1.1 Introduction
The Shared Services Program was established pursuant to Cabinet Resolution No. (276) dated 1444/4/14H, and is affiliated with H.E. the Minister of Finance. It provides high-quality shared services through the efforts of a professional and experienced team focused on delivering its tasks with a methodology that satisfies beneficiary entities. Committed to protecting user data and information, the program maintains the confidentiality and privacy of such data and uses it to achieve the desired level of service delivery in compliance with the applicable terms and conditions in the Kingdom of Saudi Arabia. The use of the Shared Services Program's website constitutes the user's agreement to the program's privacy policy.
This policy aims to:
- Ensure the protection of users' personal data.
- Define the legal basis for data collection and processing.
- Promote transparency regarding data collection and processing methods.
- Provide means for users to exercise their rights related to their personal data.
1.2 Scope of Work
This policy applies to all personal data collected and processed by the Shared Services Program, including:
- User data provided through interaction with the external portal.
- Any data collected automatically during use of the external portal, such as Cookies and IP addresses.
- This policy applies to all users who interact with the external portal.
1.3 Consent to the Safe Use Policy and Privacy Notice
The Shared Services Program ("the Program") is committed to the privacy and confidentiality of the personal data of users of the Program's website ("the Website"), placing it at the top of its priorities in accordance with the provisions of the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its implementing regulations.
The Program does not collect your personal data except with your knowledge and choice to provide such data to the Program. By visiting the website, you agree to the terms of the Safe Use Policy and Privacy Notice.
When you visit the website, the Program collects various types of personal data. The Shared Services Program uses the data collected during your visit or use of the website for research, studies, publishing reports, dashboards, and similar purposes. The Program is committed to not disclosing or sharing any personal data that could identify you, except in compliance with relevant laws and regulations.
1.4 Key Definitions and Terms
| Term |
Description
|
| The Program
|
Shared Services Program
|
| Data Management Office
|
Data Management Office at the Shared Services Program
|
| The Policy
|
Privacy Policy
|
| Legal Basis
|
The legal basis upon which the Program relies in its activities that require the collection and processing of personal data.
|
| Data
|
A set of facts in their raw or unstructured form such as numbers, letters, static images, videos, audio recordings, or emojis.
|
| Personal Data
|
Any statement — regardless of its source or form — that could lead to the specific identification of an individual, or make them identifiable directly or indirectly when combined with other data. This includes, but is not limited to, name, personal identification numbers, addresses, contact numbers, bank account numbers, credit cards, and static or moving images of the user, as well as any other data of a personal nature.
|
| Data Subject
|
The individual to whom the personal data relates.
|
| Data Processing
|
Any operation performed on data by any means, whether manual or automated, including: collection, recording, storage, indexing, organization, formatting, retention, modification, updating, merging, retrieval, use, disclosure, transfer, publishing, data sharing or interconnection, blocking, erasure, and destruction.
|
| Personal Data Protection Officer
|
The employee responsible for following up on policies, plans, and activities related to personal data protection to ensure the Program handles personal data in accordance with controls and specifications, and ensures the highest levels of protection for personal data within its sources and storage locations through the application of relevant policies and procedures.
|
2.1 Personal Data to be Collected
We collect and process the following personal data:
| Type of Personal Data
|
Details "Examples only"
|
| Account Data
|
Name / Education data / Previous experience / CV.
|
| Contact Data
|
Phone number / Email / National address.
|
| Data collected as part of our customer transactions
|
Comments and suggestions, email transactions.
|
| Data related to your devices
|
Upon visiting the Program's website, the Program's server records the user's IP address, the date and time of the visit, the URL of any website from which you were referred to the site, as well as device type, operating system, browser, and internet connection information.
