barq

Privacy Policy

1. Application and purpose

1.1 This Privacy Policy (the “Privacy Policy”) constitutes an integral part of your Agreement (as applicable) with Barraq Finance Company, a closed joint stock company established under the laws of the Kingdom of Saudi Arabia and registered in the Commercial Register in the city of Riyadh under No. 1010810920 and unified ID No. 7029786717 having its place of business and main office at 2163 AlUrubah Rd, Northern Maathar District 7795, Riyadh 12334, Kingdom of Saudi Arabia (referred to in this Privacy Policy as “barq”, “we”, “us” and “our”). It applies to you whether you are using or accessing barq’s electronic wallet services as a consumer or a merchant, as well as the authorised person to access and/or manage the merchant’s wallet account and related services, in respect of the barq electronic payments platform and the extended services as described further at: www.barq.com. Accordingly, this Privacy Policy applies to you and us whether you are setting-up, accessing, operating or using a barq Wallet Account via the App (pursuant to the barq Consumer Terms and Conditions) or an Account via the Merchant Portal and any ancillary Merchant-specific app (pursuant to the barq Merchant Terms and Conditions), as may be applicable (the “Platform”). Terms used in this Privacy Policy have the same meaning ascribed to them in your corresponding Agreement unless the context requires otherwise.

1.2 We take your privacy seriously and want you to be reinsured whenever you use or access the Platform. We process your personal data (“Personal Data”) in accordance with the Saudi Arabia Cabinet Decision No. 98/1443 on the Approval of the Personal Data Protection Law and Royal Decree No. M/148 of 05/09/1444H and the respective implementing regulations, as amended from time to time (together referred to as the “PDPL”) and the Law of Payments and Payment Services, promulgated by Saudi Arabian Royal Decree No. M26/1443 dated 22/3/1443H and its implementing regulations, as may be amended from time to time (the “PSP Regulations”, and jointly with the PDPL and the Banking Law shall be referred to as the “Applicable Laws”).

2. What Personal Data we collect and for what purposes

2.1 As an individual user of the App, we collect the following types of Personal Data about you:

a. Personal Data provided by you to us, including full name, mobile number, national ID, residency cards, passport number, national address, current location and date of birth for the purposes of downloading the App, creating an account on the App and using the services offered via the App;

b. Personal Data provided by you to us, including salary, employment sector,
Fund receipt, Fund expenditure patterns, fingerprints and face ID for the purposes of creating an account on the App, conducting AML/KYC activities and using the services offered via the App and to respond and cooperate with any competent enforcement authority in respect of national security, laws and judgements (including but not limited through Tanfeeth);

c. Personal Data provided by you to us or by the Saudi Credit Bureau (SIMAH) to us, as may be required by the relevant regulators, namely, SAMA, in respect of offering you any service or product including but not limited to credit card details, details of financial products or debts, credit score and performance data for the purposes of evaluating your credits profiles, conducting risk assessments, and assist with determining issuing amounts for debts any other product or liability;

d. Personal Data provided by you to us when you use the App, including information relating to the transactions you carry out, details of any bank accounts you transact to and from the App, fingerprints and face ID and IP address localisation data for the purposes of enabling browsing the App; using the services offered via the App and purchasing goods or services available on the App;

e. Personal Data provided by you to us, including full name, e-mail address, mobile number and account name on the App for the purposes of sending advertising material and carrying out promotional activities, marketing and/or direct sales of barq's products and/or services; and

f. Personal Data provided by or verified through Government-approved service providers to us, including but not limited to National Information center, THIQAH Businesses Services Company, and ELM Co. which may include your full name, biometrics, mobile number, date of birth, national ID number, passport number, address, records, personal assets, bank and credit card numbers for the purposes of KYC/AML/CTF, customer segmentation or such other classifications and categorisations, customer onboarding, account opening and offering of certain services or products.

