Introduction
The National Center for Government Resource Systems (the “Center”) is a government entity established pursuant to the regulation issued by Council of Ministers Resolution No. (412), dated 14/5/1445 AH. The Center is responsible for providing various solutions through unified and integrated systems aimed at enhancing the quality of electronic services in government financial transactions, promoting innovation and the use of modern technologies, supporting small and medium-sized enterprises and local content, increasing competitiveness and providing opportunities, improving beneficiary experience and measuring performance indicators, as well as standardizing procedures and fostering integration among beneficiaries.
In recognition of the importance of protecting the personal data and privacy of users of the Center’s website (the “Website”), and in compliance with the Personal Data Protection Law, its Implementing Regulations, and other relevant laws and regulations in the Kingdom of Saudi Arabia, this Privacy Policy has been prepared to enable Data Subjects to understand the nature and content of the personal data processed by the Center through the Website, the purposes for which such data is collected, the methods of collection, how it is stored, processed, and destroyed, as well as the rights of Data Subjects and how they may exercise those rights.
This Policy applies to all users and visitors of the Center’s Website (hereinafter referred to as the “User” or “Data Subject”). Use of the National Center for Government Resource Systems’ Website constitutes the User’s consent to the collection and processing of their personal data and acceptance of this Privacy Policy. The User is responsible for ensuring the accuracy and correctness of the data they provide on the Website.
Personal Data Collected
The Center ensures that the personal data collected and processed is limited to the minimum amount of personal data necessary to enable it to perform its duties and provide the required services.
The Center ensures that the collection and processing of personal data is limited to the minimum necessary and relevant to the purpose for which it is collected and to the provision of services through the Website.
The Center collects the following personal data through its Website:
• Personal identification data: Name, document type, document number, and nationality.
• Contact information: Mobile number, telephone number, and email address.
• Applicant information: Sector type (government, business, or individuals), and information relating to the request submitted through the Website, such as the subject and details of the request.
• Technical data: Data collected through cookies or similar technologies, including the Internet Protocol (IP) address, where applicable.
Methods of Collecting Personal Data and Purposes of Collection
1. Direct Collection of Personal Data
The Center collects personal data that you provide directly through the electronic forms available on the Website or when communicating with the Center through the available communication channels. Such channels indicate whether providing the data is mandatory or optional.
2. Indirect Collection of Personal Data
The Center collects certain personal data indirectly through cookies when the User provides consent to their use.
Purpose of Data Collection
The data is collected for purposes related to providing the Center’s services, receiving and processing requests, inquiries, and complaints, communicating with Website users regarding such matters, and improving electronic services and the user experience.
What Are the Legal Bases for Collecting and Processing Personal Data, and What Is the Purpose of Collection?
The Center relies, in collecting and processing personal data, on the provisions of the Personal Data Protection Law, the regulation governing the National Center for Government Resource Systems, and the regulations issued to govern the collection and processing of data.
Personal data is processed for the purposes set out in this Policy, including verifying Users’ identities and contact information, enabling the Center to perform the duties and responsibilities assigned to it and provide its services in accordance with the relevant laws and regulations, receiving and processing requests, inquiries, and complaints and communicating with Website users regarding such matters, as well as developing electronic services, improving the user experience, and enhancing the quality of services provided.
Processing of Personal Data
Personal data will only be processed by authorized personnel in accordance with their respective responsibilities and authorities and in accordance with the policies approved for this purpose.
Failure to provide your personal data may affect your ability to benefit from the services provided by the Center.
External Links
The Center’s Website may contain links to external websites. The Center is not responsible for the privacy practices followed by such websites.
Sharing of Personal Data
Personal data collected through the Center’s Website is not shared or exchanged with other entities, except in cases permitted under the Personal Data Protection Law and its Implementing Regulations.
Storage, Retention, and Destruction of Personal Data
Personal data is securely stored and retained at the premises of the National Center for Government Resource Systems or on its approved servers within the Kingdom of Saudi Arabia to ensure the preservation of national sovereignty.
Relevant security standards and practices are implemented to ensure the security and protection of data, including access rights management, data classification and encryption, and regular security assessment procedures.
Personal data is retained for the period necessary to fulfill the purpose for which it is processed, in accordance with the retention periods approved by the Center and the applicable legal requirements.
Once the purpose for retaining the data has been fulfilled, the data is securely destroyed in a manner that prevents unauthorized access to or recovery of the data, in accordance with the policies and procedures approved by the Center.
Rights of Data Subjects
Pursuant to the Personal Data Protection Law and its Implementing Regulations, Data Subjects have the following rights:
• Right to Be Informed: This includes being informed of the methods used to collect your personal data, the legal basis for its collection, the purpose of its collection, how it is processed, and all other details relating to the processing of your personal data as set out in this Policy.
• Right to Access and Obtain Your Personal Data: You have the right to request access to your personal data and obtain a copy thereof in a clear and readable format, in accordance with the applicable laws and regulations and subject to the limitations and exceptions stipulated therein.
• Right to Request Correction of Your Personal Data: You have the right to request the correction, completion, or updating of your personal data if it is inaccurate, incorrect, or incomplete.
• Right to Request Destruction of Your Personal Data: You have the right to request the destruction of your personal data when it is no longer necessary, unless there is a legal basis requiring its retention.
• Right to Withdraw Consent to the Processing of Your Personal Data: You have the right to withdraw your consent to the processing of your personal data where consent constitutes the legal basis for processing, unless there is a legal basis requiring the processing to continue.
To exercise the rights referred to above, you may contact the entity responsible for personal data protection at the Center through the communication channels specified in this Policy. Your request will be handled in accordance with the applicable statutory timelines and procedures.
Personal Data Protection Officer
Name: Data Office at the National Center for Government Resource Systems
Email: DMO@ncgr.gov.sa
Complaints and Objections Mechanism
If you have any complaint or objection concerning the processing of personal data or the exercise of related rights, the Data Subject may contact the entity responsible for personal data protection at the Center through the following contact details:
Email: DMO@ncgr.gov.sa
Complaints and objections will be handled and responded to in accordance with the timelines and procedures approved by the Center.
Availability of the Privacy Policy and Ease of Access
The Center ensures that this Privacy Policy is made available through its Website in a clear and easily accessible manner, using clear language that enables Users to review and understand how their personal data is collected and processed and the rights associated with such data.
The Center reviews and updates this Privacy Policy periodically or as necessary to ensure compliance with applicable laws, regulations, and legislation. The date of the latest update to the Policy will be clearly indicated.
Users will not be required to receive separate notification of such updates, as amendments to this Policy shall become effective upon their publication and availability on the Website.
Relevant Laws and Regulations
For more information about the laws, regulations, and policies referred to in this Policy, please refer to the following:
• Personal Data Protection Law:
• Implementing Regulations of the Personal Data Protection Law:
• Data Sharing Policy:
• Essential Cybersecurity Controls:
Last Modified Date:
At
Saudi Arabia Time