PRIVACY POLICY

Hayy Jameel Privacy Policy
1. Introduction

Hayy Jameel is committed to respecting your privacy and protecting your personal data.

• We will be transparent about the information we are collecting about you and what we will do with it.

• We will use your personal data for the purposes described below. Your personal data will not be processed in a manner inconsistent with the purpose of its collection or in cases other than those stipulated by applicable privacy laws.

• We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to process your personal data.

• We have measures to protect your personal data and keep it secure.

• We will respect your data protection rights and aim to give you control over your own personal data.

You can access our full Privacy Policy below to help you to understand how we use your personal data. In it, we explain the types of personal data we collect, how we collect and process it, what we may process it for and who we may share it with.

2. Full privacy policy

2-1 Controller Of Personal data

Any personal data processed in connection with this Privacy Policy is controlled by Art Jameel for Arts Co. Ltd. (“we” “our” “us”) having CR number 4030356421 with its registered office at Roof floor, Hayy Jameel Jeddah, Saudi Arabia which is considered the “data controller” of your personal data under the Personal Data Protection Law and its Implementing Regulations. To contact our Data Protection Officer, please send a request using the contact details specified at the end of this Privacy Policy.

2-2 What Do We Do? 

We are a multidisciplinary arts and cultural hub in Saudi Arabia, bringing together exhibitions, education, cinema, community programmes and creative enterprises to support and connect diverse creative practices in one destination.

2-3    What Do We Mean By Personal Data? 

Personal data means any data, regardless of its source or form, that may lead to identifying you specifically, or that may directly or indirectly make it possible to identify you, including your name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of you, and any other data of a personal nature.

2-4   What Do We Mean By Sensitive Personal Data? 

Sensitive Personal Data means personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown.

2-5   When Does This Policy Apply? 

This Privacy Policy applies to personal data we collect, use, or otherwise process when you use the Hayy Jameel website and online services, subscribe to our newsletter, contact us, submit enquiries, register for events, book tours, request approvals, apply for internships or job opportunities, or communicate with us about our programmes, services, exhibitions, events, facilities, and recruitment opportunities.

 2-6   How We Collect and What Types of Personal Data Do We Collect About You? 

 2-6.1       Direct Collection :

We collect and process personal data that you provide directly when interacting with Hayy Jameel through our website, email, or phone.

Through the Website and Mobile Application: When you engage with us via the website or application , including when making enquiries or accessing information about our programmes, events, or services.

Through Direct Communications: When you communicate with us by email or phone in relation to enquiries, registrations, or other interactions.

Through Social Media and digital Forms: When you submit lead or enquiry forms via social media platforms or digital forms where interested individuals provide personal data in connection with events, programmes, or offerings promoted by Hayy Jameel.

We will inform you at the time of collection of your personal data whenever the provision of such personal data to us is mandatory in order to allow us to achieve the purposes described below. Otherwise the provision of the personal data is optional.  If you do not provide the personal data we require this may affect our ability to provide services to you.

2-6.2       Indirect Collection

We may also collect and process personal data about you indirectly when you use our services, our website.

In that respect, we collect the following types of personal data:

2-7   What Do We Use Your Personal Data For and Our Legal Basis? 

We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to use your data, as described below:

2-7.1       Performance Of A Contract With You

Where applicable, we may process your personal data where it is necessary in connection with an existing contractual relationship with you, or to take steps at your request before entering into a contract.

This may include processing your personal data to:

• Provide you with information, services, or materials that you request through the Hayy Jameel Website;
• Respond to enquiries or requests submitted by you through the our Website;
• Provide information and updates about Hayy Jameel where these are connected to a service or request made by you; and
• Manage our relationship with you where a contractual relationship exists.
• Facilitate and manage online transactions, including the sale and fulfilment of tickets, programmes, merchandise, or other offerings made available through the Hayy Jameel website

2-7.2       Legitimate Interest

We may process your personal data where it is necessary for our legitimate interests, provided that your interests, rights, and freedoms do not override those interests.

