Privacy Policy

Introduction

This Policy is the very text of Chapter Eight of the Terms and Conditions of the RASA Platform, published as a standalone page for ease of reference, and is to be read together with the Terms and Conditions; in the event of any discrepancy between this page and the text of Chapter Eight in the Terms, the text of Chapter Eight prevails.

Data controller: Nasaq Alhadithah Lilkhadamat Almahdudah Establishment (a sole proprietorship) (Commercial Register (CR) 7054964734), and the Data Protection Contact Point: complaints@nusuq.sa. The Establishment complies with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its implementing regulations, and the following paragraphs describe what we collect and why, with whom we share it and where it is processed, how long we keep it, and your rights in respect of it.

Chapter Eight: Data Protection and Privacy

This Chapter is the privacy policy of the RASA Platform. It sets out for you what data we collect and from whom, why we process it and on what legal basis, with whom we share it and where it is stored and processed, its retention periods, the security measures actually in place, your rights and how to exercise them, our messages to you and how to stop them, and what we do when a breach occurs.

The data controller is the Operator identified in the Document Details card: Nasaq Alhadithah Lilkhadamat Almahdudah Establishment (a sole proprietorship), Commercial Register (CR) No. 7054964734 in the Kingdom of Saudi Arabia, its city of registration being Yanbu Industrial and the centre of management of its activity being the city of Jeddah, and its address for written correspondence is the national address stated in the Document Details card once fixed therein; it is referred to in this Chapter as the "Operator" or "Nusuq". The contact point for everything relating to your data is set out in Article (8-9).

The privacy policy is also published as a standalone page on the Operator's Official Page at nusuq.sa (path /ar/privacy-policy, with its English translation at /en/privacy-policy), generated from the full text of this Chapter with all its articles and the same numbering, to facilitate reference; in the event of any discrepancy between the standalone page and the text of this Chapter, the text of this Chapter prevails in accordance with Articles (1-3) and (17-9). Every reference in this Chapter to an article or chapter outside Chapter Eight is a reference to the Terms and Conditions published on the Official Page, and is to be read together with them.

Key principles of how we handle your data

We collect what the service needs, we never sell your data under any circumstances, and we do not show you advertisements of other parties.
RASA operates with artificial intelligence systems and hosting outside the Kingdom (Meta for the WhatsApp channel, OpenAI, Anthropic and Hostinger; their names in Latin script and their roles are in Article (8-13)); your requests and documents are sent as they are in order to be read, and your data is stored primarily outside the Kingdom with a daily backup inside it, because this is the core of the service, and its basis is the agreement between you and the Operator rather than a separate consent.
Your contact data is not shared with another User except within the limits you have agreed to in these Terms.
You have full rights: access, rectification, deletion, withdrawal of consent to whatever is optional, immediate stopping of our messages, and complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA).
We maintain a supplier directory whose data was gathered from professional group postings and public sources; anyone appearing in it may request removal, which is carried out within five (5) business days.

This summary is provided for convenience; the binding text is the articles of this Chapter.

Article (8-1): Data Collected and Its Sources

First: Data you provide yourself

Identification data: name, mobile number (which is the identifier of your account in the messaging application), email address if you provide it, business name and city.
Business data: the Commercial Register (CR), the tax number, the activity and sector, the address, and whatever the Platform extracts from the documents you upload.
Supplier data: operational categories, cities served, catalogues, price lists and product images, and the IBAN number if the Supplier chooses to add it to the Business Card.
Buyer data: the texts of requests, the images and files sent with the request, quantities and specifications.

Second: Data generated by your use

The conversation log with RASA: your messages, the Platform's replies and the status of your account at each message, for the purposes of support, quality control and the handling of complaints.
The usage log: searches and their Credits, requests sent, the items requested linked to your business, the Internet Search results linked to your request, invitations sent and their status, and invoices.
Technical data: the messaging account identifier, message identifiers and their times, and the display language. The Platform does not collect the internet address of your device, the device type or the operating system through the WhatsApp channel, because the Channel Provider does not make them available to it. As for the data of Visitors to the Official Page that reaches the hosting server logs automatically, this is set out in Article (8-13).

