PRIVACY POLICY — SERVICE PROVIDER
This Privacy Policy explains how Takhlees Alaamal Company, commercial registration no. 7054383083, a company organized under the laws of the Kingdom of Saudi Arabia ("Company", "We", "Us"), collects, uses, stores and protects the personal data of individuals registering as Service Providers ("Service Provider", "You") through the Khalesaha service provider application. The Company is the controller of Your personal data under this Policy.
This Policy is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations.
Version 2, effective 22 September 2026.
By creating an account or using the application, You acknowledge that You have read and understood this Policy.
1. DATA WE COLLECT FROM YOU
We collect only the data needed to verify Your identity, enable You to receive and complete orders, and pay You. Specifically:
Your mobile phone number, which You provide to sign in and which is verified by a one-time code.
Your full name, national identity number, and date of birth, which You provide during onboarding so that Your identity can be verified.
Your city, and the cities and branches in which You choose to offer services.
Your bank account number (IBAN), which is used solely to pay Your earnings.
Verification documents that You upload, such as identity or licensing documents required to approve Your account.
A profile photograph, which is optional and which You may add, replace or remove at any time.
Your preferred language for the application interface.
2. DATA GENERATED BY YOUR USE OF THE APPLICATION
Records of the orders You accept, reject, progress and complete, including any delivery summary or proof of delivery You submit.
Records of Your earnings, payouts and their status.
Financial documents issued by the Company to You: an invoice for each completed order, a statement for each settled payout, and a credit note for any amount later deducted. These show the price of the work, the commission deducted, the net amount paid and the bank reference of the transfer. They are issued in the Company's name, are not altered after issue, and do not contain the Customer's name.
Ratings and rating counts submitted by Customers.
The status of Your account, including any reason recorded for suspension or rejection.
An availability signal indicating that You are currently active in the application. This signal records only the fact and time of activity. It contains no location data.
3. DATA WE DO NOT COLLECT
We do not collect Your geographic location. The application does not request, access or transmit GPS or any other location data at any time.
We do not use analytics, crash reporting, advertising or tracking services of any kind, and no third-party software of that nature is embedded in the application.
We do not access Your contacts, microphone, calendar, message history, or health data.
We do not sell, rent or trade Your personal data to any party, under any circumstances.
4. DATA HELD ONLY ON YOUR DEVICE
The following are stored in protected storage on Your device and are never transmitted to Us:
Your sign-in session tokens, held in the operating system's secure storage.
Your application PIN, which is stored only as a cryptographic hash together with a random salt. The PIN itself is never stored and is never sent to Us or to any other party.
Your preference to use fingerprint or facial recognition to unlock the application. Where You enable this, the biometric data itself is held by Your device's own operating system and is never accessible to Us.
5. PERMISSIONS THE APPLICATION REQUESTS
Camera access, used only when You choose to photograph a verification document or a profile photo.
Photo library access, used only when You choose to select an existing image for the same purposes.
Fingerprint or facial recognition, used only to unlock the application where You have enabled it.
Each permission is requested at the moment You first use the feature that needs it, and each may be refused or later withdrawn in Your device settings without losing access to the rest of the application.
6. HOW WE USE YOUR DATA
To verify Your identity and eligibility to provide services through the Platform.
To make Your services available to Customers and to route orders to You.
To pay Your earnings to the bank account You provide.
To communicate with You about Your account, Your orders and Your payouts.
To detect, investigate and prevent fraud, misuse and breaches of the Terms and Conditions.
To comply with legal, regulatory, tax and anti-money-laundering obligations applicable to Us.
We do not use Your personal data for automated decision-making that produces legal effects concerning You without human review.
7. WHO ELSE MAY SEE YOUR DATA
Customers, who are shown the information necessary to receive Your services, including Your name and the ratings recorded for Your account. Customers are not shown Your national identity number, Your date of birth, Your bank account number, or Your verification documents.
Cloud hosting and storage providers engaged by Us to operate the Platform. Documents and photographs You upload are transmitted directly to secured storage using time-limited authorization issued by Us for that single upload.
