Skip to content

Madak App is authorized within the REGA regulatory sandbox · FAL license no. 120034556

List your property العربية Get the app

Legal

Privacy Policy

This policy explains how the Madak platform collects, uses and protects your personal data, and the rights you hold under the Personal Data Protection Law of the Kingdom of Saudi Arabia.

Madak — the first Saudi platform for fractional ownership in real estate, authorised within the regulatory sandbox of the Real Estate General Authority — respects your privacy and is committed to protecting your personal data. This policy sets out the types of data we collect from you, how we use, share and protect it, and the rights you hold in relation to it, in accordance with the Personal Data Protection Law and its implementing regulations in the Kingdom of Saudi Arabia. By using the platform you acknowledge that you have read and understood this policy.

Last updated: 6 July 2026

The Arabic text below is the legally binding version; an English translation is in preparation.

01 Introduction and scope

This policy applies to all personal data processed by Madak Company (“we” or “the platform”) through our website, our app and any of our related services. It covers:

  • Visitors to the Madak website and app.
  • Registered users and investors on the platform.
  • Property owners and providers of investment opportunities. This policy is to be read alongside the platform's Terms of Use and Risk Disclosure.

02 Data we collect

We collect different types of personal data depending on how you interact with the platform, including:

  • Identity and contact data: name, national ID or residency number, date of birth, mobile number, email address, and address.
  • Identity verification data: what is verified through Nafath and integration with approved government entities for know-your-customer (KYC) purposes.
  • Financial and investment data: bank account details (IBAN), the record of your investments and shares, and financial transactions within the platform.
  • Technical data: internet protocol (IP) address, device and browser type, and device identifiers.
  • Usage data: the pages you visit, and your interaction with opportunities and services within the platform.

03 How we use your data

We use your personal data for the following legitimate purposes:

  • Creating your account, verifying your identity and activating your services.
  • Enabling you to browse real estate opportunities, invest in them and manage your portfolio.
  • Executing financial transactions and issuing deeds and regulatory disclosures.
  • Complying with regulatory and supervisory requirements, including those of the Real Estate General Authority (REGA) and anti-money-laundering rules.
  • Improving our services and the user experience, and providing technical support.
  • Sending operational notifications and updates relating to your account and investments.

04 Lawful basis for processing

We process your personal data on one or more of the following lawful bases:

  • Your explicit consent when registering or using certain services.
  • Performance of a contract to which you are a party, or taking steps at your request before entering into a contract.
  • Our legal obligation under the laws and regulations in force in the Kingdom.
  • The platform's legitimate interest in operating its services and protecting them from fraud, in a manner that does not conflict with your rights. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

05 Sharing data with third parties

We do not sell your personal data. We may share it, to a limited extent and only as needed, with:

  • Regulatory and government entities upon lawful request, including the Real Estate General Authority and related bodies.
  • Trusted service providers acting on our behalf (payments, identity verification, cloud hosting) under agreements that preserve the confidentiality of your data.
  • Legal and judicial authorities where there is a legal obligation or a court order.

06 Cookies

We use cookies and similar technologies to operate the platform, improve its performance and analyse its use. These include:

  • Essential cookies without which the platform cannot function (such as session management and sign-in).
  • Analytics cookies to understand how visitors use the platform and to improve it.
  • Functional cookies that remember your preferences, such as language. You can control cookies through your browser settings, bearing in mind that disabling some of them may affect the performance of the platform.

07 Data security

We take appropriate organisational and technical measures to protect your data from unauthorised access, loss or alteration, including:

  • Encryption of data in transit and at rest.
  • Strict access controls that limit visibility of data to authorised personnel only.
  • Continuous monitoring of systems and periodic security testing. Do not share your sign-in details or password with anyone. Madak staff will never ask you for your password.

08 Data retention

We retain your personal data for as long as is necessary to fulfil the purposes set out in this policy, or for the period required by the laws in force in the Kingdom (including financial and regulatory requirements), whichever is longer. Once it is no longer needed, we securely delete or anonymise it.

09 Your rights under the PDPL

The Personal Data Protection Law of the Kingdom grants you a number of rights over your data, including:

  • The right to be informed: to know how your data is collected and the lawful basis for processing it.
  • The right of access: to obtain a copy of the personal data we hold about you.
  • The right to rectification: to request correction or updating of inaccurate data.
  • The right to erasure: to request deletion of your data once it is no longer needed and in line with the regulatory controls. To exercise any of these rights, please contact us through the channels set out at the end of this policy, and we will respond to your request within the statutory period.

10 Cross-border data transfers

We store and process your data inside the Kingdom of Saudi Arabia wherever possible. Should it become necessary to transfer or process your data outside the Kingdom (for example when using cloud hosting services), we comply with the transfer controls set out in the Personal Data Protection Law and its implementing regulations, and put in place appropriate safeguards to protect your data.

11 Children's privacy

Madak services are directed at persons who have reached full legal capacity to invest under the laws of the Kingdom. We do not knowingly collect data about minors, and if it becomes apparent to us that we have collected a minor's data without a lawful basis, we will work to delete it.

12 Changes to this policy

We may update this policy from time to time to reflect changes in our services or in regulatory requirements. We will publish the updated version on this page along with an updated “last updated” date, and we may notify you of material changes through appropriate channels. Your continued use of the platform after the amendments are published constitutes acceptance of them.

13 Contact us

For any enquiry relating to this policy or to exercising your rights over your personal data, you can contact the privacy and data protection team at Madak through:

  • Email: the contact us page
  • Unified phone line: 920031413

Have a question?

The legal and compliance support team at Madak is ready to answer your questions about this document.

Contact us