Privacy Policy | Expo 2030 Riyadh

EXPO 2030 RIYADH COMPANY, a single shareholder joint stock company incorporated under the laws of the Kingdom of Saudi Arabia, registered with the Commercial Register under number 1009130769 dated 07 November 2024, having its main place of business located in Riyadh, Kingdom of Saudi Arabia, and having a share capital of 200,000,000 Saudi Arabian Riyals, of which 50,000,000 Saudi Riyals are fully paid (“ERC”, “we”, “us” or “our”) is committed to protecting the rights of Users (as defined below) of this website (expo2030riyadh.sa) (the “Website”) and confidentiality of their data. As such, ERC follows strict corporate guidelines to protect the Personal Data (as defined below) of the Users of this Website to ensure compliance with local data protection regulations, such as the Saudi Arabian Personal Data Protection Law and its Implementing Regulations (“PDPL”).

We have prepared this Website privacy policy (the “Privacy Policy”) to disclose our approach to collecting, processing and using Users’ Personal Data.

Please read this Privacy Policy carefully to fully understand your relevant rights. If you do not agree to this Privacy Policy in general, or any of its terms, you should immediately stop using the Website.

For additional enquiries and comments regarding the Privacy Policy, please feel free to email us at: [email protected].

We may modify or update this Privacy Policy from time to time, and any changes will be published on this web page. Any modifications or updates shall become effective immediately upon publication, so please review this page for any updates from time to time.

DEFINITIONS

“Legitimate Interest” refers to any necessary interest of the ERC that requires the processing of Personal Data for a specific purpose, provided it does not adversely affect the rights and interests of the data subject (i.e., the person to which the Personal Data relates).

“Personal Data” has the meaning given under applicable data protection laws (including the PDPL) and includes information from which a living individual is identified or identifiable and information that identifies, relates to, or could reasonably be linked with a particular consumer or household, including Sensitive Personal Data.

“Sensitive Personal Data” has the meaning given under applicable data protection laws, and in any case include Personal Data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Personal Data related to the hereditary or acquired characteristics of a natural person that uniquely identifies the physiological or health characteristics of that person, and derived from biological sample analysis of that person, such as DNA or any other testing that leads to generating such genetic data for the purpose of identifying the person, Personal Data related to an individual's health condition, whether their physical, mental or psychological conditions, or Personal Data related to services related to the health of an individual, including preventive, curative, rehabilitative and hospitalizing services, as well as the provision of medications, received by that individual, and data that indicates that one or both of the individual’s parents are unknown, and includes a consumer’s racial or ethnic origin information, religious beliefs, mental or physical health diagnosis or condition, citizenship status, driver’s license number, account log-in, financial account numbers, debit card or credit card numbers in combination with any required security or access code, biometric information, or precise geolocation information.

“User” means a user and/or visitor of the Website.

COLLECTING AND USING PERSONAL DATA

Personal Data Collected, Used, Stored or Transferred by Us about Users

We may collect, use, store and transfer the following categories of Personal Data about Users:

(a) name;
(b) contact information (including addresses, phone and contact numbers, email addresses);
(c) age (to ensure 18 years and older), nationality and country of residence;

(d) geolocation;

(e) User audience and demographic information, which may include professional title, industry sector, company size, areas of interest, user-defined preferences, and engagement categories;

(f) technical information, and device data (IP address, unique system identifiers and information logged by cookies or similar technologies), including usage information (such as the number of Users of the Website, how long they stay on a page, or which hyperlinks they click on) and User device information including, but not limited to, operating system, name and type, mobile internet network information, standard web information such as the type of browser and the pages visited;

(g) marketing and communications data, including User preferences in receiving marketing form us and our third-party partners, and User communication preferences;

(h) any feedback or survey responses that Users provide to us in relation to the Website;

(i) any information regarding accessibility barriers of the Users;

(j) information that Users provide us when they contact us under this Privacy Policy or in relation to the Website; and

(k) other information needed or permitted under applicable law.

The Purposes for Processing the Collected Data

The purposes for collecting Personal Data by ERC from Users are:

(a) to communicate with Users and contact them by phone or email (based on your recorded contact preferences). Such communications may be personalized through ERC’s CRM system, and its call center;
(b) to identify Users;
(c) to enforce our Website Terms of Use which are available at https://www.expo2030riyadh.sa/en/terms-conditions/;
(d) to provide third parties with statistical information (on any anonymised and aggregated basis);
(e) to keep Users updated about our products, services, events, news, and other information that we think may interest them;
(f) identifying and selecting Users to be considered for future event invitations - Users can ask us to stop doing this – please refer to section “User Rights” below;
(g) identifying and/or verifying User information through submitted and publicly available information;
(h) managing our relationship with Users, and dealing with your requests, complaints and queries;
(i) identifying information about a User’s device (such as the settings of the device used to access the Website);
(j) to administer and protect our business and the Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);
(k) to deliver online advertisements to Users (including on social media platforms, search engines, and other third party websites on the internet), and to measure or understand the effectiveness of the advertising we provide to Users (if Users do not wish us to process (including sharing) their Personal Data for online advertising, they can ask us to stop doing this – please refer to section “User Rights” below);
(l) to use data analytics to better understand User preferences, improve our services and to measure the effectiveness of our communications and marketing and tailor the marketing that Users receive - Users can ask us to stop doing this – please refer to section “User Rights” below);
(m) improving the relevance of event planning, through targeted communications (Users can ask us to stop doing this – please refer to section “User Rights” below);
(n) allowing Users to sign-up to marketing, including our sponsorship partners (where Users consent to this) - Users can ask us to stop doing this – please refer to section “User Rights” below);
(o) enabling Users to give us feedback or to participate in surveys;
(p) legal and/or regulatory compliance reasons including litigation and defence of claims; and
(q) distributing:
(i) relevant marketing communications and personalised suggestions and recommendations to Users about the Expo 2030 Riyadh, our products, services, offerings, promotions, and experiences that we think may be of interest to Users;
(ii) communications about events or marketing information; and/or
(iii) digital and printed publications created by ERC and/or its affiliates.