Third: Data received by us from someone other than its subject

The Operator maintains a supplier database containing commercial contact data of businesses and their representatives who did not register themselves, received from postings by members of a professional procurement group, from contact files and supplier lists received by the Operator, from company websites and public directories, and from live Internet Search. The Operator also retains commercial contact data (the name as received, the contact number and the business, if any) of members of professional procurement groups and of hospitality entities received by it from the same sources, for the single purpose of the one introductory message in accordance with Article (8-16) Second, and the limits and rights in Article (8-15) Fourth and Fifth apply to it. Details of this database, its sources and the rights of its data subjects are in Article (8-15).

Article (8-2): Purposes of Processing

Data is processed exclusively for the following purposes:

Operating the supplier search service: understanding, extracting and organising your request, matching it against the supplier database and against public sources on the internet through Internet Search, and displaying the Search Results to you in accordance with Articles (3-6) and (3-7).
Delivering the Buyer's request to the matching Registered Suppliers who have consented to appear in accordance with Article (6-10), and enabling the Buyer to contact unregistered Suppliers itself in accordance with Article (7-11).
Registering and verifying businesses: extracting the data of uploaded documents, inferring the business's sector from its profile if uploaded, and issuing the Business Card, the Product Catalogue and the request forms in accordance with Article (6-9).
Managing Credits and Operational Quotas in accordance with Article (5-11), and operating the Invitation Program and the Guaranteed Request in accordance with Article (5-12): linking the invitee's registration to the person who invited them, informing the inviter of the invitee's business name or their name as they registered it unless they object, informing the invitee of the name of the person who invited them, and granting the Credit or Guaranteed Requests due.
Managing subscriptions and issuing invoices in accordance with Article (5-10), and fulfilling statutory and accounting obligations.
Internal operational supervision: a dashboard viewed by the Operator showing requests, their owners and the items requested, for quality control, the handling of complaints and support.
Building and auditing a unified item catalogue: compiling the names of items requested by Buyers or offered by Suppliers and reviewing them automatically (by the artificial intelligence provider mentioned in Article (8-13)) and by humans, without the names and mobile numbers of persons when sent for auditing, together with automated auditing of matching quality.
Improving search: saving Internet Search results together with the request that produced them for reuse in similar requests, within the periods in Article (8-7).
Supplier-to-Buyer connection services that Nusuq develops in the future and announces, within the limits of the consent to appear in accordance with Article (6-10).
Communicating with you: service messages about your account, your requests and the Platform's services, and introductory and marketing messages about RASA in accordance with Article (8-16).
Security and the prevention of misuse, and keeping the consent log and the log of opt-outs from messages.
Internal Statistics on the Platform's performance in the sense defined in Chapter Two.

Data is not processed for any purpose not mentioned here except after this Article has been updated and you have been notified in accordance with Chapter Fifteen of the Terms and Conditions (the document amendment mechanism).

Article (8-3): What Is Not Done with Data

The data of Users and the data of businesses listed in the supplier database is not sold to any third party, under any circumstances, whatever the financial consideration. This is an absolute commitment without restriction or exception.
Your data is not used to show you advertisements of other parties, and it is not handed to any advertiser or entity for its advertising purposes. RASA's introductory messages about its services are governed by Article (8-16) and you may stop them immediately.
Your contact data is not disclosed to another User except within the limits you have agreed to in these Terms: Article (5-8) for contact data and requests between Buyers and Registered Suppliers, Article (5-12) for informing the inviter and the invitee, and Article (6-10) for the consent to appear. The commercial contact data of unregistered businesses in the supplier database is displayed in accordance with Articles (3-6) and (8-15).
Data is not analysed for purposes not mentioned in Article (8-2).
No predictive models or behavioural profiles are built about any particular User; the following are not deemed to be such: automated matching between a particular request and Supplier categories, the calculation of Credits and Operational Quotas, and the inference of a business's sector and activity from its profile if uploaded optionally.

