Privacy Policy

Last updated: December 2025

About barq

Company Name and Legal Nature: Barraq Finance Company, a Closed Joint Stock Company

Unified ID Number: 7029786717

National Address: 2163 AlUrubah Rd, Northern Maathar District 7795, Riyadh 12334, Kingdom of Saudi Arabia

Website: www.barq.com

Phone: 8001000077

 

Barq is a digital wallet, financial services, and marketplace platform operated by Barraq Finance Company, through which regulated digital financial services are provided to users, including individuals and entities (as applicable), for purposes including account opening, funds transfers, card issuance, electronic payment solutions, and marketplace-related activities.

 

This Privacy Policy (“Privacy Policy”) constitutes an integral part of your Agreement (as applicable) with Barraq Finance Company (referred to in this Privacy Policy as “barq”, “we”, “us” and “our”). It applies to you whether you are using or accessing Barq’s electronic wallet services as a consumer or a merchant, as well as the authorised person to access and/or manage the merchant’s wallet account and related services, in respect of the barq electronic payments platform.

Accordingly, this Privacy Policy applies to you and us whether you are setting-up, accessing, operating or using a Barq Wallet Account via the App (pursuant to the Barq Consumer Terms and Conditions) or an Account via the Merchant Portal and any ancillary Merchant-specific app (pursuant to the Barq Merchant Terms and Conditions), as may be applicable (“Platform”). Terms used in this Privacy Policy have the same meaning ascribed to them in your corresponding Agreement unless the context requires otherwise.

We take your privacy seriously and want you to feel comfortable whenever you use or access the Platform. We process your personal data (“Personal Data”) in accordance with Royal Decree No. M148 of 5/9/1443H and its respective implementing regulations, as amended from time to time  (“PDPL”), the Saudi Arabian Banking Control Law dated 22/2/1386H as amended from time to time (“Banking Law”) and the Law of Payments and its Services, promulgated by Saudi Arabian Royal Decree No. M26/1443 dated 22/3/1443H and its implementing regulations (“PSP Regulations”, and jointly with the PDPL and the Banking Law shall be referred to as the “Applicable Laws”).

 

 

Table of Content

1.     What Personal Data we collect and for what purposes	7.     Handling of Personal Data relating to Wallet Accounts of users who do not satisfy the eligibility requirements
2.     Legal basis for the processing of Personal Data	8.     Storing your Personal Data
3.     Mandatory and optional provision of Personal Data	9.     Retaining and destroying your Personal Data
4.     Collecting and processing your Personal Data	10.  Your Rights
5.     Protecting your Personal Data	11.  Updates to this Privacy Policy
6.     Sharing your Personal Data	12.  Contact Us
13.  Acknowledgment and Acceptance

 

 

 

1. What Personal Data we collect and for what purposes
   • Personal Data Collected Directly from You

We collect Personal Data that you intentionally provide to us when downloading the App, creating an account, submitting forms, entering information into fields, uploading documents, or communicating with us. This includes information required for onboarding, AML/KYC/CTF, identity verification, credit and risk assessment, accessing or using our services offered via the App, and for advertising and marketing purposes. Depending on whether you are an individual user or a Merchant (or its authorized representative), the following data may be collected directly from you or from regulated entities acting on your behalf (e.g., SIMAH, NIC, ELM):

 

• Individual Users

We may collect your Personal Data directly from you, which includes but is not limited to:

 

1. Basic identification such as full name, email address, national ID, residency card, passport number, mobile number, national address, date of birth and current location.
2. Employment information such as salary, employment sector, cash receipt, cash expenditure patterns, income and expenditure information, and related documents.
3. Credit and financial information such as credit card details, bank account details, details of financial products or debts, credit score and performance data.
4. Biometric data such as fingerprint and facial recognition for verification and secure access.
5. Transaction and account-related such as in-App account details and information you enter or provide when using the App.
   • Merchants and Authorized Representatives

We may collect the following categories of Personal Data directly when you set up or access a Merchant Portal:

1. Identification and regulatory data such as commercial registration, unified ID, GOSI registration (when applicable), tax numbers, and basic identification details of the Merchant’s authorized representative.
2. Employee information needed for payroll services such as names, salaries, positions, mobile numbers, national IDs, passport numbers and account details.
3. Credit and financial information such as credit card details, bank account details, details of financial products or debts, credit score and performance data.
4. Biometric data such as fingerprint and facial recognition for verification and secure access.
5. Transaction and account-related data such as in-App account details and information you enter or provide when using the Merchant Portal.
6. Customer and supplier information relevant to your business transactions as may be required for using the Digital Disbursement and Collection Services.
   • Personal Data Collected Automatically (Indirect Collection)

Certain Personal Data are collected indirectly when you interact with the App, Merchant Portal, Website or our digital channels. Such data may be collected through technical, operational, regulatory, or third-party sources to enable the provision of the Services and Wallet Services, ensure security, and comply with applicable laws and regulatory requirements. Such indirectly collected Personal Data may include:

1. Device and technical information such as IP addresses, device type, operating system, and localization data used for fraud prevention, session management and service functionality.
2. Usage and behavioral information generated through analytics tools to enhance customer experience.
3. Cookies and similar technologies that help recognize your device and remember preferences.
4. System-generated logs that record actions within the App for security, monitoring and troubleshooting.
5. Data received through secure integrations with approved government platforms (e.g., NIC, ELM) to verify identity and maintain accurate records.
6. Data received from Saudi Credit Bureau (SIMAH) as required by competent regulators (including SAMA).
   • Accuracy of Personal Data

You agree and undertake pursuant to your Agreement with us to provide us only with Personal Data that are accurate, complete, up-to-date, and relevant for the purpose for which they are collected. We will take reasonable steps to ensure that your Personal Data are accurate, complete, up-to-date and relevant for the purpose for which they are collected but we will not be responsible for any inaccuracy, incompleteness, outdate or irrelevance of the Personal Data including whether the foregoing is a consequence of your error or omission, unless such inaccuracy or incompleteness is a result of our own error or omission.

2. Legal basis for the processing of Personal Data

In accordance with the Applicable Laws, the legal basis on which we rely in processing your Personal Data is as follows:

1. Legal Obligation: Personal Data may be processed where processing is required to comply with a legal obligation imposed by applicable laws or regulations.
2. Public / Security Interest: Personal Data may be processed where such processing is required to achieve public interest or for security purposes, in accordance with applicable laws and competent authority requirements.
3. Contractual Necessity: Personal Data may be processed where such processing is necessary for the performance of a contract to which the Data Subject is a party.
4. Vital Interest: Personal Data may be processed where processing is necessary to protect the life or vital interests of the Data Subject, in situations where obtaining consent is impossible or difficult.
5. Legitimate Interest: Personal Data may be processed where processing is required for the purpose of legitimate interest of Barq, without prejudice to the rights and interests of the Data Subject, and provided that no sensitive data (as defined by Applicable Laws) is to be processed.
6. Consent: Personal Data may be processed based on the consent of the Data Subject, unless processing is permitted under another lawful basis stipulated by the Applicable Laws.
7. Mandatory and optional provision of Personal Data

Your provision of Personal Data that we request from you under section 1 above is mandatory to enable Barq to provide its Wallet Services to you. Therefore, failure to provide such Personal Data for the purposes referred to in section 1 will make it impossible for us to provide you the relevant services or may impact the quality and accuracy of the service for which we may refrain from carrying out a request or instruction or offering such service.

The provision of Personal Data under sections 1.2 (e) and 1.2 (f) relies on government-approved resources and thus your limited involvement in providing such Personal Information. However, the verification of Personal Data that you provide to us pursuant the aforementioned sections, relies on the accuracy and completeness of the Personal Data that you provide to us pursuant to section 1 above. If such verification could not be ascertained, we may not be able to give you access to the Wallet Account, Account or certain services, as may be applicable.

4. Collecting and processing your Personal Data

We collect and process Personal Data only when you specifically give it to us by registering on and/or using the Platform or by the third parties mentioned in section 1 above at the start and throughout the duration of your relationship with us and beyond, strictly in accordance with the Applicable Laws and solely for the purposes set out in section 1 above. Personal Data will be processed on paper and/or via telematic means, also with the help of electronic and information means.