2.2 As a Merchant or authorised person (as may be applicable) setting up, accessing or using an Account pursuant to the Merchant Terms and Conditions and any related extensions, we collect the following types of Personal Data about you:

a. Personal Data provided by you to us, including details of your commercial registration and unified ID, registration number with the General Organisation of Social Insurance (GOSI) or such other required reference should you opt for payroll services (as may be available), tax registration number, full name of authorised representative, proof of authority, mobile number, national ID, residency cards, passport number, national address, current location, fingerprints, face ID and other officially registered biometrics and date of birth for the purposes of setting up and accessing the Account and using the Wallet Services, including but not limited to, for accessing the Merchant Portal and downloading and using any computer or mobile apps specific to a Merchant and for conducting AML/KYC requirements and to respond and cooperate with any competent enforcement authority in respect of national security, laws and judgements (including but not limited through Tanfeeth);

b. Personal Data provided by you to us concerning the name of your employees, their salaries, positions, mobile numbers, national IDs, passport numbers and bank accounts’ details (for the purpose of using payroll services) and such Personal Data concerning your customers and suppliers, including their mobile numbers, bank account details and nature of business and the description and amounts of your corresponding transactions with them as may be required for using the Digital Disbursement and Collection Services;

c. Personal Data provided by you to us or by the Saudi Credit Bureau (SIMAH) to us, as may be required by the relevant regulators, namely, SAMA, in respect of offering you any service or product including but not limited to credit card details, details of financial products or debts, credit score and performance data for the purposes of evaluating your credit profile, conducting risk assessments, and assist with determining issuing amounts for debts any other product or liability;

d. Personal Data provided by you to us when you use the Merchant Portal, including information relating to the transactions you carry out, details of any bank accounts you transact to and from the Account and IP address localisation data for the purposes of offering any specific Wallet Services such as but not limited to availing any promotions that involve coupons, codes or geofencing and offering of your products and/or services via the Marketplace;

e. Personal Data provided by you to us, including full name, e-mail address, mobile number of the Merchant and the Merchant’s personnel (as may be requested pursuant to the Wallet Services that you may avail) for the purposes of sending advertising material and carrying out promotional activities, marketing and/or direct sales of barq's products and/or services within the boundaries and guidelines set pursuant to the Applicable Laws; and

f. Personal Data provided by or verified through Government-approved service providers to us, including but not limited to National Information Center, THIQAH Businesses Services Company, and ELM Co. which may include your full name, biometrics, mobile number, date of birth, national ID number, passport number, commercial registration details, unified ID, proof of authority to represent the Merchant, address, records, personal assets, bank and credit card numbers for the purposes of KYC/AML/CTF, customer segmentation or such other classifications and categorisations, customer onboarding, account opening and offering of certain services or products.

2.3 You agree and undertake pursuant to your Agreement with us to provide us only with Personal Data that are accurate, complete, up-to-date, and relevant for the purpose for which they are collected. We will take reasonable steps to ensure that your Personal Data are accurate, complete, up-to-date and relevant for the purpose for which they are collected but we will not be responsible for any inaccuracy, incompleteness, outdate or irrelevance of the Personal Data including whether the foregoing is a consequence of your error or omission, unless such inaccuracy or incompleteness is a result of our own error or omission.

3. Legal basis for the processing of Personal Data

3.1 The legal basis for the processing described under:

a. Paragraphs 2.1.a and 2.2.a above, is the performance of the Agreement; and

b. Paragraphs 2.1.a to 2.1.d and paragraphs 2.2.a to 2.2.d above, is your explicit consent for the purposes mentioned in each of the corresponding paragraph.

4. Mandatory and optional provision of Personal Data

4.1 Your provision of Personal Data that we request from you under section 1 above is mandatory to enable barq to provide its Wallet Services to you. Therefore, failure to provide such Personal Data for the purposes referred to in section 1 will make it impossible for us to provide you the relevant services or may impact the quality and accuracy of the service for which we may refrain from carrying out a request or instruction or offering such service.

4.2 The provision of Personal Data under sections 2.1.f and 2.2.f relies on government-approved resources and thus your limited involvement in providing such Personal Information. However, the verification of Personal Data that you provide to us pursuant the aforementioned sections, relies on the accuracy and completeness of the Personal Data that you provide to us pursuant to section 1 above. If such verification could not be ascertained, we may not be able to give you access to the Wallet Account, Account or certain services, as may be applicable.

5. How we collect and process your Personal Data

5.1 We collect and process Personal Data only when you specifically give it to us by registering on and/or using the Platform or by the third parties mentioned in section 1 above.

