AJRAS PAY PRIVACY POLICY
Effective Date: [To be confirmed] | Last Updated: 12 August 2026
1. Introduction
Ajras Information Technology ("Ajras", "we", "us", or "our") respects the privacy of users of Ajras Pay and is committed to processing personal data lawfully, securely, fairly, and transparently in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations.
This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you use the Ajras Pay website, applications, or services, including when you create an account, register a business, submit a liquidity request, complete identity or business verification, undergo eligibility or risk assessment, make payments or transfers, pay SADAD bills, or use wallet or virtual-account-related services.
By using Ajras Pay or providing information to us, you acknowledge that you have reviewed this Privacy Policy. Where applicable law requires explicit consent for a particular processing activity, we will request that consent separately before carrying out the relevant processing.
2. Who Controls Your Personal Data?
Ajras acts as the Data Controller for personal data collected and processed through Ajras Pay where Ajras determines the purposes and means of processing. We may engage technology and service providers that process personal data on our behalf as Data Processors. Such providers may only process data in accordance with our instructions and the services agreed with us, unless otherwise required by applicable law.
3. Personal Data We May Collect
A. Account and Contact Information
Full name.
Mobile number.
Email address.
Account authentication information.
Customer support requests and communications.
B. Business Information
Legal business name and business type.
Commercial Registration number and VAT information where applicable.
Business department or branch information.
Corporate documents and regulatory information.
Information relating to authorized representatives and account users.
C. Identity and Verification Information
National ID or Iqama number.
Date of birth.
Information about the business owner, representative, or authorized person.
Identity or authentication results from government or approved services such as Nafath or equivalent services.
Commercial Registration and authority-verification information.
Ajras does not ask you to disclose your Nafath password, PIN, or private authentication credentials to Ajras.
D. Liquidity Request and Eligibility Information
Requested amount and selected repayment period.
Business or department associated with the request.
Purpose and details of the request.
Financial obligations or indicators necessary to assess the request where legally permitted.
Verification, eligibility, and risk-assessment results.
Credit data or indicators derived from credit data where necessary and permitted by applicable law.
Where processing credit data requires explicit consent under applicable law, we will obtain separate and clear consent before carrying out such processing.
E. Payment and Transaction Information
Beneficiary information required to execute a transaction.
Bank account, IBAN, or relevant banking identifiers.
Virtual account (vIBAN) information where applicable.
Transaction amount, date, type, and status.
SADAD bill and reference information.
Wallet balances and platform transaction history depending on the service.
Settlement, cancellation, and refund records where applicable.
F. Technical and Usage Information
IP address.
Device, operating-system, and browser information.
Device or session identifiers.
Login dates and times.
Platform usage, activity, security, and authentication logs.
Cookies and similar technologies used through the website.
4. Sources of Personal Data
1. Directly from you or your organization's authorized users.
2. From the organization you represent.
3. From government entities or approved verification sources.
4. From identity and business verification providers.
5. From participating banks, payment providers, and settlement providers.
6. From eligibility or risk-assessment service providers where legally permitted and necessary.
7. From technology partners and Data Processors providing services to Ajras.
8. Automatically through your interaction with our platforms and services.
5. Why We Process Your Personal Data
Create and manage your account and verify identity, business registration, and authorization.
Process liquidity requests and assess eligibility and risks associated with a request.
Execute payments and transfers and operate wallet or virtual-account services where enabled.
Enquire about and process SADAD payments and track transactions and settlements.
Detect and prevent fraud or misuse and protect users, accounts, and the platform.
Comply with applicable anti-money laundering, counter-terrorism financing, and other regulatory requirements where applicable.
Provide customer support, handle complaints, and send service, account, transaction, and request notifications.
Improve platform functionality and user experience and conduct internal analytics, preferably using aggregated or anonymized information where appropriate.
Meet legal, regulatory, and contractual requirements.
Send marketing communications where legally permitted and subject to any applicable consent requirements.
We will not use personal data for a new purpose that is incompatible with the purpose for which it was collected without an appropriate lawful basis and any notice required by applicable law.
6. Legal Bases for Processing
Your consent.
Performance of a contract or steps required to provide a service requested by you.
Compliance with a legal or regulatory obligation.
Ajras's legitimate interests where permitted by applicable law and where those interests do not override the rights and interests of the Data Subject.
Any other lawful basis permitted under the PDPL and applicable regulations.
Where explicit consent is legally required, including certain processing of credit data or certain decisions based solely on automated processing, Ajras will obtain the required consent before conducting such processing.
7. Verification, Eligibility Assessment, and Decision Support
Ajras may use information provided by you or lawfully obtained from verification or data providers to verify identity and business information, validate submitted information, assess request eligibility and risk, prevent fraud, and support decisions relating to requests.
Ajras may use analytical tools, models, or rules to support these assessments. Where a decision is made solely through automated processing and applicable law requires explicit consent or additional information to be provided to the Data Subject, Ajras will comply with those requirements before conducting the processing.