If you are a Merchant, it is your obligation to obtain the consent of your personnel, customers, contracts and suppliers to provide us with their corresponding Personal Data as may be required for the relevant Wallet Services, pursuant to the Applicable Laws and any other laws, regulations and policies that may apply.

 

5. Protecting your Personal Data

The Personal Data you provide will be processed in compliance with the Applicable Laws and, in any case, in such a way as to guarantee the security and confidentiality of the same. We will do our best to protect your Personal Data by implementing strong security controls and industry’s best practices, including but not limited to encryption, regular security assessments, and ongoing employee training. We continuously monitor and update our security measures to reduce risks and prevent any unauthorized access, disclosure, alteration, or loss of information.

 

6. Sharing your Personal Data

Barq may share your Personal Data, as applicable, on a one-time basis or ongoing basis for the purposes specified in this Privacy Policy and to the categories of recipients listed below, while requiring recipients to keep your data secure and use it in line with this Privacy Policy. However, we shall not be liable for any unauthorized use of your Personal Data by any of third-party provider.

 

• With third parties within KSA

We may share Personal Data with third party providers so they can provide you with certain services through the Platform. Personal Data may be shared with recipients located inside the Kingdom of Saudi Arabia, who may act either as data processors on behalf of Barq or as independent data controllers (as defined by Applicable Laws), as applicable, in the following circumstances:

1. Legal and Regulatory disclosures: Personal Data may be disclosed where required to comply with applicable laws, court orders, requests from regulatory or enforcement authorities, or for the purposes of fraud prevention, credit risk management, and regulatory compliance.
2. Professional service providers: Personal Data may be disclosed to entities that provide professional and consultancy services to Barq, including but not limited to accounting, administrative, legal, tax, and financial advisory services.
3. Platform-related service providers: Personal Data may be disclosed to companies that provide services on behalf of Barq in connection with the operation of the App, including but not limited to, data analysis, payment service management, shipment and delivery of purchased products, marketing activities, Platform management, and service customization.
4. Companies within Barq’s corporate group: Personal Data may be disclosed to affiliates companies of Barq, for purposes such as aggregated or anonymized data analysis, identity management, profiling and marketing (subject to consent), or in connection with any actual or potential sale, merger, liquidation, receivership or transfer of assets involving Barq or any of its affiliates.
5. Business partners: Personal Data may be disclosed to hird-party companies collaborating with Barq in the provision of services, including promotional partners, IT support, professional services, and functions performed on Barq’s behalf.

 

• With third parties outside KSA

For the purposes of providing you with our payment services other purposes indicated in the Privacy Policy, Personal Data may be shared with recipients outside the Kingdom of Saudi Arabia, provided (i) such transfers comply with Applicable Laws regarding data transfers, and (ii) recipients act as processors or autonomous controllers. In such cases, we ensure that an adequate level of protection is maintained and that all transfers are conducted lawfully. This includes relying on adequacy decisions issued by the competent authority and implementing standard contractual clauses governing the transfer of Personal Data.

 

7. Handling of personal data relating to Wallet Accounts of users who do not satisfy the legal capacity requirements

 

• If your eligibility to use the Wallet Services is suspended under the applicable laws and regulations in the Kingdom of Saudi Arabia (e.g., due to capacity-related issues), we may share your Personal Data as required by Applicable Laws and competent court instructions to protect your interests. In such cases, if a legal guardian is appointed in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia and the Platform terms and conditions, we will provide your guardian with the necessary transactional data to supervise your use of the Wallet Services.

 

• If you are or you become the legal guardian, in accordance with the Platform terms and conditions and the applicable laws and regulations in the Kingdom of Saudi Arabia, of another Wallet user who lacks eligibility or whose eligibility is suspended, we will disclose that user’s Personal Data to you, provided that (a) you have an active Wallet Account; (b) you confirm at all times that you will exercise the user’s rights under this Privacy Policy and Applicable Laws on their behalf; and (c) you confirm that you will act in their best interests and maintain confidentiality of their Personal Data.

