سياسة الخصوصية

1. About the Authority

The King Abdulaziz Royal Reserve Development Authority was established pursuant to Council of Ministers Resolution No. 437, dated 01/07/1441 AH (corresponding to 24/02/2020 AD). The Authority is tasked with developing the King Abdulaziz Royal Reserve, preserving its natural resources, and holding legislative and regulatory authority over the Reserve. It implements development strategies in collaboration with various local and global entities operating across the environmental ecosystem to safeguard the Reserve's environment and ensure its sustainability for current and future generations. In line with the Authority’s dedication to protecting user data and information, this Privacy Policy has been formulated to detail how personal data provided by users while utilizing the Authority’s website is collected, used, stored, destroyed, and protected. Using the Authority’s website constitutes implicit acceptance of this Privacy Policy.

2. Data to be Collected and the Purpose of Collection

Personal Data You Disclose to Us: We collect personal data that you voluntarily provide when registering for our services, expressing interest in obtaining information about the Authority or its products and services, participating in activities related to the services, or when you contact us through other means.

Personal Data You Provide: The personal data collected depends on your interactions with us and the services, the choices you make, and the products or features you utilize. All personal data provided to us must be accurate, complete, and true. You remain free to notify us of any changes to such data.

Automatically Collected Data: Certain data—such as your Internet Protocol (IP) address and/or browser and device characteristics—is collected automatically when utilizing our services and is not used for any other purposes.

3. Purpose of Collection

Personal data is collected to deliver requested government services, enhance service quality, and improve beneficiary experience.

4. Data Collection Methods

1. Data provided directly by the personal data owner during website registration is collected; no personal data is collected from external parties.
2. Personal data is collected indirectly through cookies gathered upon visiting the website.

5. Storage and Destruction of Personal Data

Personal data is stored on servers protected by advanced technical standards. The Authority takes all necessary measures to protect personal data in compliance with National Cybersecurity Authority (NCA) policies and controls, ensuring prevention of unauthorized access and mitigating cyber risks. Data is subsequently destroyed securely, preventing any unauthorized viewing or recovery.

6. Legal Basis for Collecting and Processing Personal Data

Personal data is collected and processed in accordance with relevant Saudi laws under the Personal Data Protection Law based on the consent of the data owner. The data owner may withdraw consent for data collection and processing at any time unless another legal basis exists. To do so, the Data Management Office at the Authority may be contacted via email: dmo@karnr.gov.sa.

7. Rights of the Personal Data Owner

• Right to Knowledge: The data owner has the right to know our collection methods, legal basis for collection and processing, handling, retention, destruction procedures, and parties with whom data will be shared. Complete details can be reviewed via this Privacy Policy or by contacting us through the "Contact Us" forms.
• Right to Rectification: The data owner has the right to request correction of personal data deemed inaccurate, incorrect, or incomplete via the email specified in Clause 6 within 7 business days from the request date.
• Right to Destruction: The data owner has the right to request the destruction of personal data under certain circumstances, unless statutory requirements or contractual obligations dictate specific retention periods.
• Right to Withdraw Consent: The personal data owner may withdraw consent to the processing of personal data at any time, unless legitimate interests require otherwise.
• Right of Access: The data owner has the right to access personal data available with the Authority, including reviewing it upon request, or via automated tools provided by the controller enabling direct access without requiring a formal request.

8. Personal Data Sharing / Exchange

Personal data collected through the Authority's website is neither shared nor exchanged with third parties.

9. Exercising Data Owner Rights

The personal data owner has the right to request access, rectification, or destruction of personal data by contacting:

• Data Management Office at the Authority
• Email: Dmo@karnr.gov.sa

10. Personal Data Protection

• Data encryption in transit using Secure Hypertext Transfer Protocol (HTTPS).
• Continuous monitoring of systems to detect and prevent cyber threats.
• Implementation of appropriate technical controls to prevent unauthorized access.