8. Payment Infrastructure Providers and Participating Banks
Ajras relies on payment infrastructure and banking technology providers, together with participating banks and other relevant regulated or licensed entities, to provide certain payment, transfer, settlement, and bill-payment services. Where relevant, Ajras may share the minimum information necessary to execute the transaction, such as payment instruction information, beneficiary details, account or IBAN information where required, transaction amount, SADAD bill or reference information, and payment-status enquiry information.
Depending on the nature of the service and contractual relationship, payment infrastructure and technology providers may process relevant personal data on behalf of Ajras and in accordance with Ajras's instructions. Participating banks and other regulated or licensed entities may also process transaction data as necessary to execute the transaction and meet their own legal or regulatory obligations. Personal data is shared only to the extent necessary to provide the service or where disclosure is otherwise required or permitted by applicable law.
Use of payment infrastructure or banking technology providers does not mean that Ajras automatically obtains a user's complete banking history or access to all of the user's bank accounts. The scope of data processed depends on the specific service activated and the lawful authority and consent applicable to that service.
9. Other Parties We May Share Data With
Identity and business verification providers.
Payment and settlement providers and participating banks.
Eligibility and risk-assessment service providers.
Cloud, infrastructure, cybersecurity, and technology providers.
Email, SMS, and notification providers.
Auditors, advisers, and other professional service providers subject to appropriate confidentiality obligations.
Government, regulatory, law-enforcement, or judicial authorities where disclosure is legally required or ordered by a competent authority.
Ajras does not sell your personal data to third parties.
10. Data Minimization
Ajras seeks to collect and process only the minimum personal data reasonably necessary to achieve the specified processing purpose. Access to personal data within our organization is restricted according to role, actual business need, and appropriate authorization.
11. Information Security
Ajras applies appropriate technical, organizational, and administrative safeguards designed to protect personal data against unauthorized access, unlawful use or disclosure, unauthorized alteration or destruction, loss, leakage, or misuse.
Encryption of communications.
Access, identity, and authentication controls.
Activity logging and monitoring.
API security controls.
Infrastructure and server-security controls.
Secure management of keys, credentials, and backups.
Security incident-response procedures.
No electronic system can guarantee absolute security, and Ajras therefore continually reviews and enhances its safeguards based on risk and technological developments.
12. Data Retention
Ajras retains personal data only for as long as necessary to achieve the purposes for which it was collected or for periods required under applicable legal, regulatory, contractual, financial, or compliance requirements. When personal data is no longer required and there is no legal basis requiring further retention, it will be securely deleted or destroyed, or anonymized so that it can no longer identify the Data Subject.
Certain transaction records may be retained for longer periods where necessary to meet legal, financial, regulatory, fraud-prevention, or dispute-resolution requirements.
13. Transfers Outside Saudi Arabia
Ajras seeks to process and store personal data in accordance with applicable requirements in the Kingdom of Saudi Arabia. Where a service requires personal data to be transferred outside the Kingdom or made accessible to a recipient outside the Kingdom, such transfer will only occur in accordance with the PDPL and applicable safeguards governing transfers of personal data outside the Kingdom.
14. Cookies and Similar Technologies
The Ajras Pay website may use cookies and similar technologies to operate the website and user sessions, protect account security, remember preferences, understand website performance and usage, and improve the user experience. Where consent is legally required for non-essential cookies, Ajras will provide appropriate user controls.
15. Your Personal Data Rights
Be informed about how your personal data is collected and processed.
Access your personal data.
Request a copy of your personal data in a clear and readable format.
Request correction, completion, or updating of inaccurate personal data.
Request destruction of personal data where permitted by law.
Withdraw consent where consent is the legal basis for processing.
Exercise any other rights available under the PDPL and its Implementing Regulations.
Some requests may be restricted where continued processing or retention is required by law or by a legal or regulatory obligation.
16. Withdrawal of Consent
Where a processing activity is based on your consent, you may withdraw that consent using the communication channels provided by Ajras. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Withdrawal may prevent Ajras from providing a particular service where the relevant information is necessary to provide that service and no other lawful basis permits continued processing.
17. Responsibilities of Business Users
Provide accurate and up-to-date information.
Have appropriate authority to represent the organization.
Do not provide another person's personal data without appropriate authority or a lawful basis.
Protect account credentials and prevent unauthorized access.
Inform Ajras if unauthorized account access is suspected.
18. Personal Data Breaches and Security Incidents
If Ajras becomes aware of a security incident or personal data breach, Ajras will take appropriate steps to investigate, contain, mitigate, and remediate the incident and will notify competent authorities and affected Data Subjects where required under applicable law. Ajras also requires relevant processors and service providers to report security incidents that may affect Ajras user data.
19. Changes to This Privacy Policy
Ajras may update this Privacy Policy from time to time to reflect changes to Ajras Pay services, new or modified technical integrations, legal or regulatory developments, or changes to our data-processing practices. The updated version will indicate the latest revision date, and Ajras will provide additional notice where changes are material or where required by applicable law.
20. Contact Us
For questions regarding this Privacy Policy, to submit a privacy request, or to exercise your personal data rights, please contact:
Ajras Information Technology Privacy Email: [email protected] Business/Contact Address: Prince Saud Ibn Abdullah Ibn Jalawi, Al Qirawan, Riyadh 13535, Saudi Arabia