Privacy Policy

1. Introduction

The Economic Cities and Special Zones Authority ("ECZA" or the "Authority") respects the privacy of users of its website and digital services and is committed to protecting personal data in accordance with applicable laws and regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations.

This policy explains how personal data may be collected, used and protected when you use ECZA's website, platforms and digital services.

2. Data Controller

Unless otherwise stated for a particular service, the Economic Cities and Special Zones Authority is the controller of personal data processed through its website and digital services.

For personal data protection enquiries:

Email: DMO@ecza.gov.sa

3. Personal Data We May Collect

Depending on how you interact with ECZA and its digital services, the data processed may include:

• Name and identification information.
• Contact details, including telephone number and email address.
• Information relating to applications or services requested.
• Business or investment-related information where relevant to a service.
• Documents and information submitted through forms or electronic services.
• Internet Protocol (IP) address.
• Device, browser and operating system information.
• Date and time of access.
• Pages and services accessed.
• Cookies and similar technical information.
• Other information necessary to provide a service or perform ECZA's regulatory functions.

ECZA seeks to collect only personal data that is necessary for specific and legitimate purposes or to comply with applicable legal requirements.

4. Purposes of Processing

Personal data may be processed to:

• Provide electronic services and process applications.
• Verify users' identities where necessary.
• Communicate with beneficiaries and respond to enquiries.
• Carry out ECZA's statutory and regulatory functions.
• Improve the website, digital services and user experience.
• Analyze website performance and usage.
• Protect ECZA's systems and information from cybersecurity threats.
• Meet legal and regulatory requirements.
• Exchange necessary information with government authorities or service providers where permitted by applicable law.

5. Legal Basis

Personal data is processed on the legal bases provided under the Personal Data Protection Law and other applicable regulations, which may include:

• Consent where consent is required.
• Providing a service or fulfilling an obligation requested by the data subject.
• Compliance with a legal obligation.
• Performing a task in the public interest or exercising ECZA's official authority.
• Any other legal basis permitted under applicable law.

6. Sharing Personal Data

Personal data is shared only where necessary and for legitimate purposes. Recipients may include:

• Relevant government and regulatory authorities.
• Technology and service providers acting on behalf of ECZA.
• Authorities with which information must be shared pursuant to applicable laws or official orders.
• Other parties where there is a lawful basis or the data subject's consent, as applicable.

Appropriate measures are applied to protect personal data when it is shared.

7. International Transfers

Where personal data needs to be transferred outside the Kingdom of Saudi Arabia, such transfers are carried out in accordance with the Personal Data Protection Law and applicable regulations governing personal data transfers outside the Kingdom.

8. Data Security

ECZA applies appropriate organizational and technical measures to protect personal data against unauthorized access, use, alteration, disclosure, loss or destruction.

9. Data Retention

Personal data is retained for as long as necessary to fulfil the purpose for which it was collected and in accordance with applicable legal and regulatory requirements and ECZA's approved retention requirements.

When there is no longer a legal or operational need to retain personal data, it is handled or securely destroyed in accordance with applicable requirements.

10. Your Rights

Subject to applicable law, data subjects may have rights including:

• The right to be informed about the collection and processing of their personal data.
• The right to access their personal data.
• The right to request a copy of their personal data.
• The right to request correction of inaccurate or incomplete information.
• The right to request destruction of personal data where permitted by law.
• The right to withdraw consent where processing is based on consent.
• Any other rights provided under applicable law.

Requests relating to these rights may be submitted through ECZA's designated data protection channels.

11. Third-Party Websites

The website may contain links to websites or platforms operated by third parties. ECZA's Privacy Policy does not apply to such external websites. Users should review the privacy policy of each third party before providing personal data.

12. Policy Updates

This policy may be updated to reflect changes in ECZA's services, processing activities or applicable legal and regulatory requirements.

Updated versions will be published on the website together with the date of the latest update.

Last updated: September 2026