Article (8-4): Processing by Artificial Intelligence Systems and Transfer of Data Outside the Kingdom

First: What is sent and why

The RASA service relies at its core on artificial intelligence systems operated by providers outside the Kingdom of Saudi Arabia (their names and roles are in Article (8-13)). The following data is sent to these systems, as it is and without prior anonymisation, to the extent necessary to perform the service: the texts of your requests and your messages relating to the request; the images of items and lists that you send; and the documents you upload yourself (the Commercial Register (CR), the tax certificate, the business profile, catalogues, price lists, and any other letter or file you choose to upload), including the names and numbers they contain. The purpose of sending is to read these materials, extract their data, classify your business, match items and search for Suppliers; it is technically impossible to read a document or an image without sending it in full.

Second: What we do not ask for, and our advice to you

The Platform does not ask for passwords or payment card data, and does not ask for bank account data other than what the Supplier chooses to include in the Business Card (the IBAN number). Any document you upload that contains bank data or data you do not want processed outside the Kingdom is processed like all other documents; therefore upload only what the service needs, and write the IBAN number as text if you wish to add it, instead of sending the full bank letter.

Third: The safeguards actually in place

Content is transmitted over an encrypted connection; the providers are used under the terms of their programming interfaces for commercial use, which prohibit the use of your data to train their models and specify a temporary, time-limited retention for monitoring purposes; and your data is neither published nor sold to any party. The Operator keeps the documents of these contractual terms and allows you to request a copy of them through the contact point in Article (8-9), and prepares a documented assessment of the risks of transfer outside the Kingdom and updates it when the providers change in accordance with Article (8-13).

Fourth: The legal basis

This processing and this transfer are necessary for the performance of the agreement between you and the Operator under which you request the service (Article Six, Paragraph Two, of the Personal Data Protection Law (PDPL)), and the transfer outside the Kingdom is carried out in accordance with Article Twenty-Nine of the Law and the Regulation on the Transfer of Personal Data Outside the Kingdom for the purpose of performing this agreement, with the contractual safeguards mentioned above. Accordingly, this transfer does not rest on your separate consent, and it is not possible to continue using RASA while objecting to it. You retain the right at any time to end your use and to request the deletion of your data in accordance with Article (8-8), and whatever rests on your optional consent remains withdrawable in accordance with Article (8-14).

Article (8-5): Data Sharing Within the Platform

The details of what is shared between Buyers and Registered Suppliers are set out in Articles (5-8), (5-12) and (6-10) of the Terms and Conditions, and what is displayed from the supplier database about unregistered businesses is set out in Article (8-15).

The general principle: the Buyer sees in the Search Results the Supplier's commercial contact data in order to contact it itself; the data of a Registered Supplier is displayed only to Buyers whose requests match its categories and after its consent to appear; the Buyer's data is sent only to the Registered Suppliers matching a particular request and upon the Buyer's approval, so that the Supplier receives the name of the buying business, the details of its request and the contact data specified by the Buyer; and the data of any party is not made available to other Users outside this framework in a manner that infringes its commercial privacy.

Article (8-6): Security Protection

The Operator applies organisational and technical measures appropriate to the size of its activity and the nature of the data, which are currently:

Encryption in transit via the approved secure encryption protocols between the messaging application, the Channel Provider, the Platform's servers and the artificial intelligence providers.
Restricting access to the server by an encryption key for a single designated operator, protecting the internal supervision dashboard with an access code, and limiting the viewing of data to the purposes of operation, support and quality control.
Restricting the file types accepted for upload (portable document files, images and spreadsheets of specified types) and rejecting all others.
Rotating daily and weekly backups on the server and a daily copy on a secured device belonging to the Operator, subject to the same access restrictions, with the Operator working on encrypting their archive.
A consent log, a log of opt-outs from messages and a conversation log, to track any unusual use.
Periodic review of these measures as the Platform grows, and updating of this Article when a new measure is added.

The Operator does not claim to apply enterprise standards that it does not actually apply, and does not guarantee absolute protection against intrusion. Details of breach notification are in Article (8-10).

