: Analysing platform usage patterns; identifying user preferences; developing new features; improving mobile application performance; and enhancing user experience.

5.10 Statistical Analysis and Reporting: Conducting anonymised statistical analyses; preparing aggregated reports; conducting market research; and preparing performance indicators with personal identifiers removed.

5.11 Legal Obligations and Court Orders: Complying with court orders or legal directives; responding to governmental investigations; complying with disclosure requirements; and fulfilling legal obligations under applicable laws.

Article 6: Legal Basis for Processing

Under the Law, the Company processes personal data on one or more of the following bases:

6.1 Consent: Processing carried out with the explicit, informed, and free consent of the data subject, which may be withdrawn at any time, unless processing is required by law.

6.2 Contractual Necessity: Processing necessary for the performance of a contract to which the data subject is a party, including account opening agreements, service agreements, and terms of engagement.

6.3 Legal Obligation: Processing required to comply with legal obligations imposed under the Personal Data Protection Law, Capital Market Law, Anti-Money Laundering Law, Counter-Terrorism Crimes and Financing Law, CMA regulations, and other applicable laws.

6.4 Legitimate Interest: Processing carried out for legitimate interests of the Company or third parties, including fraud prevention, platform security, business improvement, and market research, provided such interests do not override the rights and interests of the data subject.

6.5 Protection of Vital Interests: Processing necessary to protect the vital interests of the data subject or another person, such as emergencies requiring the immediate disclosure of personal data.

6.6 Public Interest: Processing carried out in furtherance of tasks in the public interest or in the exercise of official authority, including regulatory compliance and public safety.

Article 7: Data Sharing and Disclosure

7.1 Regulatory and Governmental Authorities: The Company may disclose personal data to regulatory authorities including the CMA, the Financial Intelligence Unit, and other competent governmental authorities as required by law, regulation, or specific regulatory requests.

7.2 Custodian Banks and Fund Platforms: Personal data necessary for account operation, transaction execution, and custody services may be shared with the Company's custodian bank and licensed fund platforms operating under CMA supervision.

7.3 Verification Service Providers and References: Personal data may be disclosed to licensed verification service providers (including Nafath), credit agencies, background check providers, and sanctions screening databases for KYC, AML, and counter-terrorism financing compliance purposes.

7.4 Auditors and Legal Advisors: The Company's external auditors, legal advisors, and compliance consultants may access personal data as needed to fulfil their professional obligations, subject to confidentiality agreements.

7.5 Technology Service Providers: Third-party technology service providers, including cloud infrastructure providers (Google Cloud), software vendors, and communications providers, may access personal data under strict data processing agreements imposing comprehensive confidentiality and security obligations.

7.6 Court Orders and Legal Requirements: The Company may disclose personal data in response to court orders, legal proceedings, subpoenas, governmental requests, or other legal requirements, with notification to the data subject unless prohibited by law.

7.7 Anti-Money Laundering and Counter-Terrorism Financing: Personal data may be disclosed to competent authorities and international databases to comply with AML and counter-terrorism financing obligations, including reporting suspicious activities and screening against sanctions lists.

7.8 Client Consent: Personal data may be shared with other third parties based on explicit consent from the data subject.

7.9 Data Protection Restrictions: The Company prohibits the sale of personal data to third parties for commercial purposes. Personal data is not shared for marketing purposes without explicit consent. All sharing is conducted in accordance with the Saudi Personal Data Protection Law and applicable regulations.

Article 8: Data Retention

The Company retains personal data for periods determined by legal obligations, operational necessities, and regulatory requirements:

8.1 Active Client Accounts: Personal data for active clients is retained throughout the duration of the relationship and kept in an accessible format to provide ongoing services.

8.2 Following Account Closure: Following account closure, personal data is retained for a minimum of ten (10) years as required under Article 10 of the Capital Market Institutions Regulations, to facilitate dispute resolution, regulatory enquiries, and compliance verification.

8.3 Transaction and Communications Records: Transaction records, statements, confirmations, and communications records are retained for a minimum of ten (10) years in accordance with CMA regulations and the Anti-Money Laundering Law.

8.4 KYC and Compliance Documents: KYC forms, identity verification documents, compliance records, and AML/CTF documentation are retained for ten (10) years or longer if required by regulatory authorities.

8.5 Marketing and Consent Records: Marketing consent records are retained throughout the duration of consent and for seven (7) years thereafter to demonstrate compliance with consent requirements.

8.6 Anonymised Data: Properly anonymised data from which individuals cannot be identified may be retained indefinitely for statistical analysis, research, and business intelligence purposes.

8.7 Early Deletion: The Company may delete personal data before the expiry of specified retention periods if it is no longer necessary for the original purpose and there are no legal or regulatory requirements for retention, having regard to the data subject's right to request deletion.