5.2 The Personal Data you provide will be processed in compliance with the Applicable Laws and, in any case, in such a way as to guarantee the security and confidentiality of the same, to prevent unauthorised disclosure or use, alteration or destruction. The Personal Data will be processed on paper and/or via telematic means, also with the help of electronic and information means. We will process your Personal Data in our own technological infrastructure and/or using the technological infrastructure of third-party suppliers appointed as data processors. We process Personal Data for the purposes set out in section 1 above.

5.3 If you are a Merchant, it is your obligation to obtain the consent of your personnel, customers, contracts and suppliers to provide us with their corresponding Personal Data as may be required for the relevant Wallet Services, pursuant to the Applicable Laws and any other laws, regulations and policies that may apply.

5.4 You may request a list of the names of the persons to whom your Personal Data is or may be disclosed by writing to the address indicated in section 12 below. Within barq's organisation, your Personal Data may be processed by the persons in charge of the departments responsible for carrying out individual processing activities.

6. Protecting your Personal Data

6.1 The transmission of information via the Internet is not completely secure. We will do our best to protect your Personal Data while it is in our possession. However,

6.2 We recognise industry standards and employ security safeguards to protect personally identifiable information from unauthorised access and misuse. All information you provide to us is stored on secure servers. Any payment transactions will be protected and safeguarded by encryption.

7. Sharing your Personal Data with third parties and cross-border transfers

7.1 We may share Personal Data with third party providers so they can provide you with certain services through the Platform. We will require these third-party providers to take steps to ensure that your Personal Data is kept secure and used in accordance with this Privacy Policy. However, we shall not be liable for any unauthorised use of your Personal Data by a third-party provider.

7.2 The Personal Data may be communicated, exclusively for the purposes indicated in this Privacy Policy, to the categories of subjects listed below:

a. persons, companies, associations or professional firms that provide services and activities of assistance and consultancy to barq, with particular but not exclusive reference to accounting, administrative, legal, tax and financial matters;

b. companies that provide, on behalf of barq, certain services related to the Platform and to the management and execution of purchase orders through the Platform, with particular but not exclusive reference to the analysis of Personal Data, the management of payment services, the management, shipment and delivery of products purchased on the Platform, marketing activities, the management of services provided through the Platform and their customisation in your favour;

c. in the event of a sale, merger, liquidation, receivership or transfer of assets of barq or one of our affiliated companies, to the prospective buyer of the business and their professional advisers;

d. companies belonging to the same corporate group as barq, with particular but not exclusive reference to activities of Personal Data analysis in aggregate and anonymised form, identity management of user profiles on the Platform, profiling and profiled marketing in relation to users who have given their consent to these activities;

e. subjects to whom the right to access the Personal Data is required by law, secondary legislation, a court order or by a regulatory authority of competent jurisdiction or if we believe that such disclosure is necessary, to protect, defend or enforce our rights. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction; and

f. third party companies and clients with whom barq collaborates as a business partner (e.g. for the promotion of goods and services) including those third parties assisting us in supplying our services to you or perform certain functions on our behalf, including IT support services or professional services.

7.3 The Personal Data may be communicated, exclusively for the purposes indicated in this Privacy Policy, to the categories of recipients listed above and having their registered offices in the Kingdom of Saudi Arabia and acting, as the case may be, as data processors on behalf of barq or as separate data controllers, in this case providing you, under his/her own responsibility, with appropriate information.

7.4 For the purposes of providing you with our payment services, the Personal Data may also be communicated, exclusively for the purposes indicated in this Privacy Policy, to the categories of recipients listed above and having their registered offices in countries outside the Kingdom of Saudi Arabia (in this case in compliance with the provisions of the Applicable Laws regarding data transfers and acting as data processors on behalf of barq or as autonomous data controllers).

7.5 We may display to other concerned parties (namely, individual recipients, billers and merchants) with whom you transact your full name and any of your information to ensure that the beneficiary or recipient clearly recognizes and identifies the origin of the relevant transaction.

