Privacy Policy

Last updated on 01 February 2026

Personal Data Privacy Notice

Saudi Finance Company (SFC) is a Saudi closed joint-stock company and a pioneer in providing Sharia-compliant financing solutions to individuals and small-to-medium enterprises (SMEs) including but not limited to consumer financing, credit facilities, and related financial solutions in Saudi Arabia. The company is headquartered in Riyadh and is regulated and supervised by the Saudi Central Bank (SAMA).

SFC places great importance on the privacy and protection of personal data and is committed to processing personal data in a lawful, fair, and transparent manner. This Privacy Notice explains how SFC collects, uses, discloses, stores, and protects personal data of individuals who interact with the company.

This Privacy Notice applies to individuals whose personal data is processed by SFC, including customers, prospective customers, website visitors, applicants, guarantors, authorized representatives, vendors, and other individuals who interact with SFC through its digital platforms, branches, customer service channels, or business relationships.

When Do SFC Collect Your Personal Data?

The Saudi Finance Company begins collecting data when you use contact channels (such as contacting customer service, visiting the website, or company branches). Data collection starts through the information you provide or via your direct authorization (when you are asked to provide data). This may include your identity and contact information through form completion or communication via phone, email, or other means. This includes sharing personal data for the following purposes:

• Customer service channels (phone, email, website, or branches).
• Forms and applications, you complete.
• Social media interactions (Facebook, Instagram, LinkedIn, X, Google, TikTok, etc.).
• Feedback and surveys, you provide.
• Authorized representatives or agents acting on your behalf.

Use of Cookies

• Log Files: Log file information includes data about your use of the service, such as IP address, browser type, referral/exit pages, operating system, date/time stamps, and related data, which is stored in log files.
• Cookies: To enhance the customer experience, the Saudi Finance Company websites use a standard technology called “cookies” to gather information about how the company’s websites are used, which may include your data. Cookies are essential for the operation of the Saudi Finance Company websites. They can be used for various purposes, including enabling service features, remembering your preferences and equipment, understanding your interactions with the service better, providing advertisements within and outside the service, and monitoring visitor usage and directing online traffic. You may be able to adjust your browser settings to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. However, if you do not accept cookies, you may not be able to use all parts of the Saudi Finance Company’s service or all of its features.

Third Parties or Public Sources

The Saudi Finance Company collects personal data from trusted third parties as mentioned below:

• Analytics providers such as Google and Facebook.
• Social media platforms like Facebook, X, Instagram, LinkedIn.
• Service providers like Elm, SIMAH, Nafath, SAMA, etc.

What Personal Data Does SFC Collect?

This includes all data required to conclude and execute contracts, such as full name, ID number or residence number, place of residence, place of work, financial and credit data. When using the Saudi Finance Company website, creating an account, applying for products, or contacting us, we may collect a range of data and information, including:

• Account Information: Email address, account status, age.
• Device Information: Data that identifies your device, such as serial number or device data.
• Contact Information: Data such as name, email address, physical address, phone number, or other contact information.
• Payment Information: Data related to billing address and payment method.
• Fraud Prevention Information: Data used to help detect and prevent fraud.
• Location Information: Your current location only.
• Financial Information: Details including salary information, income.
• Government ID Data: Legally required collection of your national identity information.
• Other Information Provided to Us: Interactions with customer support and contacts through social media.
• Product and Transaction Data: Account activity and product usage.

How and Why Does SFC Use Your Personal Data?

We collect your data through various touchpoints. Some examples include:

• Service Initiation and Use: When you use the Saudi Finance Company services, you become a customer and benefit from our products.
• Information Sharing: When you complete and upload a form to the Saudi Finance Company website, email, or social media posts, or contact our customer center or participate in promotional campaigns.
• Interaction (Social Media): Any posts, messages, or interactions directly with our social media channels.
• Browsing Patterns: Data about how you browse the Saudi Finance Company website, the timing of your visits, the types of internet browsers you use, and how you were referred to the Saudi Finance Company website.
• Surveys: Online surveys that allow us to collect your opinions on topics such as what you like or dislike about the design of the Saudi Finance Company website. Your valuable feedback helps us improve the quality of the experience we offer.
• Directly or through Your Authorized Agent or Legal Representative.
• In Legally Acceptable Cases from Third Parties and Public Sources: This includes government agencies and credit information companies. The Saudi Finance Company may also use your personal data in the following, potentially rare, cases:

  o   To protect your interests (or the interests of someone else).

  o   When necessary for the public interest or for official and legal purposes.