Most websites, upon being visited, place a small file on the visitor's device hard drive (browser), called "Cookies." Cookies are text files that contain information enabling the website that deposited them to retrieve them when needed during the user's subsequent visits. This stored information includes:
- Remembering username and password if available on the site
- Saving page settings if available on the site
- Saving colors selected by the user if available on the site
- Browsing patterns, interactions with the site, and preferences
|
2.2 Methods of Collecting Personal Data and the Purpose of Collection
Personal data is collected mandatorily and directly through what you provide to us. We also obtain some personal data indirectly through cookies collected when visiting the website. This is to provide the best level of service. The Program collects and uses personal data for several purposes in accordance with relevant laws and regulations, including:
- Resolving and handling inquiries and complaints
- Improving user experience through communication channels
- Data analysis, quality assurance, and verification of submitted data
2.3 Use of Personal Data
Personal data is used for the purpose of developing and improving the beneficiary experience and ensuring the continued delivery of services at the required quality in accordance with the Personal Data Protection Law.
2.4 Legal Basis for Collecting and Processing Personal Data
Personal data is collected and processed based on the consent of the data subject, who may withdraw consent at any time without affecting processing operations carried out based on other legal bases. To do so, you can contact the Data Management Office at the Shared Services Program via email ssp.dmo@ssp.gov.sa
2.5 Potential Consequences and Risks of Not Completing Personal Data Collection
Failure to complete personal data collection may result in several negative consequences, including:
- Difficulty improving services and user experience
- Impact on your ability to benefit from our services
2.6 Storage of Personal Data
Your personal data is stored through secure solutions on servers within the Program's premises or with authorized cloud computing service providers within the Kingdom, protected by the best technologies in compliance with the policies and controls of the National Cybersecurity Authority and international standards to prevent unauthorized access and mitigate cyber risks. Data will be destroyed within three years from the date of storage in a manner that prevents viewing or recovery, in accordance with the Program's policies.
2.7 Sharing and Disclosure of Personal Data
Your personal information will only be available to our employees who need to access it, and will not be available to the public without your consent. Additionally, none of this information will be exchanged or traded with any third party without your prior consent.
The Program also has the right to share information and personal data provided by you or collected about you in the following cases:
- If the Program is required to disclose or share your personal information to comply with any legal obligation, enforce the Program's terms of use, protect the Program's rights, properties, safety, and personnel, or others
- Your personal information may be shared or disclosed for research purposes with a processing entity. However, the Program will only share your personal data for this purpose in compliance with applicable laws and regulations, limited to the information necessary to achieve the stated purposes at the time of collection. The Program carefully selects entities committed to applicable laws and regulations in the Kingdom and continuously verifies this
- Information and personal data may be shared or disclosed in response to subpoenas, court orders, or any other legal proceeding, or to investigate, prevent, or take action regarding illegal practices, suspected fraud, or technical or security issues
- Data may be shared if it has been aggregated from publicly available sources or with the written consent of the data subject in accordance with applicable provisions, or in cases of extreme necessity for public interest or the data subject's interest, or if all personal data that could identify the data subject has been removed
2.8 Protection of Personal Data
The Program takes appropriate and suitable measures and precautions to maintain personal data securely, protecting it from loss, unauthorized access, misuse, modification, or unauthorized disclosure. This includes, but is not limited to:
- Stringent measures and precautions for information and technology security to prevent fraud and unauthorized access to our systems.
- Regular and periodic updating of protection measures and controls in accordance with the best standards.
- Training and qualifying employees to respect the confidentiality of personal data.
- Collecting the minimum amount of personal data necessary to serve its purpose.
- Applying a high level of data protection in accordance with the requirements of the National Cybersecurity Authority, including data encryption and protection from leakage, loss, misuse, or any unauthorized access or modification.
2.9 Rights of the Data Subject
- Right to Know: You have the right to know how we collect your personal data, the legal basis for collection, how it is processed, stored, and destroyed, and to whom it will be disclosed. You can view all details through the privacy policy or by contacting us at the Program's Data Management Office email ssp.dmo@ssp.gov.sa
- Right to Access Your Personal Data: You have the right to request to view your personal data by contacting us at ssp.dmo@ssp.gov.sa
- Right to Obtain Your Personal Data: You have the right to request your personal data available with the Program in a readable and clear format whenever technically possible, by contacting us at ssp.dmo@ssp.gov.sa
- Right to Correct Your Personal Data: You have the right to request correction of your personal data that you believe is inaccurate, incorrect, or incomplete, by contacting us at ssp.dmo@ssp.gov.sa. The review and update will be completed within 10 business days, and you will be notified via email.