7.6 Your Personal Data will be stored on the servers available to barq or to the persons in charge of holding barq’s data located in Kingdom of Saudi Arabia. Should it become necessary for technical and/or operational reasons to use subjects located outside the Kingdom of Saudi Arabia, or should it become necessary to transfer some of the collected Personal Data to technical systems and services managed in the cloud and located outside the Kingdom of Saudi Arabia, the processing will be regulated in compliance with the provisions of the Applicable Laws regarding data transfers.

7.7 This Privacy Policy only applies to Personal Data collected on the Platform. Although the Platform may provide links to websites of third parties, such as banks, this Privacy Policy does not apply to any other application or website that you connect to from the Platform. We are not responsible for the content or practices of applications and websites operated by third parties that are linked to or from the Platform and you should refer to the relevant privacy policies issued by such third parties.

8. Handling of personal data relating to Wallet Accounts of users whose eligibility is subject to any interruption

8.1 If you were eligible to use the Wallet Services and such eligibility is interrupted pursuant to applicable laws and regulations in the Kingdom of Saudi Arabia (e.g. due to issues or concerns relating to capacity), we will share your Personal Data pursuant to the Applicable Laws and the instructions of a competent court for the protection of your interests. In such circumstances, if a legal guardian is appointed in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia, we will provide your guardian with access to your transactional data as may be required to supervise your use of the Wallet Services.

8.2 If you are at any time appointed legal guardian of another user of the Wallet Services whose eligibility has been interrupted pursuant to the applicable laws and regulations in the Kingdom of Saudi Arabia to supervise the Wallet Account of that user, we will disclose to you the user’s personal data provided that you:

a. have a valid and current Wallet Account; and

b. confirm that you will exercise the user’s rights stipulated in the Privacy Policy and the Applicable Laws on its behalf; and

c. confirm that you will act in the user’s best interests while maintaining confidentiality of its personal data.

9. Data retention period and data deletion

9.1 The Personal Data collected for the processing purpose indicated in section 1 above shall be retained for the time necessary for the pursuit of such purposes and thereafter, and in any case at least ten (10) years from the achievement of the respective purposes as required by the Applicable Laws, except in case of extraordinary necessity of barq to keep the Personal Data further in order to defend its rights, also in relation to disputes existing at the time of the request or upon indication of public authorities or as otherwise permitted by the Applicable Laws.

9.2 The Personal Data collected for the processing purpose indicated in paragraphs 2.1.e and 2.2.e above shall be retained until the withdrawal of the relevant consent or until you expressly request the deletion of such Personal Data, and in any case at least Ten (10) years from the last purchase made, except in case of extraordinary necessity of barq to keep the Personal Data further in order to defend its rights, also in relation to disputes existing at the time of the request or upon indication of public authorities or as otherwise permitted by the Applicable Laws.

10. Methods of Deletion

10.1 Without prejudice to our rights in section 8 and in the Applicable Laws, we will achieve the deletion of your Personal Data, as and if applicable, by means of erasure from our systems and archives.

10.2 As an alternative to the methods of deletion above, barq may anonymize your Personal Data and retain the output of such anonymization.

11. Changes to this Privacy Policy

11.1 Any changes we may make to this Privacy Policy in the future will be posted on the Platform and, where appropriate, notified to you. By continuing to use the Platform you will be deemed to accept the changes to this Privacy Policy.

12. Contact

12.1 Your personal data processing controller is barq. You can contact barq at any time by mail or e-mail at info@barq.com. If you have any questions regarding this Privacy Policy, please include it in the email subject to enable our DPO to contact you.

12.2 barq has appointed its own Data Protection Officer (also known as the "DPO"), who may be contacted for matters relating to the processing of your data at privacy@barq.com. By writing to privacy@barq.com you may also exercise the rights indicated under section 13 below.