Payment and banking institutions, to the extent necessary to transfer Your earnings.
Competent governmental and judicial authorities of the Kingdom of Saudi Arabia, where We are legally obliged to disclose.
Professional advisers bound by obligations of confidentiality.
We require every processor engaged by Us to protect Your data to a standard no lower than that set out in this Policy.
8. TRANSFER OF DATA OUTSIDE THE KINGDOM
Where any processing or storage of personal data takes place outside the Kingdom of Saudi Arabia, it is carried out only in the circumstances permitted by the Personal Data Protection Law and its Implementing Regulations, and subject to the safeguards those instruments require.
9. HOW LONG WE KEEP YOUR DATA
We retain Your personal data for as long as Your account remains active, and thereafter for the period required to satisfy the legal, regulatory, tax, accounting and dispute-resolution obligations that apply to Us. Some data is reduced or removed earlier, on a fixed schedule:
Images uploaded to an order, including any proof of delivery, cease to be accessible through the application once the order's dispute window has closed (72 hours after completion, cancellation or rejection, plus a 24-hour margin). Where a dispute is open, they remain accessible until it is resolved. The stored files are deleted 90 days after the order closes.
The Customer's address recorded on an order is reduced to the city alone 90 days after the order closes; the street, coordinates and directions are removed permanently.
Notifications delivered to You in the application are deleted after 90 days.
One-time sign-in codes and expired sign-in sessions are deleted automatically once they can no longer be used.
Financial documents issued to You (invoices, payout statements and credit notes) are retained for the period required by the tax and commercial regulations that apply to Us.
Data no longer required for any of those purposes is deleted or irreversibly anonymized.
10. DELETING YOUR ACCOUNT
You may request deletion of Your account from within the application, under Settings.
Deletion removes Your profile and Your access to the Platform, and removes Your name from the financial documents already issued while the underlying record of the amounts is retained. Records that We are legally obliged to retain — including transaction, payout and tax records — are kept for the period the applicable law requires, and are not used for any other purpose during that period.
Deletion cannot be completed while You have orders in progress or amounts outstanding.
11. YOUR RIGHTS
Under the Personal Data Protection Law You have the right:
To be informed of the legal basis and purpose of collecting Your personal data.
To request access to Your personal data held by Us.
To request a copy of Your personal data in a readable and portable format.
To request correction of personal data that is inaccurate, incomplete or out of date.
To request destruction of Your personal data where it is no longer necessary for the purposes for which it was collected, subject to the retention obligations described in this Policy.
To withdraw consent to processing that is based on consent, at any time, without affecting the lawfulness of processing carried out before withdrawal.
To lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent supervisory authority in the Kingdom of Saudi Arabia, in addition to or instead of raising it with Us.
We respond to requests concerning these rights within the period prescribed by the applicable regulations, and in any case within thirty days of receiving a complete request.
12. SECURITY OF YOUR DATA
All communication between the application and our systems is encrypted in transit.
Session credentials and Your PIN hash are held in the secure storage facilities provided by Your device's operating system.
Access to personal data within the Company is restricted to personnel who require it to perform their duties.
Uploaded documents are transmitted using single-use, time-limited authorization and are not publicly addressable.
No system can be guaranteed absolutely secure. Where a personal data breach occurs, We notify the competent authority and affected persons in accordance with the requirements of the Personal Data Protection Law.
13. CHILDREN
The Platform is not directed to persons under eighteen years of age, and registration as a Service Provider requires that You be at least eighteen. We do not knowingly collect personal data from children. Where We become aware that We hold such data, We delete it.
14. CHANGES TO THIS POLICY
We may amend this Policy. The version published on our website is the version in force. Where an amendment materially affects how Your personal data is processed, We will make reasonable efforts to notify You through the application before it takes effect.
15. CONTACT
Questions, requests concerning Your rights, and complaints regarding personal data may be addressed to Us:
By email to customercare@khalesaha.com.
Through the support channel provided in the application.
In writing to Takhlees Alaamal Company, commercial registration no. 7054383083, Kingdom of Saudi Arabia.
We may ask You to verify Your identity before acting on a request concerning Your personal data.