Application Privacy Policy

1. Introduction

Rushd respects the privacy of individuals whose Personal Data we collect and process. This Privacy Policy is intended to provide clear information regarding Personal Data processed through our Applications and is designed to support compliance with applicable laws and regulations, including the Saudi Arabian Personal Data Protection Law (“PDPL”) and its Implementing Regulations, where applicable.

2. Data Controller

Data Controller: Hulul Rushd Company. Commercial Registration: 7051464175. Registered Address: RUQB3118 - 3118 Sadir Street, 6976 Qurtubah District, 13245 Riyadh, Saudi Arabia. Privacy Contact: contact@rushdsolutions.com.

Where Rushd provides an Application to an enterprise customer and processes Personal Data on behalf of that customer, the customer may be the Controller and Rushd may act as a Processor or service provider. Processing will also be governed by the applicable agreement and customer’s instructions.

3. Personal Data We May Collect

Categories may include identity information; contact information; application and account information; technical information; content submitted through an Application; communications; and information received from other lawful sources.

Depending on the Application, this may include names, identification information where required, employee or user IDs, usernames, professional and organisation information, email and telephone numbers, authentication information, IP addresses, device information, application activity, documents, forms, text, images, audio, video, business records, financial or commercial information, prompts, support correspondence and technical or security information.

Users should not submit Sensitive Data unless the relevant Application expressly permits such submission and the required safeguards are in place.

4. Purposes of Collection and Processing

Rushd may process Personal Data to provide and operate Applications; manage accounts; verify identity and authentication; provide requested services; process transactions and service requests; provide support; integrate authorised systems; maintain performance and security; detect and investigate fraud or misuse; maintain audit trails; improve services; comply with legal and regulatory requirements; establish or defend legal claims; communicate service and security information; and perform other purposes disclosed at or before collection or otherwise permitted by law.

Rushd seeks to limit Personal Data collected to what is necessary and appropriate for the relevant purpose.

5. Legal Basis for Collection and Processing

Rushd will process Personal Data only where there is an applicable legal basis under the PDPL and other applicable laws. Depending on the circumstances, this may include consent; contractual necessity; legal obligation; protection of vital interests; legitimate interests where permitted; or another recognised legal basis. Where consent is required, Rushd will seek consent through an appropriate mechanism.

6. Information Provided at Collection

Where Personal Data is collected directly from a Data Subject, Rushd will provide information required by applicable law, including, where relevant, the identity of the Controller, purposes of collection, categories of Personal Data that are mandatory and optional, legal basis, parties to whom Personal Data may be disclosed, whether Personal Data may be transferred or processed outside the Kingdom, consequences of not providing required information, and applicable Data Subject rights.

7. Artificial Intelligence and Automated Processing

Certain Rushd Applications may incorporate artificial intelligence, machine learning, natural language processing, analytics, automated workflows, conversational AI and other automated technologies.

Depending on the Application, Personal Data may be processed to generate responses, classify or analyse information, extract information, identify patterns, detect anomalies, generate summaries or reports, automate processes, support operational decisions or provide other AI-enabled functionality. The specific processing depends on the Application and its configuration. Rushd will not intentionally use Personal Data for purposes unrelated to the purpose for which it was collected, except where permitted by applicable law.

Where automated decision-making or profiling has legal or similarly significant effects and applicable law provides specific rights or safeguards, Rushd will provide the information and mechanisms required by law.

8. Disclosure of Personal Data

Rushd may disclose Personal Data to customers and organisations; service providers and processors supporting cloud infrastructure, hosting, cybersecurity, authentication, communications, analytics, AI and machine-learning infrastructure, monitoring, support, payment processing and other operations; competent authorities where required or permitted; and parties involved in corporate transactions, subject to applicable law.

9. Transfers and Processing Outside the Kingdom

Some Rushd Applications may use infrastructure, technology providers or service providers located outside the Kingdom of Saudi Arabia. Where Personal Data is transferred, disclosed or processed outside the Kingdom, Rushd will apply the requirements and safeguards applicable under the PDPL and its Implementing Regulations. Where required, information concerning the relevant international transfer, destination or safeguards will be provided to the Data Subject.

