Privacy Notice

The Saudi Real Estate Refinance Company (SRC) is a Saudi joint-stock company regulated by the Saudi Central Bank (SAMA). It operates in the real estate refinancing sector, contributing to the support and sustainability of the real estate finance sector in the Kingdom of Saudi Arabia. SRC's transactions are limited to real estate finance companies and local banks licensed by SAMA only, without any direct dealings with individuals.

The Saudi Real Estate Refinance Company (SRC) (hereinafter referred to as "SRC," "we," "us," or "our") is committed to protecting and respecting your privacy in accordance with the Personal Data Protection Law (PDPL) and its implementing regulations, and in compliance with all relevant regulatory requirements, including those of Saudi Central Bank (SAMA), and the company's internal policies.

The privacy policy (“the Policy”) in force at the Saudi Real Estate Refinance Company (SRC) sets out the basis on which we collect any general and/or personal information from you, or information that you provide to us, which we in turn process.

The purpose of the policy is to help you protect your personal data by complying with the Personal Data Protection Law (PDPL) and its implementing regulations in force in the Kingdom of Saudi Arabia.

Contacting SRC:

For any inquiries regarding this policy or the processing of personal data within its scope, please contact the company through the following official channels:

Dedicated Team: Data Management Office, Saudi Real Estate Refinance Company (SRC).

Email: DPO@srco.com.sa

Address: Saudi Real Estate Refinance Company - Roshan Front Complex, Building N7, King Khalid Airport Road, Riyadh, Kingdom of Saudi Arabia.

When submitting a request for personal data, the company may request additional information to verify the applicant's identity in accordance with applicable laws and regulations. The company will review and respond to requests within the prescribed timeframe, taking into account any exceptions or restrictions stipulated in applicable regulations.

The types of personal data that the SRC may collect, the methods of collecting it, and its purpose:

The company may collect and process the minimum personal data necessary within the scope of this policy and the limits required by the nature of the interaction, in accordance with the relevant regulations and instructions in force in the Kingdom of Saudi Arabia.

Based on the above, and for the purposes of employment applications or processing your application and facilitating your access to the Saudi Real Estate Finance Company (SRC) premises, the data shown below will be collected from you directly after obtaining your consent:

Categories of Data Subjects:

Visitors to the Saudi Real Estate Refinance Company (SRC) premises, and Business partners.

Job Applicants

Types of Personal Data:

Identifying Information: This may include your first name, last name, and the organization you represent (if applicable).

Contact Information: This includes email addresses and phone numbers.

Pre-Employment Information: This includes any personal data that appears in your resume.

Processing of personal data:

Personal data is processed within the scope of this policy in accordance with the regulations stipulated in the Personal Data Protection Law, its implementing regulations, and other relevant regulatory instructions applicable in the Kingdom of Saudi Arabia, and in line with the nature of the Saudi Real Estate Refinance Company's (SRC) operations. This includes fulfilling a request submitted by the data subject or pursuing a legitimate interest that does not infringe upon their statutory rights.

Sharing personal data:

Personal data may be shared to the extent necessary, after verifying that there is a legitimate regulatory or operational justification for such sharing, and in a manner that ensures data protection and confidentiality. This is limited to facilitating your access to the premises of the Saudi Real Estate Refinance Company (SRC).

If your data is to be processed or shared outside the Kingdom of Saudi Arabia (if applicable), you will be provided with information about the entity or entities to which your personal data will be disclosed, their capacity, and, if disclosure is required, the primary purpose will be clearly and precisely explained, along with whether the disclosure will be incidental (one-time) or recurring (multiple times).

Storage of personal data, retention period, and destruction:

Personal data is stored in secure systems or locations within the Kingdom of Saudi Arabia, in accordance with applicable regulations. It is retained for the periods necessary to fulfill the purpose for which it was collected, or as required by law. Data is destroyed, depending on the storage method, including physical or electronic destruction, or its identity is anonymized after its purpose has been fulfilled using secure methods that ensure it cannot be recovered or its owner re-identified.

Data Subject rights and how to exercise them:

In accordance with the Personal Data Protection Law, data subjects have the right to exercise their legal rights related to their data within the scope of this policy. The exercise of these rights is subject to the controls and exceptions stipulated in the relevant laws and regulations.

Your rights available to manage your privacy, as stipulated in Article (4) of the Personal Data Protection Law:

The right to know includes being informed of the legal justification for collecting your personal data and the purpose of its collection, provided that your data is not processed in a manner inconsistent with the purpose of its collection or in circumstances other than those stipulated in your consent to the processing.

The right to request access to your personal data held by us, in accordance with the controls and procedures specified in the relevant regulations, without prejudice to the provisions of Article (9) of the Law. This includes reviewing it and obtaining a copy of it in a clear format that matches the content of the records, free of charge, as specified in the relevant regulations. Furthermore, your exercise of the right to access your personal data shall not negatively affect the rights of others, such as intellectual property rights or trade secrets.

The right to request that your personal data held by us be presented in a legible and clear format, in accordance with the controls and procedures specified in the relevant regulations.

The right to request the correction, completion, or updating of your personal data held by us.

The right to request the destruction of your personal data held by us that is no longer needed, without prejudice to the provisions of Article (18) of the Law.

The right to withdraw your consent to the processing of data collected about you, whether because you have withdrawn your consent to data collection or because the data no longer serves the purpose for which it was collected, as stipulated in Article (12) of the Implementing Regulations of the Law.

For more details about the processing of your personal data, and how to exercise your rights, you can contact the company’s Data Management Office via the communication channels outlined in Section (7) of this policy.

How to submit complaints and objections:

The data subject may submit a complaint or objection related to the processing of their personal data, a request to exercise their legal rights, or a request for compensation for damages, by contacting us through the channels described in Section (1) of this policy. The company will review the complaints, inquiries, or requests to exercise legal rights. Implementing some requests may require verifying the identity of the applicant or requesting additional information or documents when necessary to protect personal data and ensure the integrity of its processing. These will be dealt with and responded to within 30 days from the date of receiving the completed request, and this period may be extended for a similar period, when necessary, in accordance with the Personal Data Protection Law and its implementing regulations or any other relevant laws or instructions. And if you are not satisfied with the way we are handling your request, you can file a complaint with the Saudi Central Bank (https://www.sama.gov.sa).

Policy updates:

The effective date of this notice is 14 June 2026, and any updates or changes to this notice will be posted on this website with the new version date, which is the effective date of the changes. Your continued use of this website constitutes your acceptance of any changes to this notice.