 

8. Storing your Personal Data

 

Your Personal Data is securely stored at our authorized cloud service providers operating in the Kingdom of Saudi Arabia within a controlled environment that applies to strict technical and organizational safeguards, including, but not limited to, encryption and access management. In certain cases, data may also be stored outside the Kingdom of Saudi Arabia, in which case the processing and storing will be regulated in compliance with the Applicable Laws.

 

Barq will store your Personal Data only for as long as necessary to fulfil the purposes for which it was collected or processed, and as required under applicable laws, regulations, and supervisory instructions. These purposes may include legal obligations, recordkeeping for analysis or audit, responding to inquiries or complaints, monitoring fraud and money-laundering activities, taking legal actions, and responding to regulatory requests.

 

9. Retaining and destroying your Personal Data

Personal Data collected for the processing purposes indicated in this Privacy Policy shall be retained for the time necessary for the pursuit of such purposes, or until your consent is withdrawn (where applicable), except in case of extraordinary necessity of Barq to keep the Personal Data further in order to defend its rights, or upon indication of public authorities or as otherwise permitted by the Applicable Laws. However, in certain circumstances, Barq may be unable to comply with a request for deletion of Personal Data where such deletion would conflict with legal or regulatory obligations to which Barq is subject, ensuring always that the necessary records can be produced as evidence if needed. However, once your Personal Data is no longer required to be retained, Barq will securely delete and destroy such data using appropriate measures to prevent any unauthorized access or recovery, or alternatively, it will be anonymized to ensure irreversible de-identification.

10. Your Rights

Barq is committed to upholding your rights as outlined below in accordance with the Applicable Laws and will take the appropriate action within a period not exceeding 30 days from the date of receiving your request. Where the nature or complexity of your request requires additional time, we will notify you promptly with the reasons for the delay, and may extend the response period by no more than an additional 30 days.

You may exercise your rights below through the App or by contacting us at Privacy@Barq.com.

Rights	Description
Right to Access	You have the right to access the Personal Data Barq holds about you, such as your account details, identity information, and transaction history. When you submit an access request through the App, we will provide you with the Personal Data we process about you. Access may be limited in certain cases to protect security, prevent fraud, or comply with applicable laws and regulatory restrictions.
Right to Obtain a Copy	You have the right to request a soft copy of the Personal Data you have previously provided to us in a structured, commonly used, and clear and readable format.
Right to Request Correction, Completion, or Updating	You have the right to request the correction of inaccurate data or the updating/completion of incomplete or outdated Personal Data. We will take reasonable steps to verify the accuracy of the information before making any changes to ensure the data we process remains accurate and up to date.
Right to Deletion or Destruction	You may request deletion of your Personal Data. However, we may retain data where required for legal, regulatory, judicial, or statutory purposes, where technical limitations temporarily prevent deletion, or as stated in this Privacy Policy.
Right to Withdraw Consent	You have the right to withdraw your consent at any time by selecting the appropriate option in the Platform or sending an e-mail to our contacts as set out in this Privacy Policy.
Right to Lodge Complaints	If you wish to raise a complaint regarding how we handle your Personal Data, you may contact Barq at any time by phone 8001000077 or at CSS@Barq.com or you can contact the Data Protection Office at Privacy@Barq.com. You can always contact SAMA Care at 8001256666 or through SAMA website: www.sama.gov.sa for lodging complaints.
Right to claim compensation for material or moral damage	You have the right to file a claim with the competent court to seek compensation for material or moral damage resulting from any violation of the PDPL.
Right to be informed about the lawful basis/purpose for collection of personal data	You have the right to obtain information in relation to the purposes and legal basis for which your Personal Data is processed.

 

11. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. Any changes to this Privacy Policy will be published on the Platform with the updated date to ensure that the Data Subject is informed. By continuing to use the Platform, you will be deemed to accept the changes to this Privacy Policy.

 

12. Contact Us

Your Personal Data processing controller is Barq. You may contact Barq at any time by phone at 8001000077 or at CSS@Barq.com or you can contact our Data Protection Office at Privacy@Barq.com.

 

13. Acknowledgment and Acceptance

By reading this Privacy Policy, you acknowledge and agree to the collection and processing of your Personal Data in accordance with the terms set out herein and the Applicable Laws.