10. Data Storage and Retention

Rushd will retain Personal Data only for the period necessary to fulfil the purposes for which it was collected, unless a longer period is required or permitted by applicable law. Retention may depend on the purpose, type and sensitivity of Personal Data, contractual requirements, legal requirements, disputes, security and audit requirements, and the nature of the Application. Where Personal Data is no longer necessary, Rushd will cease processing and securely delete, destroy or anonymise it in accordance with applicable requirements.

11. Data Security

Rushd maintains appropriate technical and organisational safeguards designed to protect Personal Data against unauthorised access, unlawful processing, accidental loss, destruction, alteration, disclosure and misuse. Security controls may include role-based access controls, authentication, encryption where appropriate, logging and monitoring, infrastructure security, vulnerability management, backup and recovery controls, and organisational security procedures.

12. Data Subject Rights

Subject to applicable law and exceptions, Data Subjects may have rights to be informed about processing; access Personal Data; request correction or completion of inaccurate or incomplete Personal Data; request deletion or destruction where legally applicable; request restriction of certain processing; withdraw consent where processing is based on consent; object to certain processing where permitted; and exercise other rights available under the PDPL and its Implementing Regulations.

13. How to Exercise Your Rights

Privacy requests may be submitted to contact@rushdsolutions.com. Where possible, include your name, contact details, Application concerned, nature of the request and sufficient information to identify the relevant Personal Data. Rushd may take reasonable steps to verify identity before responding. Where Rushd processes Personal Data on behalf of an enterprise customer, we may direct the request to the relevant customer or assist that customer as appropriate.

14. Cookies and Similar Technologies

Applications may use cookies, local storage, software development kits, logs and similar technologies for authentication, security, session management, functionality, preferences, analytics and application performance. Where consent is required by applicable law, Rushd will obtain the necessary consent before deploying non-essential technologies.

15. Sensitive Personal Data

Certain categories of Personal Data may receive additional protection under applicable law. Users should not provide Sensitive Personal Data through an Application unless the Application specifically requires or permits it, appropriate legal basis exists, and necessary safeguards are in place.

16. Accuracy of Personal Data

Rushd will take appropriate measures, where required, to ensure that Personal Data processed by it is accurate, complete, current and relevant to the purpose for which it is processed. Data Subjects should notify Rushd or the relevant customer where information requires correction or updating.

17. Children

Our Applications are primarily designed for business, professional and organisational use and are generally not directed at children. We do not knowingly collect children’s Personal Data where prohibited by applicable law.

18. Third-Party Services

Applications may integrate with third-party platforms, systems and services. Those third parties may process Personal Data under their own privacy policies and terms. Rushd is not responsible for independent privacy practices outside Rushd’s control.

19. Complaints

If you have a concern regarding the processing of your Personal Data, we encourage you to contact Rushd first so we can investigate and address the concern. You may also have the right to lodge a complaint with the competent regulatory or supervisory authority under applicable law.

20. Changes to This Privacy Policy

Rushd may update this Privacy Policy to reflect changes to Applications, processing activities, technology or service providers, applicable laws, or privacy practices. The Last Updated date will indicate when the Privacy Policy was most recently revised. Where required by law, appropriate notice of material changes will be provided.

21. Contact Us

Hulul Rushd Company / Rushd Solutions
Privacy Contact: contact@rushdsolutions.com
Registered Address: RUQB3118 - 3118 Sadir Street, 6976 Qurtubah District, 13245 Riyadh, Saudi Arabia
Commercial Registration: 7051464175
Website: https://rushdsolutions.com

22. Application-Specific Privacy Notices

Certain Rushd Applications may process additional categories of Personal Data or provide functionality requiring additional privacy information. Where applicable, an Application-specific notice may describe specific Personal Data collected, purposes, mandatory and optional information, retention, processors, international transfers, AI processing and additional rights. It should be read together with this Privacy Policy.