Article (8-7): Data Retention Period

Account data, the Business Card, catalogues, product images and price lists: for the duration of the account; upon termination of the account or a deletion request, they are deleted from the operating systems within the period stated in Article (8-8), and disappear from the backups upon the lapse of an additional sixty (60) days in accordance with the backup cycle set out in item eight of this Article.
Uploaded verification documents (the Commercial Register (CR), the tax certificate, the IBAN letter and the business profile): retained for the duration of the account as evidence of the verification of the business; upon termination of the account or a deletion request, they are deleted from the operating systems within the period stated in Article (8-8), and disappear from the backups upon the lapse of an additional sixty (60) days in accordance with the backup cycle, while the data extracted from them remains with the account data. Documents uploaded without completion of registration are reviewed periodically and the Operator aims to delete them within ninety (90) days of their upload.
The conversation log with RASA, the log of items requested and the Internet Search results linked to requests: a maximum of twelve (12) months from their date, for the purposes of support, quality control and search improvement, after which they are deleted or anonymised by removing the name and mobile number from them.
Records of Quotation Requests and their dispatch to Suppliers: five (5) years after the end of the relationship.
Invoices, subscription and payment records and transfer receipts: ten (10) years after the end of the relationship in accordance with the commercial and accounting regulations.
The Electronic Consent log (Article (9-2)): not less than five (5) years, and it is exempt from deletion.
The log of opt-outs from marketing messages and the do-not-list-and-do-not-contact list (the contact number, the time of the request, its channel and its means): at least five (5) years from the last request, and for as long as the number exists in any contact list held by the Operator, so that the person who opted out is not targeted again and is not re-listed; it is exempt from deletion and is not deleted upon deletion of the account.
Backups: the daily backups on the server rotate every fourteen (14) days and the weekly ones every sixty (60) days, and the daily copy on the Operator's device is subject to the same cycle; accordingly any deletion applies to the backups automatically upon the lapse of sixty (60) days from its execution.
Dormant accounts: the Operator may treat an account that has not been used for twelve (12) consecutive months as a dormant account, and delete its basic data and its promotional Credits granted free of charge after notifying the User thirty (30) days in advance via their registered number, while retaining whatever records the regulations require to be retained in accordance with this Article. Paid Credits and subscriptions do not lapse through dormancy during their agreed validity period.
The hosting server logs of Visitors to the Official Page (the internet address and the browser type): a maximum of ninety (90) days in accordance with Article (8-13).
The records of unregistered businesses in the supplier database (Article (8-15)): twenty-four (24) months from the last update or contact, after which they are deleted or renewed from a documented source.

After the periods have elapsed, data is permanently deleted or anonymised for statistical analysis. If a law imposes a longer period, the longer period is adopted.

Article (8-8): Your Rights in Your Data and How to Exercise Them

Under the Personal Data Protection Law (PDPL), you have the following rights:

To access your stored data and obtain a copy of it in a structured format (an electronic spreadsheet or a data file) together with the files of your uploaded documents.
To rectify any inaccurate data; you may edit your business data directly from the "My Account" menu in the conversation whenever it is available.
To request the deletion of your data. Deletion covers: your account record, your uploaded documents, your Business Card and your Product Catalogue, the removal of your business from the supplier database if it was registered by you, and the removal of your name and number from the log of items requested and the conversation log. Excluded from it are: your Electronic Consent record (the identifier, the time and the version), the line of your opt-out from marketing messages if any, invoices and subscription records, and whatever the regulations require to be retained for the periods in Article (8-7).
To withdraw your consent to the consent-based processing operations mentioned in Article (8-14) Second.
To object to a particular processing operation, with an explanation of the effect of that on the service if the processing is necessary for it.

How to exercise them

The request is sent to the contact point in Article (8-9) from the mobile number or the email address registered in your account, or written in the RASA conversation itself (the word "خصوصية" ("privacy") or "حذف بياناتي" ("delete my data") displays the two request buttons to you). The Operator may verify the identity of the person making the request before executing it.

The Operator responds to and executes the request within the statutory period, which is thirty (30) days from its receipt, extendable by a further thirty (30) days in complex or multiple cases with notice to you of the extension, and aims to give an initial response within five (5) business days in ordinary cases. No fees are charged for the exercise of these rights.

If you are not satisfied with the response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels.

Article (8-9): The Data Protection Contact Point

The approved contact point for everything relating to your personal data (requests for access, rectification, deletion, withdrawal of consent, objection and complaints) is the email address complaints@nusuq.sa, which is an email address on the Operator's official domain and is checked regularly.