We may rely on legitimate interests to:

• Review, develop, and improve our services;
• Keep internal records and carry out administration;
• Identify you when you contact us;
• Share relevant information within our businesses where necessary for internal administration or service delivery;
• Perform and analyse the results of customer surveys and feedback about Hayy Jameel, where this does not require consent;
• Notify you about changes to our Website’s services;
• Address and resolve enquiries raised through the our Website;
• Administer our Website and carry out internal operations, including troubleshooting, data analysis, testing, research, statistical, and survey purposes;
• Keep the Hayy Jameel Website safe and secure;
• Operate CCTV surveillance within Hayy Jameel premises for the purposes of ensuring security, preventing and detecting crime, and safeguarding individuals and property and;

• Receive and review CVs and other documents you submit via the Job Openings page.

2-7.3       Compliance with legal obligations

We may process or disclose your personal data where this is necessary to comply with a legal obligation to which Hayy Jameel is subject.

This may include processing or disclosing your personal data:

• Where we have a legal duty to disclose or share your personal data;
• To comply with applicable laws, regulations, court orders, regulatory requests, or lawful government requirements;
• To maintain records required by law; and
• To cooperate with competent authorities where legally required.

2-7.4        Vital Interest

We may process your personal data where it is necessary to protect your vital interests or the vital interests of another person.

This basis would only be relied upon in limited circumstances, such as where processing is necessary to protect life, health, or physical safety.

2-7.5       Consent

We rely on your consent where you have freely given a clear indication that you agree to the processing of your personal data for a specific purpose.

We may rely on your consent:

• Where you opt in to receive information regarding Hayy Jameel, its businesses, and activities;
• Where your personal data is intended to be used for marketing purposes;
• Where your personal data is intended to be disclosed to any third party for marketing purposes;
• To allow you to be contacted by third parties who carry out customer surveys and feedback about Hayy Jameel;
• To provide you with promotional or marketing communications where consent is required by applicable law; and
• Where explicit consent is required for a proposed data transfer after you have been informed of any potential risks.
• Place any non-essential cookies or similar technologies on your device to enhance site functionality or analytics as explained in our cookie policy

• In case we use your data for any automated decision-making, we will obtain your consent.
• To capture and use photographs and video recordings featuring you in connection with Hayy Jameel’s events, activities, and promotional materials, If you do not wish to be photographed or filmed, please inform us in advance or speak to a member of staff on the day of the event, and we will take reasonable steps to minimise your inclusion where possible.

You have the right to withdraw your consent at any time for Art Jameel to process your personal information.  You can exercise this right by contacting Hayy Jameel DPO ([email protected])

2-8 How Long Do We Keep Personal Data?

We will retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Your information will be retained for a period of 10 years to ensure effective support, operational continuity, and compliance across all business functions. This period also enables us to handle or respond to any complaints, queries, or concerns relating to your account or application, including meeting any applicable statutory requirements.

If you stop interacting with us we will remove or anonymize your information after the passing of the statutory requirements.  On the expiry of the applicable data retention periods, we will delete it securely, or in some cases anonymize it.

If you wish to know more about our retention policy and retention periods that apply to your personal data, please send a request using the contact details specified at the end of this Privacy Policy.

2-9 Who Do We Share Your Personal Data With?

Database support partner– Personal data is disclosed regularly to ensure secure storage, maintenance, and performance of our data systems

We also share your personal data with any Affiliate companies, for purposes including but not limited to facilitating business operations services and marketing (where you have provided your consent to do so).

(Note: Affiliate refers to any individual, corporation, partnership, limited liability company, or other legal entity that directly or indirectly controls, is controlled by, or is under common control with a party to an agreement. For the purposes of this definition, “control” means the ownership of at least fifty percent (50%) of the voting equity, membership, or other ownership interests of such entity, or the ability to otherwise direct its management and policies, whether through ownership, contract, or other means. This also includes any other entity that falls under shared ownership, shares any partial management, or has the same ultimate ownership as a party to the agreement between entities.)

We do not share your personal data with any external entities for purposes referred to under this Privacy Policy.