13. Your rights

13.1 Unless otherwise permitted by the Applicable Laws, we hereby remind you that you have the following rights:

a. to the extent that consent was given for any processing of Personal Data, the right to withdraw your consent at any time by selecting the appropriate option in the Platform or sending an e-mail to our contacts above;

b. the right to obtain information in relation to the purposes and legal bases for which your Personal Data is processed;

c. the right to obtain correction of inaccurate, incomplete and/or outdated Personal Data relating to you;

d. the right to obtain the destruction of the Personal Data concerning you in the following cases:

i. you request us to do so;

ii. the Personal Data is no longer necessary for the purposes for which it was collected;

iii. you have withdrawn your consent to the processing of the Personal Data where it is processed on the basis of your consent; or

iv. the processing of your Personal Data does not comply with the Applicable Laws. However, please note that the retention of Personal Data by barq is lawful if it is necessary to enable you to comply with a legal obligation or to establish, exercise or defend a right in court;

e. the right to obtain that the Personal Data concerning you is only kept without any other use of the Personal Data in the following cases:

i. you contest the accuracy of the Personal Data, for the period necessary to allow us to verify the accuracy of such Personal Data;

ii. the processing is unlawful but you still object to the deletion of the Personal Data by barq;

iii. the Personal Data is necessary for the establishment, exercise or defence of legal claims;

iv. you object to the processing and are awaiting verification as to whether the legitimate grounds of the data controller for processing prevail over those of the data subject;

f. the right to obtain the cessation of processing in cases where your Personal Data is processed for marketing purposes; and

g. the right to receive in a readable and clear format, a copy of the Personal Data provided to barq.

13.2 Should you see that your Personal Data is being processed unlawfully, you may file a complaint with the relevant data protection authority. Please note that in the Kingdom of Saudi Arabia you have the right to turn to the national authorities to assert your rights in relation to the processing of your Personal Data.

13.3 Furthermore, by writing to the email address privacy@barq.com you may exercise the rights set forth under this section.

14. Acknowledgment

FOR INDIVIDUALS / CONSUMERS

You acknowledge that your Personal Data shall be processed for the purposes set forth in paragraphs 2.1.b to 2.1.f of the Privacy Policy https://barq.com/doc/privacy_policy.html and provide consent to:

□ the processing of your Personal Data for the purposes set forth in paragraph 2.1.b of the Privacy Policy, i.e. purposes of creating an account on the App, conducting AML/KYC activities and using the services offered via the App;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.2.c of the Privacy Policy, i.e. purposes of evaluating your credits profiles, conducting risk assessments, assist with determining issuing amounts for debts any other product or liability;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.1.d of the Privacy Policy, i.e. purposes of enabling browsing the App, identifying your location, using the services offered via the App and purchasing goods or services available on the App;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.1.e of the Privacy Policy, i.e. purposes of sending advertising material and carrying out promotional activities, marketing and/or direct sales of our products and/or services; and

□ the processing of his/her Personal Data for the purposes set forth in paragraph 2.1.f of the Privacy Policy, i.e. purposes of KYC/AML/CTF, customer segmentation or such other classifications and categorisations, customer onboarding, account opening and offering of certain services or products.

If you are appointed as the legal guardian of a user in accordance with section 7 of the Privacy Policy, you consent to:  

□ act in the user’s best interests by exercising its rights stipulated in this Privacy Policy and the Applicable Laws, maintain the confidentiality of the user’s personal data, and use it only as required by regulatory or judicial authorities. 

FOR MERCHANTS

You acknowledge that your Personal Data shall be processed for the purposes set forth in paragraphs 2.2.b to 2.2.f of the Privacy Policy https://barq.com/doc/privacy_policy.html and provide consent to:

□ the processing of your Personal Data for the purposes set forth in paragraph 2.2.b of the Privacy Policy, i.e. purposes of creating an account on the Platform, conducting AML/KYC activities and using the services offered via the Platform;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.2.c of the Privacy Policy, i.e. purposes of evaluating your credit profile, conducting risk assessments, assist with determining issuing amounts for debts any other product or liability;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.2.d of the Privacy Policy, i.e. purposes of enabling operating your Wallet Account through the Merchant Portal, identifying your location, using the services offered via the Platform and purchasing goods or services available on the Platform;

□ the processing of your Personal Data for the purposes set forth in paragraph 2.2.e of the Privacy Policy, i.e. purposes of sending advertising material and carrying out promotional activities, marketing and/or direct sales of our products and/or services to you and personnel and such other beneficiaries of marketing programs agreed with you from time to time; and

□ the processing of his/her Personal Data for the purposes set forth in paragraph 2.2.f of the Privacy Policy, i.e. purposes of KYC/AML/CTF, customer segmentation or such other classifications and categorisations, customer onboarding, account opening and offering of certain services or products.