The Operator itself performs the functions of this point, including supervising compliance, communicating with the Saudi Data and Artificial Intelligence Authority (SDAIA) and notifying any breach. If the Operator appoints an independent personal data protection officer in accordance with the appointment rules issued by the Authority, this is announced on this page and in the Messaging Channel, and the officer's name is provided on request. The response periods for your requests are set out in Article (8-8).

Article (8-10): Data Breach Notification

If the Operator becomes aware of a breach, leak or unauthorised access affecting personal data, it undertakes the following:

Notifying the Saudi Data and Artificial Intelligence Authority (SDAIA) within seventy-two (72) hours of becoming aware of the breach, whenever the breach may harm the data or its subjects or conflict with their rights, in accordance with Article Twenty-Four of the Implementing Regulation of the Personal Data Protection Law (PDPL).
Notifying the affected Users without undue delay, and within a maximum of five (5) business days of becoming aware, via the Messaging Channel or the registered email address, stating the nature of the breach, the data affected, the measures taken, and what the User is advised to do to limit the impact (such as being wary of impersonation messages in RASA's name, or contacting their bank if an IBAN number was affected).
Documenting the breach, its causes and the corrective measures in an internal record made available to the Authority on request.

Article (8-11): Unified Confidentiality

The following confidentiality obligations apply to all Users, and remain in force for a period of two (2) years after the termination of any account on the Platform:

Not to disclose the data of other Users (Suppliers or Buyers) obtained by virtue of using the Platform.
Not to use the commercial information of Suppliers or Buyers outside the framework of the dealings authorised through the Platform.
To maintain the confidentiality of the details of Offers, their prices and their terms.

This Article repeals and replaces any earlier paragraphs relating to confidentiality in the other articles of this document, and is adopted as the unified reference for all confidentiality obligations.

Article (8-12): Notice and Takedown Mechanism

To protect the rights of the parties and prevent misuse of the Platform, the Platform applies a detailed notice and takedown mechanism:

A. Submitting the report

The reporting party must submit a written report through the Official Channels of the Platform, containing as a minimum:

The full identity of the reporting party and their means of contact.
A precise description of the reported content and its location on the Platform.
The reason for the report (intellectual property infringement, fraud, defamation, deception, etc.).
Documented evidence (certificate of ownership, court judgment, documents).
A written undertaking as to the accuracy of the information and the bearing of the consequences of a false report.

B. The Platform's procedures

Acknowledging receipt of the report within two (2) business days.
Reviewing the report within ten (10) business days.
Informing the reported party and giving them the opportunity to respond within five (5) business days; in cases of urgent danger or obvious infringement, the content is hidden as a precaution immediately after the initial review and the party is then informed.
Making the decision: removal, suspension, or rejection of the report.

C. The Platform's right to reject the report

Absence of the essential information.
Failure to provide sufficient evidence.
Proof that the report is false or made in bad faith.
Use of the report as an instrument of unlawful competition.

D. Consequences of a false report

A reporting party who is proven to have submitted a false or misleading report bears full compensation to whoever was harmed, is referred to the competent authorities, and exposes their account to immediate suspension.

Article (8-13): Recipient Entities and Place of Processing

RASA's systems, databases and backups are hosted outside the Kingdom of Saudi Arabia, your messages pass through the infrastructure of the messaging application provider, and their contents are processed by artificial intelligence providers outside the Kingdom. That is, your data is stored and processed primarily outside the Kingdom, with a daily backup inside it. The current recipient entities and the role of each:

Meta Platforms (the WhatsApp Business application): operating the Messaging Channel; your mobile number, your account name and the content of your messages and media pass through it, and are subject there to its terms and privacy policy in its capacity as the Channel Provider in accordance with Article (3-9).
OpenAI: understanding the texts of requests, reading uploaded images and documents and extracting their data, and Internet Search for Suppliers.
Anthropic: periodic auditing of the item names proposed for the unified catalogue; item names are sent to it without the names and mobile numbers of persons.
Hostinger (the hosting provider, with the server in Manchester, United Kingdom): hosting the server, the data files and the daily and weekly backups.
A daily backup pulled to a secured device belonging to the Operator inside the Kingdom, subject to the retention periods in Article (8-7).