Article 9: Data Storage and Security

9.1 Storage Location: Personal data is stored primarily on Google Cloud infrastructure in data centres located in Riyadh and Dammam, ensuring compliance with Saudi data residency requirements and minimising cross-border data transfers.

9.2 Encryption: Personal data is encrypted using industry-standard encryption protocols (AES-256 or equivalent) at rest and in transit. All data transfers occur via secure HTTPS/TLS connections.

9.3 Authentication and Access Controls: Systems implement multi-factor authentication for access to sensitive data. Access to personal data is restricted to employees based on their job role (RBAC). All access is logged and monitored.

9.4 Security Audits and Testing: The Company conducts regular security audits, vulnerability assessments, and penetration testing to identify and address security vulnerabilities. Third-party security assessments are conducted annually.

9.5 Employee Confidentiality: All employees, contractors, and service providers are bound by confidentiality agreements and data protection commitments. Access to personal data is limited to individuals with a legitimate operational need.

9.6 Physical Security: Physical access to facilities containing personal data is restricted to authorised individuals only. Data centres maintain physical security procedures including surveillance, access controls, and environmental protection.

9.7 Continuous Monitoring: Systems are continuously monitored to detect unauthorised access, suspicious activities, and potential security threats. Advanced detection systems analyse network traffic and user behaviour patterns.

9.8 Incident Response: The Company maintains documented incident response procedures to address data breaches, unauthorised access, or security incidents, encompassing investigation, mitigation, notification, and remediation.

Article 10: Data Subject Rights

Under the Saudi Personal Data Protection Law, individuals have the following rights in relation to their personal data:

10.1 Right of Access: The data subject has the right to obtain confirmation as to whether their personal data is being processed and to obtain a copy in a structured, widely used, and machine-readable format.

10.2 Right of Rectification: The data subject has the right to request the rectification of their personal data if it is inaccurate or incomplete. The Company shall carry out the rectification within thirty (30) days of the request, and may extend this period by up to thirty (30) additional days if fulfilling the request requires unusual additional effort or if multiple requests are received from the same data subject, provided the data subject is notified in advance of the extension and the reasons therefor.

10.3 Right of Erasure (Right to be Forgotten): The data subject has the right to request the deletion of their personal data, subject to exceptions such as legal retention requirements, ongoing contractual obligations, and regulatory requirements. The Company shall respond to erasure requests within thirty (30) days of the request, and may extend this period by up to thirty (30) additional days if fulfilling the request requires unusual additional effort or if multiple requests are received from the same data subject, provided the data subject is notified in advance of the extension and the reasons therefor.

10.4 Right to Restrict Processing: The data subject has the right to request the restriction of processing in certain circumstances, such as when the accuracy of the data is disputed or when processing is unlawful but the data subject does not wish for deletion.

10.5 Right to Data Portability: The data subject has the right to receive their personal data in a structured, widely used, and machine-readable format, and to transmit it to another controller without hindrance.

10.6 Right to Withdraw Consent: The data subject has the right to withdraw consent to processing at any time, without affecting the lawfulness of processing that took place prior to withdrawal.

10.7 Right to Object: The data subject has the right to object to processing based on legitimate interests or for direct marketing purposes, and the Company shall cease processing unless it demonstrates compelling legitimate grounds.

10.8 Right Not to be Subject to Automated Decision-Making: The data subject has the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects.

10.9 How to Exercise Rights: The data subject may exercise their rights by submitting a written request to the Company's Data Protection Officer or Compliance Department, including their full name and account details, a clear description of the right being requested, supporting documents if any, and signature or electronic authorisation.

10.10 Right to Lodge a Complaint: The data subject has the right to lodge a complaint with the competent regulatory authority regarding the Company's data processing practices. Regulatory authority contact information is provided in Article 17 of this Policy.

Article 11: Cookies and Tracking Technologies

11.1 Types of Cookies:

• Essential Cookies: Necessary for core platform functionality, account security, and transaction processing; they cannot be disabled without affecting access to the platform.
• Functional Cookies: Improve user experience by saving preferences, language settings, and customisations.
• Analytics Cookies: Enable the Company to analyse platform usage, user behaviour, and performance metrics to improve services.

11.2 Cookie Consent: The Company requests explicit consent before placing non-essential cookies on users' devices. Users may accept or reject these cookies upon first accessing the platform or through account settings.

11.3 Managing Cookie Preferences: Users may modify cookie preferences at any time through platform settings or browser settings, noting that certain browser-level restrictions may limit some platform features.

11.4 Third-Party Cookies: The Company does not place third-party cookies from external advertisers or analytics providers. Third-party service providers engaged by the Company are contractually bound to respect user privacy.

11.5 Pixel Tags and Web Beacons: The Company may use pixel tags and similar tracking technologies to measure platform effectiveness and user engagement; these technologies collect the same information as cookies.

