PRIVACY POLICY — CUSTOMER
This Privacy Policy explains how Takhlees Alaamal Company, commercial registration no. 7054383083, a company organized under the laws of the Kingdom of Saudi Arabia ("Company", "We", "Us"), collects, uses, stores and protects the personal data of individuals and entities using the Khalesaha customer application ("Customer", "You"). The Company is the controller of Your personal data under this Policy.
This Policy is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations.
Version 1, effective 22 September 2026.
By creating an account or using the application, You acknowledge that You have read and understood this Policy.
1. DATA WE COLLECT FROM YOU
We collect only the data needed to identify You, to accept and fulfil Your orders, and to collect payment for them. Specifically:
Your mobile phone number, which You provide to sign in and which is verified by a one-time code sent to that same number.
Your full name and national identity or residency number, which You provide during registration so that Your identity can be verified as required by applicable law.
Where You register as a business: the business name, its registered name, and its commercial registration details.
The city You select from the list of cities in which the platform operates.
Delivery details that You provide where a service requires them, so that the service can be completed.
Documents and images that You upload in relation to an order, such as the paperwork a particular service requires.
Your preferred language for the application interface.
2. DATA GENERATED BY YOUR USE OF THE APPLICATION
Records of the orders You create, including the service requested, the assigned service provider, the price, and the order's status and timeline.
Records of payment attempts and their outcomes, including whether a payment succeeded, was declined, or did not complete, and how many payment attempts remain on an order.
The rating and any accompanying comment You submit for a completed order.
Any objection You raise in relation to an order, and the correspondence recorded in connection with it.
The status of the power-of-attorney requirement for the relevant order, where a service requires one.
A record of the version of the Terms and Conditions You accepted and the date of Your acceptance.
3. DATA WE DO NOT COLLECT
We do not collect Your geographic location. The application does not request, access or transmit location data at any time, and declares no location permission on either platform.
We do not collect Your email address or Your date of birth.
We do not use any analytics, tracking, crash-reporting or advertising services, and the application contains no third-party software of that kind.
We do not use cookies within the application.
We do not access Your contacts, microphone, calendar, message history or health data.
We do not receive or store Your card number, its expiry date or its security code. Those details are entered so as to pass directly to Our licensed payment service provider and do not reach Our systems at any stage. See Section 6.
We do not sell, rent or trade Your personal data with any party, under any circumstances.
4. DATA HELD ON YOUR DEVICE ALONE
Your session credentials, which are held in the secure storage provided by Your device's operating system.
Your application lock code, if You choose to set one. It is stored only as a cryptographic hash with a random value; the code itself is never stored, and is never transmitted to Us or to any other party.
Your preference to use fingerprint or face recognition to unlock the application. Where enabled, the biometric data remains with Your device's operating system and is not accessible to Us.
Your choice of the light or dark appearance for the application interface.
A short-lived technical record used to resume an interrupted payment, so that a payment You started is settled rather than lost. That record identifies the order and the attempt only, and contains no card data.
5. PERMISSIONS THE APPLICATION REQUESTS
Camera access, used only when You choose to photograph a document that an order requires.
Photo library access, used only when You choose an existing image for the same purpose.
Fingerprint or face recognition, used only to unlock the application where You have enabled it.
Each permission is requested when You first use the feature that needs it, and You may decline it, or withdraw it later in Your device settings, without losing access to the rest of the application.
6. PAYMENTS
Payments are processed by a payment service provider licensed by the Saudi Central Bank. When You pay, Your card details pass from Your device directly to that provider.
We receive only the outcome of the payment and the information needed to reconcile it against Your order: whether it succeeded, a reason code where it did not, and the amount and time.
Where Your bank requires additional verification of a transaction, that step takes place between You, Your bank and the payment service provider, and We do not see the details You enter in it.
If You choose to pay using a digital wallet provided by Your device manufacturer, that wallet and the payment service provider carry out the transaction, and We receive the same outcome information and no card data.
7. PURPOSES FOR WHICH WE USE YOUR DATA
To verify Your identity and Your eligibility to create orders through the platform.
To convey Your order to a service provider and enable them to fulfil it.
To collect payment for orders, and to reconcile, refund or investigate payments where necessary.