We do not sell personal data to third parties, and we only allow our third parties, sister and affiliate companies to send you marketing information where we have your consent to do so.

2-10         Do we Transfer Your Personal Data Outside KSA?

When we share your personal data with the entities mentioned above, it may imply transfers of your personal data outside KSA, namely to Europe for database support services

We seek to ensure such transfers satisfy the conditions set out under the applicable privacy laws. We have in particular limited the transfer to the minimum personal data needed and implemented sufficient guarantees for preserving the confidentiality of the personal data transferred so that the standards of the protection of your personal data are not less than the standards set forth in the applicable privacy laws.

2-11         What Are Your Legal Rights In Relation To The Personal Data We Hold About You?

Under the applicable privacy laws, you have certain rights in relation to your personal data . Responses to exercise your rights will be provided within 30 days (or such other period under applicable law). You can exercise your rights by contacting via email at ([email protected] ). If your request is particularly complicated we may extend the deadline for responding by a further 30 days (or such other period permitted under applicable law), but we will let you know if this is the case. We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. Further explanation of those rights and the exceptions to them are set out below.

Details of how to exercise your rights are set out in the section below “How can you exercise your legal rights and change how we use your data”.

Your rights include the following:

• Right of access to your personal data
• Right to request access
• Right to be informed about our processing of your data
• Right to obtain personal data in a readable and clear format
• Right to request correction, completing or updating of personal data
• Right to request the destruction/erasure of personal data
• Right to withdraw Consent

In any case, you also have the right to lodge a complaint with the competent data protection authority in accordance with applicable law if you consider that the processing of your personal data carried out by us infringes the applicable privacy laws.

2-12         How Can You Exercise Your Legal Rights And Change How We Use Your Data?

In order to exercise any of your rights mentioned above, or if you have any questions or complaints about our use of your personal data, please send a request using the contact details specified at the end of this Privacy Policy. We may ask for some additional information to confirm your identity, which will only be used to process your request.

In your request, please try to make clear which right(s) you would like to enforce and provide any details which may help us answer to your request.   Where you fully or partially lack legal capacity (for example you are a child under 18) your legal guardian may be required by applicable law to exercise your rights on your behalf.

2-13         Security of Your Personal Data

To protect against the loss, misuse and alteration of the information under our control, we have in place appropriate physical, electronic and managerial procedures. For example, our servers are accessible only by authorized personnel and your information is shared with respective personnel on need to know basis to complete the transaction and to provide the services requested by you.  We also employ data encryption, anonymization, and coding methods to ensure that your personal data remains secure during storage and transmission. The level of security measures applied is adjusted based on the sensitivity and volume of the personal data we collect. Although we will endeavor to safeguard the confidentiality of your personal data , transmissions made by means of the Internet cannot be made absolutely secure.

To make sure your access to our services is secure, you should not share your log in details with anyone else. When you finish using our services, you should log out if others may be able to access your computer or device. This is especially important if you are using a publicly accessible computer.  Be aware that there is an Internet fraud practice known as ‘phishing’ which is the illegal gathering of personal data by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a cloned or illegal copy website.

3. How will we inform you of changes to this privacy policy?

If we change this Privacy Policy, we will let you know about the changes by publishing the updated version on our website. If such change to the Privacy Policy requires your consent, you will have a choice to consent as to whether or not we may use your personal data in this different manner.

We are committed to protecting and respecting your privacy and will continue to do so in any future changes we make to this  Privacy Policy

The Privacy Policy was last updated on –  28^th MAY 2026.

4. How to get in touch with us and your right to complain to our supervisory authority?

4-1 How to get in touch with Hayy Jameel?

If you want to exercise any of your rights, or if you have any questions about this policy or our use of your personal data, please contact the Data Protection Officer.

The Data Protection Officer for Hayy Jameel can be contacted via email at ([email protected])

4-2 How to get in touch with SDAIA?

If you are not satisfied with how we handle your complaint, or if we fail to respond within 30 days, you have the right to file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).

Email – [email protected].