- Right to Destroy Your Personal Data: You have the right to request the destruction of your personal data under certain circumstances, including but not limited to: the purpose of data collection has ended, unless there is a legal provision specifying a retention period or contractual requirements. Contact us at ssp.dmo@ssp.gov.sa
- Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time, unless there are legal bases requiring otherwise. Contact us at ssp.dmo@ssp.gov.sa
- Right to Restrict Processing: The data subject has the right to request the restriction or suspension of processing of their personal data temporarily in specific cases, such as objecting to the accuracy of the data or objecting to the processing. Contact us at ssp.dmo@ssp.gov.sa
- Right to Data Transfer: The data subject has the right to obtain a copy of their personal data in a readable and secure format or transfer it to another entity they specify, whenever technically possible. Contact us at ssp.dmo@ssp.gov.sa
- Right to File a Complaint arising from the application of the provisions of the Law. Contact us at ssp.dmo@ssp.gov.sa
- Right to Claim Compensation for material and moral damages if harmed as a result of any violation stipulated in the Personal Data Protection Law and its implementing regulations. Contact us at ssp.dmo@ssp.gov.sa
Except as required by law, you will not be required to pay any fees for exercising these rights. If a request is submitted to exercise any of these rights, you will receive a response within 5 business days from the date of receiving the complete request.
2.10 Exercising Data Subject Rights
The data subject has the right to request access / correction / destruction of their data by contacting us at the Program's Data Management Office email ssp.dmo@ssp.gov.sa
2.11 Personal Data Protection Officer
Name: Data Management Office at the Shared Services Program
Email: ssp.dmo@ssp.gov.sa
2.12 External Links
The Shared Services Program's website may contain links to other websites. The Program is not responsible for the content of those websites. The risks of browsing those websites through any link available on the site are the user's responsibility. You can review the privacy policies and content of those websites accessed through any link.
Kingdom of Saudi Arabia
Riyadh
Website (sdaia.gov.sa)
National Data Governance Platform (dgp.sdaia.gov.sa)
2.13 Complaints and Inquiries
In accordance with the Law and without prejudice to the Program's regulations and bylaws, we welcome all requests, inquiries, questions, and complaints regarding the privacy policy or the handling of personal data by contacting the Data Management Office at the Shared Services Program via email ssp.dmo@ssp.gov.sa
If the issue is not resolved or a response is not received within 14 business days, you may file a complaint with the competent authority, the "Saudi Data and Artificial Intelligence Authority."
Address of the Saudi Data and Artificial Intelligence Authority:
2.14 Privacy Policy Updates
- Last update to the privacy policy: July 15, 2025
- The Program's website administration reserves the right to add or change any provisions of the privacy policy. The website administration will notify the data subject of any changes, and reserves the right to terminate the data subject's account if they do not accept any change to the privacy policy, without prejudice to relevant laws and regulations.
- Arabic is the official language for the application of terms and conditions. In case of any dispute in interpreting any text in another language, the Arabic text shall prevail.
2.15 Termination of Use
The Program may, at its absolute discretion, terminate, restrict, or suspend the user's right to access and use the website without notice and for any reason, including violation of the terms and conditions of use or any other conduct that we deem, at our sole discretion, to be unlawful or harmful to others. Upon termination, you will not be authorized to access this website.
2.16 Relevant Laws and Policies
The Program has issued this privacy policy in compliance with the Personal Data Protection Law and its implementing regulations, the policies and controls issued by the National Data Management Office, and other relevant laws applicable in the Kingdom of Saudi Arabia.
For more information about the related policies and laws referenced in this policy, you can visit one of the following links:
Personal Data Protection Law : Link
Implementing Regulations of the Personal Data Protection Law : Link
Policies issued by the National Data Management Office : Link
Controls issued by the National Data Management Office : Link
Controls issued by the National Cybersecurity Authority : Link
|
3.0 Program Website Administration
|
- Supervising entity name: Shared Services Program