  
  

  Legal Basis and Purposes for Collecting and Using Your Personal Data

  The purpose of collecting data is to conclude and execute contracts authorized by the Saudi Central Bank. The purposes include evaluating your request or following your instructions or otherwise as stated in these terms or as notified in another agreement or notice (whether written, verbal, or electronic), such as:

• Compliance: To meet any legal and regulatory obligations in Saudi Arabia.
• Providing Products or Services: To provide and manage products or services.
• Fraud Protection: To protect you from fraud through identity and credit verification and conflict checks.
• Improving Services: To improve the Saudi Finance Company products and services and your experience through our channels.
• Understanding Customer Needs: To understand your needs as a customer and your eligibility for products and services. The Saudi Finance Company may use your personal data to promote new investments and financial products and services that may interest you. However, the Saudi Finance Company will seek your explicit consent before such promotional offers. Personal data may also be used for other purposes that do not conflict with the purposes disclosed (such as archiving for public interest, scientific or historical research, or statistical purposes) where permitted by applicable laws.
• For marketing communications and promotional offers where you have explicitly opted in.
• Protection of vital interests of the data subject
• Legitimate interests of Saudi Finance Company, provided such interests do not prejudice the rights of the data subject

   

  Automated Decision Making and Profiling

  Where personal data is processed using automated decision-making methods, Saudi Finance Company ensures that such processing does not result in decisions that produce legal or significant effects on the data subject without appropriate safeguards, including the right to request human review where applicable.

   

  Purpose Change

  The Saudi Finance Company will only use your personal data for the purposes it was collected for, unless we reasonably believe that it is needed for another purpose, and that purpose is compatible with the original purpose.

   

  Disclosure of Your Personal Data

• If the data subject has consented to the disclosure in accordance with the system’s provisions.
• If the personal data was collected from a public source.
• If the requesting party is a public entity, for security purposes or to comply with other regulations or judicial requirements as specified by regulations.
• If disclosure is necessary to protect public health or safety or to protect the life or health of individuals, with regulations detailing the relevant controls and procedures.
• If the disclosure will be limited to processing in a manner that does not enable identifying the data subject or any other individual specifically, with regulations outlining the relevant controls and procedures.

   

  How Does SFC Protect Your Personal Data?

  The Saudi Finance Company ensures that your data is adequately protected using required physical, technical, administrative, and procedural security measures to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal of your data.

  The Saudi Finance Company protects your data in accordance with applicable data protection laws and regulations in Saudi Arabia. However, please be aware that the internet is not completely secure.

   

  Data Storage

  All data is stored in a digital database using security procedures and policies on our secure servers behind firewalls, in line with regulatory instructions.

   

  Data Processing

  Data is processed according to available processing methods to achieve the purpose for which it was collected. For example, decisions may be fully automated based on the processing of personal data.

   

  Children’s / Minors’ Personal Data

  Saudi Finance Company does not knowingly collect personal data from individuals under the age specified by applicable laws without the consent of a parent or legal guardian.

   

  Retention of Personal Data

  Your personal data will be retained:

• For as long as necessary: To achieve the purpose for which it was collected.
• To meet legal and regulatory requirements: As required by law.

   

  Data Destruction

  Data will be destroyed in accordance with applicable regulations.

   

  Data Subject Rights and How to Exercise Them

  Data subject rights are governed by applicable regulations and include the right to modify data, file complaints, and request data destruction, as outlined in the regulations.

   

  What Are Your Data Protection Rights?

• Duty to Inform Us of Changes: It is important that the personal data the Saudi Finance Company holds about you is accurate and up-to-date. Please inform us of any changes to your personal data and share updated data with the Data Protection Officer (DPO) at Data.Privacy@sihksa.com.sa or by calling the customer service hotline 8001240220.
• Your Rights Under the Personal Data Protection Law (PDPL): The Personal Data Protection Law (“PDPL”) provides certain rights related to your personal data:
• Since Saudi Finance Company may use automated credit scoring systems to evaluate product eligibility, you have the right to object to decisions based solely on automated processing that produce legal or similarly significant effects. You may request a manual review of such decisions by a human employee.

   

  Complaints and Objections

  Data subjects have the right to submit complaints or objections regarding the processing of their personal data, including cases where they believe their rights have not been exercised within the legally prescribed timeframe or where they object to the processing of their personal data.

  Complaints and objections may be submitted through the following channels:

• Email: Data.Privacy@sihksa.com.sa
• Customer Service Hotline: 8001240220
• Any Saudi Finance Company branch

  Saudi Finance Company shall acknowledge receipt of complaints or objections and shall respond within no more than thirty (30) calendar days from the date of receipt.

  Where additional time is required due to the complexity of the request, the data subject shall be informed of the delay and the reasons thereof in accordance with applicable regulations.

  If a data subject is dissatisfied with the outcome of the complaint or objection handling process conducted by Saudi Finance Company, or if no response is received within the specified timeframe, the data subject has the right to escalate the matter to the competent regulatory authority.