Visitors to the Official Page: when the Terms page or the Privacy page on nusuq.sa is opened, the internet address of the Visitor's device and their browser type reach the Operator's server logs at the hosting provider mentioned above automatically for security purposes, and these logs are retained for a period not exceeding ninety (90) days; the two pages do not load fonts or tools from external parties, so the Visitor's address does not reach any other party merely by browsing.

The legal basis for this transfer is the necessity of performing the agreement between you and the Operator (Article Twenty-Nine of the Personal Data Protection Law (PDPL) and the Regulation on the Transfer of Personal Data Outside the Kingdom) combined with the contractual safeguards of each provider, and the Operator prepares a documented assessment of the risks of this transfer and updates it when the providers change. You may request a copy of the providers' safeguards through the contact point in Article (8-9).

If a provider is replaced by another performing the same role within the categories above, this table is updated on the Official Page and Users are notified via the Messaging Channel, and this is not deemed a Material Amendment; whereas the addition of a new processing category is a Material Amendment subject to Article (15-2).

Article (8-14): Bases of Processing and What May Be Withdrawn

First: Processing necessary for the service

Its basis is the performance of the agreement with you or a statutory obligation, and it does not rest on a separate consent:

Creating your account and documenting your consent to this document.
Understanding your requests, matching them with Suppliers and displaying the Search Results to you.
Reading the images and documents you choose to upload and extracting their data.
Delivering the Buyer's request to the matching Registered Suppliers.
Calculating Credits, Operational Quotas and subscriptions, issuing invoices and keeping their records.
The service messages mentioned in Article (8-16) First.
The Invitation Program in accordance with Article (5-12): linking your registration to the person who invited you, informing your inviter of your business name or your name as you registered it upon completion of your registration through their link, and informing you of the name of the person who invited you, in performance of the provisions of the program accepted by both parties by accepting these Terms; the invitee may, upon registration, object to their inviter being informed of their name, in which case the inviter is not informed of it. Your sharing of your invitation link with others is a voluntary act on your part at your own responsibility in accordance with Article (7-11).

Providing data in these processing operations is mandatory to the extent required by the service; failure to provide it means only that the service concerned cannot be performed (for example, a person who does not upload a Commercial Register (CR) does not receive the "Verified Supplier (CR matches name)" badge).

Second: Processing based on your consent

Withdrawing it at any time does not affect the rest of the service:

The appearance of your business as a Supplier in the supplier database and the delivery of Buyers' requests to you (taken by a separate consent button upon Supplier registration in accordance with Article (6-10); withdrawing it stops the appearance and the notifications without closing your account).
Reading your business profile to infer its sector and activity (uploading it is optional and has a skip button).
Receiving introductory and marketing messages from RASA (in accordance with Article (8-16) Second).

Any of these consents is withdrawn by a request through the contact point in Article (8-9), or by the immediate means mentioned alongside each of them, and the withdrawal applies to subsequent processing without effect on what preceded it.

Third: Data received from someone other than its subject

Commercial contact data received from someone other than its subject (the supplier database, and the data of members of professional groups and hospitality entities) is subject to Article (8-15).

Article (8-15): The Supplier Database, Its Sources and the Rights of Its Data Subjects

First: What it is

The Operator maintains a supplier directory containing, alongside registered Users, commercial contact data of businesses and their representatives who did not register themselves in RASA, and of members of professional procurement groups and hospitality entities whose data reached the Operator from the same sources set out in Second. The data categories: the name of the business or its trade name or the name of its representative as received, the contact number, the email address and website if any, the classification or category and the activity, the city, and the source of the record, the date of its receipt and its context. No documents, financial data or data about individuals beyond what is public or shared for commercial contact are collected about these persons.

Second: Its sources

Postings by members of a professional procurement group on the messaging application which the Operator was able to view in its capacity as a member of the group, where members share the numbers of Suppliers they recommend; the contact data of the members themselves also came from this source.
Contact files and supplier lists received by the Operator from professional Buyers, and postings by the Platform's Users about their Suppliers.
Company websites and commercial directories published on the internet, and the results of live Internet Search upon the Buyer's request, which are added to the database tagged with their source and date.