Article 12: Children and Minors

12.1 Age Restrictions: The Company's services are not directed at individuals under the age of eighteen (18) Hijri years. The Company does not collect personal data from minors without appropriate legal guardian consent.

12.2 Guardian Consent for Minors: If accounts are opened for minors (requiring explicit CMA approval), the consent of the legal parent or guardian must be obtained and documented, and the guardian assumes responsibility for the account.

12.3 Special Protections: When opening accounts for minors, the Company applies additional controls including enhanced parental oversight, investment restrictions, and educational materials.

Article 13: Cross-Border Data Transfers

13.1 Primary Data Storage: Personal data is stored primarily in the Kingdom of Saudi Arabia on Google Cloud infrastructure in data centres in Riyadh and Dammam, in compliance with data localisation requirements.

13.2 Cross-Border Transfers: Cross-border transfers of personal data are carried out only when legally necessary and with appropriate safeguards under the Saudi Personal Data Protection Law, with regulatory notification or approval where required.

13.3 Adequate Safeguards: When cross-border transfers occur, the Company ensures adequate legal protection through data processing agreements, contractual safeguards, and compliance with the requirements of Article Twenty-Nine (29) of the Law and the Personal Data Transfer Regulations issued by the Saudi Data and Artificial Intelligence Authority.

Article 14: Third-Party Links and Services

14.1 Disclaimer: The Company's mobile application may contain links to third-party websites, applications, and services. This Privacy Policy applies only to the Company's platform and does not govern the privacy practices of third parties.

14.2 Third-Party Responsibility: The Company bears no responsibility for the privacy practices, data collection methods, or security measures of third-party websites and services. Users should review third-party privacy policies independently.

14.3 External Partner Services: When data is shared with third-party service providers (as outlined in Article 7), those providers are contractually bound to comply with data protection requirements equivalent to those imposed on the Company.

Article 15: Data Breach Notification

15.1 Definition of a Data Breach: A data breach constitutes unauthorised access, disclosure, loss, or destruction of personal data that threatens the confidentiality, integrity, or availability of personal information.

15.2 Breach Investigation: Upon discovering a data breach, the Company immediately initiates an investigation to determine the nature, extent, and impact of the breach, including identifying affected individuals and assessing the extent of data exposure.

15.3 Regulatory Notification: The Company notifies the CMA and relevant regulatory authorities of a data breach within the required timeframes (typically within 72 hours or as required by applicable regulations), providing details of the breach and corrective actions.

15.4 Notification of Affected Individuals: If the breach poses a high risk to affected individuals, the Company provides prompt notification via email, SMS, or platform notifications, including details of the breach and precautions to be taken.

15.5 Corrective and Preventive Measures: Following a breach, the Company implements corrective measures including securing affected systems, strengthening security controls, and implementing process improvements to prevent future breaches.

Article 16: Amendments to this Policy

16.1 Policy Updates: The Company reserves the right to update this Privacy Policy to reflect changes in data processing practices, regulatory requirements, or operational circumstances. Clients will be informed of material changes.

16.2 Notification Methods: Policy updates are communicated via email, platform announcements, or account notifications. Material changes require at least thirty (30) days' advance notice.

16.3 Continued Use as Acceptance: Continued use of the Company's services after notification of changes constitutes acceptance of the updated Policy. Clients may request account closure if they do not accept the amended terms.

Article 17: Contact Information

17.1 Data Protection Officer and Compliance Department

For enquiries regarding this Privacy Policy, to exercise data subject rights, or to address data protection concerns, please contact:

Miza Capital, Al Thumamah Branch 6442, Al Sahafah District 3339, Riyadh 13315, Kingdom of Saudi Arabia

Compliance Department — Email: compliance@mizacapital.sa — Tel: 0112690222

17.2 Regulatory Authority Contact Information

For complaints or enquiries regarding the Company's data processing practices, please contact:

Capital Market Authority (CMA), Riyadh, Kingdom of Saudi Arabia — Website: www.cma.org.sa

National Data Governance Platform, Riyadh, Kingdom of Saudi Arabia — Website: https://dgp.sdaia.gov.sa/wps/portal/pdp/home

Article 18: Applicable Law and Jurisdiction

18.1 Applicable Law: This Privacy Policy is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia, including: the Law; the Capital Market Law, Royal Decree No. M/30; the Capital Market Institutions Regulations issued by the CMA; the Anti-Money Laundering Law and its implementing regulations; and the Counter-Terrorism Crimes and Financing Law.

18.2 Language: This Privacy Policy may be translated into English or other languages for convenience only; the Arabic version is the official and legally binding document. In the event of any conflict between translations, the Arabic text shall prevail.

18.3 Jurisdiction and Dispute Resolution: Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts or committees in Riyadh, Kingdom of Saudi Arabia.