To communicate with You about Your account, Your orders and Your payments.
To handle objections and to enforce the Terms and Conditions.
To detect, investigate and prevent fraud and misuse of the platform.
To comply with the legal, regulatory, tax and anti-money-laundering obligations that apply to Us.
We do not use Your personal data to make automated decisions producing legal effects concerning You without human review.
8. LEGAL BASIS FOR PROCESSING
We process Your personal data on one or more of the following bases, as permitted by the Personal Data Protection Law:
Performance of a contract to which You are a party, covering the data needed to create Your account, create an order and collect payment for it.
Compliance with a legal or judicial obligation, covering identity verification and the retention of transaction and tax records.
A legitimate interest that does not conflict with Your rights, covering the prevention of fraud and misuse.
Your explicit consent, where a particular processing activity relies on consent. In that case You may withdraw Your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
9. WHO MAY SEE YOUR DATA
The service provider assigned to fulfil Your order, who is shown what is necessary to complete it, including Your name and the details and documents of that order.
Our payment service provider, to the extent necessary to collect, reconcile or refund a payment.
The hosting and cloud storage providers We engage to operate the platform. Documents and images You upload are transferred to secured storage using a time-limited authorization We issue for that transfer alone, and are not publicly accessible.
Competent governmental and judicial authorities in the Kingdom of Saudi Arabia, where We are legally required to disclose.
Professional advisers bound by duties of confidentiality.
We require every processor We engage to protect Your data to a standard no lower than that set out in this Policy.
10. TRANSFER OF DATA OUTSIDE THE KINGDOM
Where any processing or storage of personal data takes place outside the Kingdom of Saudi Arabia, it is carried out only in the circumstances permitted by the Personal Data Protection Law and its Implementing Regulations, and subject to the safeguards they require.
11. HOW LONG WE KEEP YOUR DATA
We retain Your personal data for as long as Your account exists, and thereafter for the period necessary to satisfy the legal, regulatory, tax, accounting and dispute-resolution obligations that apply to Us.
Data no longer necessary for any of those purposes is deleted or irreversibly anonymized.
12. DELETING YOUR ACCOUNT
You may request deletion of Your account from within the application.
Deletion removes Your profile and Your access to the platform. Records We are legally required to retain, including transaction and tax records, are kept for the period required by applicable law and are not used for any other purpose during that period.
Deletion cannot be completed while You have orders in progress or amounts outstanding.
13. YOUR RIGHTS
Under the Personal Data Protection Law, You have the right to:
Be informed of the legal basis for, and the purpose of, the collection of Your personal data.
Request access to Your personal data held by Us.
Request a copy of Your personal data in a readable and portable format.
Request correction of personal data that is inaccurate, incomplete or out of date.
Request destruction of Your personal data where it is no longer necessary for the purposes for which it was collected, subject to the retention obligations set out in this Policy.
Object to processing carried out on the basis of a legitimate interest.
Withdraw consent to processing based on consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Lodge a complaint with the Company, and with the competent supervisory authority in the Kingdom of Saudi Arabia.
We respond to requests concerning these rights within the period prescribed by law.
14. SECURITY OF YOUR DATA
All communication between the application and Our systems is encrypted in transit.
Session credentials and the hash of the lock code are held in the secure storage provided by Your device's operating system.
Access to personal data within the Company is limited to those who need it to perform their duties.
Uploaded documents are transferred using a single-use, time-limited authorization and are not publicly accessible.
No system's security can be guaranteed absolutely. In the event of a personal data breach, We notify the competent authority and the affected individuals as required by the Personal Data Protection Law.
15. CHILDREN
The platform is not directed at persons under eighteen years of age, and registration requires that You be at least eighteen. We do not knowingly collect personal data from children. Where We become aware that We hold such data, We delete it.
16. CHANGES TO THIS POLICY
We may amend this Policy. The version published on Our website is the version in force. Where an amendment materially affects how Your personal data is processed, We make reasonable efforts to notify You through the application before it takes effect.
17. CONTACT US
For any question about this Policy, to exercise any of Your rights under Section 13, or to make a complaint about the processing of Your personal data, You may contact Us:
By email at customercare@khalesaha.com.
Through the support channel available within the application.