We will process User Personal Data on the basis of one or more of the following legal grounds (to the extent applicable): (1) where a User provides their consent; (2) where required by law; (3) if and where we have a Legitimate Interest to process a User’s Personal Data that is not outweighed by the User’s interests.

The Personal Data that a User provides will not be subject to decisions that will have a significant impact on them based solely on automated decision-making, unless we have a lawful basis for doing so; we have notified Users and have provided them with the means and procedures taken to protect their Personal Data; and we obtained User consent prior to using it for any automated decision-making.

Handling of your Personal Data

Only individuals within ERC and third parties as stated in this Privacy Policy, which need to have access for the purposes above (to carry out their own function related to the Website) will have access to User Personal Data processed under this Privacy Policy.

All personnel who have access to User Personal Data operate under strict corporate guidelines to ensure the protection of the data and compliance with local data security regulations.
We will not sell User Personal Data to third parties.

SECURE INFORMATION TRANSMISSION

Under this Privacy Policy, we commit to protect and process User information and Personal Data securely. We also take reasonable physical, administrative and technical measures to protect User Personal Data from loss, theft, unauthorized use, illegal access or modification.

However, the security of the internet cannot be completely guaranteed, and therefore, we cannot guarantee the security or protection of any Personal Data provided via our Website, by e-mail or other means. Accordingly, any transmission of information via the Website shall be solely at a User’s own risk.

USER PERSONAL DATA & THIRD PARTIES

User Personal Data will not be available to any other party except to third parties that process Personal Data on behalf of ERC (its processors). We may use processors for analytics tools, to improve the Website and User experience. Such processors may use the information provided about User visits to the Website and other websites (except User email addresses and telephone numbers) to provide information and traffic data about User experience and services that may interest Users. Users should read the privacy policy of the third parties, as we assume no responsibility for their data collection techniques. ERC’s processors are:

Zoho CRM;
Tihama Almona International Advertising Company and its affiliate companies;
Cloudflare; and
Vercel, Inc.

ERC may share Personal Data with government officials when a need arises. Such information will never be available for the public without User prior consent. Besides, such information will not be circulated, exchanged nor sold to any other party without User prior consent.

We will disclose User information to law enforcement agencies, public authorities or other organizations if legally required.

HOW LONG WE RETAIN USER PERSONAL DATA

We will only retain User Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for following which we will securely destroy it or anonymise it in line with our policies. We may retain User Personal Data for a longer period in the event of a complaint or to deal with legal claims. There will also be some Personal Data that we are required to retain for legal reasons.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of User Personal Data, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal, regulatory or other requirements

Users can request to be removed from our files and may request earlier deletion by contacting us in writing at the address below:

Attn: - The Marketing & Communications Department
Expo 2030 Riyadh Company
3137 Financial Boulevard
6568 Al Aqeeq Dist.
13519, Riyadh
Kingdom of Saudi Arabia

WHERE WE STORE USER PERSONAL DATA

User Personal Data will not be transferred to, stored, made available or processed by ERC outside the Kingdom of Saudi Arabia other than in compliance with the PDPL.

ERC ensures that the requirements under the implementing regulations issued under the PDPL are complied with.

USER RIGHTS

Under the PDPL, Users have rights regarding their Personal Data, including the right to:

(a) be informed about the legal basis and the purposes of the collection of their Personal Data;
(b) access their Personal Data, in accordance with the rules and procedures set out in the PDPL;
(c) obtain in a readable and clear format copies of their Personal Data, in accordance with the rules and procedures set out in the PDPL;
(d) request correction, completion or updating of their Personal Data; and
(e) request the deletion or destruction of their Personal Data (when it is no longer needed or necessary in relation to the purposes for which it was collected or processed, unless we have another legal basis to retain such Personal Data).

To assert any of the above listed rights to User Personal Data or to withdraw consent given to process User Personal Data please contact ERC in writing at the address provided below:

Attn: - The Marketing & Communications Department
Expo 2030 Riyadh Company
3137 Financial Boulevard
6568 Al Aqeeq Dist.
13519, Riyadh
Kingdom of Saudi Arabia
Email: [email protected]

Users may also have the right to lodge a complaint with the data protection authority in the Kingdom of Saudi Arabia, being:

Saudi Data and Artificial Intelligence Authority
Tel. 800122111
Email: [email protected]

OTHER WEBSITES

We may use or provide links on the Website to other websites or social media sites such as Facebook, LinkedIn, and X (previously Twitter), that are not owned or controlled by us. This Privacy Policy does not apply to those sites. If a User chooses to use these websites or their services, the User should review their privacy policies for more information on how they deal with User Personal Data.

Social media platforms also allow Users to indicate their preferences to them about how they share User Personal Data, or the advertising Users receive on their platforms. Please contact the social media platforms for more information.

WEBSITE-ONLY PRIVACY POLICY

This Privacy Policy applies only to our activities available through this Website and its sub-domains and does not apply to any information collected offline or through any other channels.

Website - Privacy Policy