Privacy Policy

Your privacy is important to us. This Privacy Policy explains how we collect, use, share, and protect your personal data in accordance with Saudi Arabia's Personal Data Protection Law (PDPL).

1. Scope of the Policy

This policy applies to all users of HOA, including visitors, registered unit owners, property managers, agency owners and agents, and service providers accessing our platform through the web or mobile applications.

2. Data We Collect

We may collect and process the following types of personal data:

• Personal Identification Information: Name, email address, phone number, national ID or Iqama number.
• Account Details: Username, password, and account preferences.
• Financial Information: Transaction history, invoices issued or received, and (for agencies) bank account details (IBAN) used for settlement payouts.
• Property Details: Information related to properties managed via the platform.
• Usage Data: IP address, device information, browser type, and activity logs.
• Communication Data: Messages, inquiries, or other interactions with the platform.

What we do NOT collect or store: full card numbers, CVV codes, or any other card-credential data. Those are entered directly on Tap Payments' hosted form (see Section 5) and are subject to Tap's PCI DSS-compliant handling.

3. How We Use Your Data

Your personal data is collected and used for the following purposes:

• Providing and improving our services, including HOA management tools.
• Facilitating secure communication between users and service providers.
• Processing payments, settling funds to agencies, and recording the platform fees we deduct in our role as a payment intermediary (see the Terms of Use, Section 7).
• Issuing tax invoices and reporting them to the Zakat, Tax and Customs Authority (ZATCA) where required by Saudi e-invoicing regulations.
• Complying with legal and regulatory obligations.
• Enhancing user experience through analytics and feature development.
• Sending notifications, updates, and promotional content (with your consent).

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the PDPL:

• Consent: When you explicitly agree to the collection and use of your data.
• Contractual Obligation: To fulfill our contractual obligations to provide services.
• Legal Compliance: To meet regulatory or legal requirements in Saudi Arabia, including ZATCA e-invoicing reporting.
• Legitimate Interests: For purposes such as improving the platform or ensuring security.

5. Sub-processors and Data Sharing

We share specific personal data with the following sub-processors as needed to deliver platform features:

• Tap Payments (tap.company) — our payment processor for all card payments. When a customer initiates a card payment we share: customer first/middle/last name, email address, phone number (with country code), the payment amount and currency, and a description of what is being paid for. Tap also handles card credentials directly on its own hosted form. Tap's processing of your data is governed by their own privacy policy.
• Saudi Cloud Computing Company (SCCC) — Alibaba Cloud Saudi Arabia — primary infrastructure provider. The application, database, and all object storage (uploaded documents, rendered invoice PDFs, images) are hosted on SCCC infrastructure in the Riyadh region, within the Kingdom of Saudi Arabia.
• Amazon Web Services (AWS) — transactional email only — outbound transactional emails (account activation, password reset, payment confirmation, etc.) are sent via Amazon Simple Email Service (SES). The recipient email address, subject, and body of each message pass through AWS SES; no other user data is shared with AWS.
• Zakat, Tax and Customs Authority (ZATCA) — Saudi tax authority. Signed e-invoice metadata (issuer, buyer, amounts, line items) is reported to ZATCA in accordance with the e-invoicing regulations.
• Other Users: Relevant data (e.g. names or contact details of unit owners, agency members, property managers) is shared between users where needed to facilitate HOA-related communications.
• Government Authorities: When required by law or for regulatory compliance.
• With Your Consent: When you explicitly authorise data sharing with specific parties.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Specific retention rules of note:

• Tax invoices (e-invoices): the signed XML representation and the associated invoice records are retained for at least six (6) years from the date of issuance, in accordance with ZATCA regulations.
• Invoice PDFs (rendered): the human-readable PDF version of an invoice is generated on first request and cached for approximately sixty (60) days on in-Kingdom object storage (SCCC Riyadh). After that, the cached PDF is automatically deleted; if a user later requests it, the PDF is re-rendered from the retained signed XML. The legal record is the signed XML, not the PDF.
• Agency settlement bank details (IBAN): retained for as long as the agency uses the platform's settlement features, plus a reasonable period thereafter to evidence payout history.
• Other data: deleted or anonymised when it is no longer needed for the purpose for which it was collected.

7. Data Security

We implement security measures to protect your personal data, including:

• Encryption of data in transit (HTTPS) and at rest.
• Regular security reviews and vulnerability assessments.
• Access controls to restrict unauthorised access to sensitive data.
• HMAC-signed verification of payment-gateway webhooks to prevent forged payment notifications.
• Redacted logging — personally identifying details are not written to operational logs for routine payment events.
• Card-data scope: as noted in Section 2, full card credentials are handled by Tap Payments under its PCI DSS-compliant environment and never reach HOA's systems.

8. Your Rights

Under Saudi Arabia's PDPL, you have the following rights:

• Access: Request access to the personal data we hold about you.
• Correction: Request corrections to inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal requirements, such as the 6-year invoice retention noted in Section 6).
• Withdrawal of Consent: Withdraw consent for specific processing activities.
• Portability: Request a copy of your personal data in a portable format.

To exercise these rights, please contact us at privacy@hoa.sa.

9. International Data Transfers

HOA keeps personal data within the Kingdom of Saudi Arabia for all primary platform functions:

• Application, database, and object storage: hosted entirely on Saudi Cloud Computing Company (SCCC, an Alibaba Cloud Saudi Arabia joint venture) in the Riyadh region — fully in-Kingdom, no cross-border transfer.
• Payment processing: performed by Tap Payments, a Saudi-domiciled payment service provider — under Saudi jurisdiction.
• Transactional email: outbound emails (activation, password reset, payment confirmations, etc.) are delivered via Amazon Web Services Simple Email Service in the US East (Ohio) region. The recipient's email address and the message content cross the border for this purpose only. We safeguard this transfer through AWS's contractual data-protection commitments and TLS-encrypted SMTP submission.

Where any data is transferred outside Saudi Arabia, we comply with the requirements of the Personal Data Protection Law (PDPL) by implementing adequate safeguards, such as contractual data-protection commitments or government-approved mechanisms.

10. Cookies and Tracking Technologies

Our platform uses cookies and similar technologies to enhance user experience and collect analytics data. You can manage your cookie preferences through your browser settings.

11. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or regulatory requirements. Users will be notified of significant updates, and continued use of the platform constitutes acceptance of the revised policy.

12. Contact Information

If you have any questions or concerns about this Privacy Policy, please contact us:

Email: privacy@hoa.sa

Effective Date: to be set on publication