The Operator keeps, for each record, its source and, for whoever shared a Supplier's number within the group or through the Platform, a link between their name and what they shared, for the single purpose of enabling them to see "their suppliers" and granting them the invitation Credit upon their registration in accordance with Article (5-12); neither the sharer's name nor the text of their posting is disclosed to any other Supplier or Buyer.

Third: Purposes and legal basis

The data of unregistered businesses is processed for two purposes: displaying the commercial contact data to the searching Buyer so that it may contact the Supplier itself, and inviting the Supplier to register by a single introductory message in accordance with Article (8-16). The data of members of professional groups and hospitality entities is processed only for the single purpose of the one introductory message in accordance with Article (8-16) Second, and is not displayed in Search Results and is not used for anything else.

The legal basis is the legitimate interest of the Operator and of Buyers in reaching Suppliers, and of the Supplier in receiving purchase requests, in respect of contact data of a commercial nature which its subject made available for commercial contact in a professional context or which was published to the public for that purpose (Article Six, Paragraph Four, of the Personal Data Protection Law (PDPL)), with the data subject being notified at the first contact with them of the identity of the Operator, the source of their data and their rights, and without prejudice to their rights set out in Fifth.

Fourth: Safeguards and limits of display

Only the name of the business, its contact data, its classification and its city are displayed to the Buyer from this database, tagged as unverified in accordance with Article (3-6); no documents, prices or the context of the posting are displayed.
No request is sent to these businesses or persons automatically, and they are not contacted except in accordance with Article (8-16); the Operator works on excluding numbers that appear to be personal rather than commercial from the introductory messages.
This data is not sold and is not shared with third parties, and is corrected or deleted when proven to be erroneous.
The records of unregistered businesses in this database are retained for twenty-four (24) months from the last update or contact, after which they are deleted or renewed from a documented source, in accordance with Article (8-7).

Fifth: Rights of the subjects of this data

Any business or person whose data appears in this database may request at any time: to know the source of their data, or to rectify it, or to stop messages to them (executed immediately by the "Stop Messages" button or by writing "إيقاف" ("stop") in the conversation), or to object to its processing, or to remove their record entirely from the database and from the Search Results, through the contact point in Article (8-9) or by a message to the RASA number. Removal is carried out within five (5) business days and its execution is confirmed to the requester, and the contact number alone is retained in the do-not-list-and-do-not-contact list in accordance with Article (8-7) to ensure that listing is not repeated, and the number is not re-listed unless its owner registers themselves.

Article (8-16): Service and Marketing Messages and the Right to Opt Out

First: Service messages

These are sent to operate the service, require no additional consent and cannot be stopped for as long as the account exists: replies to your requests, notification to the Supplier of the arrival of a matching request, Search Results, invoices and Credit and subscription alerts and changes to Credits or fees, invitation notifications, security alerts, notifications of amendment of this document, and requests for renewed consent.

Second: Introductory and marketing messages

The Operator may send introductory messages about RASA, its features and its offers as follows:

To registered Users: a maximum of one message per month.
To unregistered businesses, members of professional groups and hospitality entities whose data is referred to in Article (8-15): one introductory message per number, identifying in an explicit sentence the identity of the Operator and the source of the number as recorded with it, containing a link to this policy and an immediate, free means of stopping, and not repeated unless the owner of the number replies or registers.
Messages are sent through templates approved by the Channel Provider, and state that the service is currently free of charge, and that any future fees are not imposed on an existing User without prior notice to them in accordance with Chapter Fifteen.

Third: Opting out and its record

You may stop introductory and marketing messages at any time and free of charge by pressing the "Stop Messages" button in the message itself, or by writing the word "إيقاف" ("stop") or words to that effect in the conversation, whether you are registered or not. The stop is executed immediately and automatically, and no marketing message is sent to you thereafter.

The stop request (the number, the time, the channel and the means of the request) is retained in a separate compliance record that survives the deletion of your account or your data so that you are not targeted again, and is used exclusively to ensure that you are not contacted, for the period set out in Article (8-7). The stop remains in effect until you expressly request reactivation through the contact point in Article (8-9). The stop does not affect the service messages in First, and no prior notice is required for it.

Fourth: Recipient lists

Recipient lists are not shared with any third party, and the numbers of registered Users are not used in campaigns for anything other than RASA's services.

Summary