  For matters related to financial services and data protection within the financial sector, the competent authority is Saudi Central Bank (SAMA).

  Data subjects may submit complaints to SAMA through its official channels in accordance with applicable laws and regulations.

   

  Sharing Your Personal Data

  In compliance with the Personal Data Protection Law, Saudi Finance Company may disclose your personal data to third parties in the following cases:

• When we obtain your explicit consent.
• When your personal data is already in the public domain and was collected from a publicly available source.
• When necessary for security purposes, compliance with another law, or to fulfill a judicial or legal order, such as sharing with tax authorities and meeting legal requirements.
• When necessary for public health and safety and to protect an individual’s life/health.
• If the data disclosed is fully anonymized and the identification of the data subject is not possible either directly or indirectly.
• For the legitimate interests of Saudi Finance Company without affecting your rights and interests, provided that the data is not sensitive.

   

  Transfer of Data Outside the Kingdom

  While Saudi Finance Company primarily stores and processes data within the Kingdom of Saudi Arabia, we may utilize third-party service providers (such as analytics or cloud providers) located outside the Kingdom.

  In such cases, we ensure that any transfer of personal data outside the Kingdom complies with the Personal Data Protection Law (PDPL) and its regulations. We ensure an adequate level of protection is available for your data through:

• Transferring data to countries recognized as having an adequate level of protection; or
• Implementing appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the Competent Authority, or Binding Corporate Rules.

   

   

  Data Breach Notification

  In the event of a personal data breach that may affect the rights or interests of data subjects, Saudi Finance Company shall notify the competent authority and affected individuals in accordance with the timelines and requirements set forth under the Personal Data Protection Law and its implementing regulations.

   

  What Might SFC Need from You?

  Saudi Finance Company may need to request specific information from you to help us verify your identity and ensure your right to access the information (or to exercise any other rights). This is a security measure to ensure that personal data is not disclosed to anyone not entitled to receive it.

  Saudi Finance Company may also contact you to request further information regarding your request to expedite our response.

   

  Intellectual Property Rights

  All information on this website is protected by copyright and other intellectual property rights. No images, texts, or other content from this site may be distributed or reproduced without prior written permission from the company.

   

  Changes to Privacy Notice

  Saudi Finance Company reserves the right to amend this privacy notice at any time. The effective date of this privacy notice, as mentioned below, indicates the most recent date on which this privacy notice was reviewed or modified. Checking the date below allows you to see if there have been changes since you last viewed the privacy notice. Therefore, Saudi Finance Company advises you to periodically review this privacy notice to ensure you are aware of the latest version.

   

  Contact Us

  If you have any questions or concerns regarding privacy or data protection, you may reach us through any Saudi Finance Company branch, by email, via our official social media channels, or directly through our website.

• Email: Data.Privacy@sihksa.com.sa
• Hotline: 8001240220
• Headquarters Address: Saudi Finance Company, Al Ma'azar North District, Prince Sultan bin Abdulaziz Road, Riyadh 12312-6769, Kingdom of Saudi Arabia.

   

  Disclaimer

• Right to Information: Data subjects have the right to know the legal basis and purpose of collecting their personal data.
• Right to Access: Data subjects have the right to access personal data held by the Saudi Finance Company.
• Right to Data Portability: Data subjects can request their personal data in a clear and readable format.
• Right to Erasure: Data subjects can request the deletion of their personal data when it is no longer needed.
• Right to Timely Response: The Saudi Finance Company is committed to responding to data subject requests within specified timeframes using specific methods.
• Right to Correction: Data subjects can request correction, completion, or updating of their personal data held by the Saudi Finance Company.
• Right to Withdraw Consent: Data subjects have the right to withdraw their consent to the processing of their personal data at any time, provided this does
• Right to File a Complaint: In the event of any privacy-related incident, data subjects also have the right to file a complaint with the relevant authority within 90 days of the incident, providing the following information:
• Right to Compensation: Without prejudice to any other rights available under applicable laws, data subjects have the right to claim compensation for any material or moral damage suffered as a result of violations of the Personal Data Protection Law or its implementing regulations by Saudi Finance Company. Such claims may be pursued through the appropriate legal and regulatory channels in accordance with the laws and regulations of the Kingdom of Saudi Arabia.
• Place and time of the breach.
• Name, identity, address, and phone number of the complainant.
• Information about the entity being complained about.
• A clear and specific description of the breach.

This privacy notice is not intended to create any contractual rights of any kind or any other legal rights, or to create any obligations on our part to any other party or on behalf of any party. When logging into any third-party website, this privacy notice will no longer apply. Additionally, we are not responsible for the content of third-party sites and do not represent any third party. Therefore, Saudi Finance Company recommends reviewing the privacy and security policy of each link you log into.