Version 1.0 · Effective date: 10 November 2026. In case of any conflict, the Arabic text prevails.
This policy explains in plain language what personal data we collect, why, who we share it with, and how you can exercise your rights under the Personal Data Protection Law (PDPL) and its regulations.
1. Controller and contact
The controller of your data is Aldlal Aljdid Company for Information Technology (Dallali), Unified National No. 7021461301, national address: Building 8186, King Fahad Branch Road, Secondary No. 4054, Al Mutamarat District, Riyadh 12711.
Data Protection Officer: privacy@dallali.com or +966 11 500 1540.
2. Data we collect
Category | Examples | Source |
|---|---|---|
Identity | Name, national ID or Iqama number, date of birth, nationality | You and Nafath |
Contact | Mobile, email, national address | You |
Property and ownership (Owners) | Deed number, property and unit details, powers of attorney | You, the Real Estate Registry, REGA |
Contracts and transactions | Brokerage and management contracts, Ejar leases, invoices, payments, arrears | You, Ejar, the Platform |
Financial | IBAN for rent transfers, payment history (we do not store full card details) | You, the payment gateway |
Tenant or Buyer details | Employer where needed, co-occupant details required by law in the lease | You |
Vendors | Commercial registration, bank details, work orders, job photos | You |
Communications | Messages via WhatsApp and email, requests and complaints | You |
Technical | IP address, device and browser type, login and security logs | Automatically |
Property media | Photos and videos of units (we avoid capturing people and personal belongings) | Our team |
We do not knowingly collect sensitive data such as health, religious or genetic data. If we ever need it for a legal purpose, we will ask for your explicit consent or rely on the specific legal basis.
3. Purposes and legal bases
Purpose | Legal basis |
|---|---|
Creating your account and verifying identity | Contract performance; legal obligation |
Providing marketing, brokerage and property-management services | Contract performance |
Documenting leases on Ejar, verifying ownership, licensing listings | Legal obligation |
Invoicing, collection, rent transfers and Owner reporting | Contract performance; legal obligation (ZATCA) |
Anti-money-laundering, counter-terrorist-financing and beneficial-owner checks | Legal obligation |
Customer service and operational notices (SMS, email, WhatsApp) | Contract performance |
Platform security, fraud prevention and service improvement | Legitimate interest |
Marketing and awareness messages | Your explicit consent only, which you can withdraw at any time |
We do not make decisions affecting your rights based solely on automated processing without human review.
Verification and anti-money-laundering checks: as a licensed real estate broker, the Anti-Money Laundering Law requires us to know our customers. Your verification profile therefore asks for your capacity, anyone you represent, the beneficial owners of companies, the purpose of the relationship, the source of funds, the expected value, and whether you or anyone connected to you is a politically exposed person. We verify this through Nafath, the Wathq service (Ministry of Commerce), Najiz (Ministry of Justice) for powers of attorney, and the national address. We screen names against local and international sanctions lists, assign each profile a risk level, and our compliance team reviews profiles that need it.
If you give us other people's data (such as partners or a principal), you confirm you are authorised to do so and have told them. The law may require us to report to the competent authorities without informing you.
4. Artificial intelligence
We use Claude by Anthropic for drafting, summarising and organising data. We send it the minimum data needed and avoid sending ID numbers and bank details. Our team reviews outputs before relying on them, and under the provider's commercial terms your data is not used to train the model.
5. Who we share your data with
We do not sell your personal data. We share it only as needed with:
Recipient | Purpose | Processing location |
|---|---|---|
Transaction parties (Owner, Tenant or Buyer) | Completing the transaction and performing the contract | KSA |
Approved Vendors | Carrying out maintenance orders (name, contact number and unit location only) | KSA |
Government bodies: Nafath, Ejar, REGA, the Real Estate Registry, the Ministry of Commerce (Wathq), the Ministry of Justice (Najiz), ZATCA, the General Directorate of Financial Intelligence, and others on lawful request | Verification, documentation and legal compliance | KSA |
WafaiCloud | Hosting the Platform and databases | KSA |
HyperPay | Card payment processing | KSA |
Unifonic | SMS messages | KSA |
Twilio | Sending email | Outside KSA |
WhatsApp (Meta) | Customer messaging | Outside KSA |
Google Maps | Showing property locations | Outside KSA |
Anthropic (Claude) | AI features | Outside KSA |
Every service provider is bound by contract to process data only on our instructions and to protect it.
6. Transfers outside the Kingdom
Your core data is stored in Saudi Arabia. We transfer outside the Kingdom only the minimum needed for the services listed above, in line with the Regulation on Personal Data Transfer outside the Kingdom, with appropriate contractual safeguards and a risk assessment where required. You can ask for more information about these safeguards at privacy@dallali.com.
7. Retention
Data | Retention period |
|---|---|
Account data | Life of the account plus 2 years after closure |
Contracts, invoices and accounting records | 10 years |
Verification and AML records | At least 10 years after the relationship ends |
Security and technical logs | 13 months |
Marketing data | Until consent is withdrawn |
After that, we destroy the data or anonymise it so you cannot be identified, unless a law requires us to keep it longer.
8. Your rights
You have the right to:
Be informed how and on what basis your data is collected and processed.
Access your data and obtain a copy in a readable, clear format.
Ask us to correct, complete or update your data.
Ask us to destroy your data when it is no longer needed, unless a law requires us to keep it.
Withdraw your consent at any time, without affecting the lawfulness of earlier processing.
Complain to the Saudi Data and AI Authority (SDAIA).
To exercise your rights, email privacy@dallali.com. We will verify your identity and reply within 30 days. We may extend this by a similar period where needed, telling you the reason in advance.
We may be unable to destroy verification data before its legal retention period ends, or to disclose certain information where the Anti-Money Laundering Law prevents us. Where possible, we will tell you the legal basis.
9. Security
We apply technical and organisational measures to protect your data, including encryption in transit, role-based access control, access logs, backups and staff confidentiality training.
If a data breach occurs, we will notify SDAIA within 72 hours of becoming aware of it as the regulations require. We will tell you without undue delay if it could harm you, and explain what you can do to protect yourself.
10. Cookies
We use only strictly necessary cookies to run the Platform, keep you signed in, keep it secure and remember your language. If we add analytics or marketing cookies in future, we will ask for your consent first.
11. Marketing messages
We send marketing or awareness messages only with your explicit consent. You can unsubscribe at any time through the unsubscribe link, by replying "STOP", or in your account settings. Operational notices about your contracts and payments will continue.
12. Minors
The Platform is for people aged 18 and over. We do not create accounts for minors. We process data of minor co-occupants in a lease only as the law requires, as provided by their guardian.
13. White-label versions
If you use a real estate company's platform that runs on a white-label version of Dallali, that company is the controller of your data and Dallali processes it on its behalf. Please send requests to that company first.
14. Changes to this policy
We may update this policy and will show the new date at the top. We will notify you of material changes by email or on the Platform before they take effect.
15. Complaints
If you are not satisfied with our reply, you may complain to the Saudi Data and AI Authority (SDAIA) through its official channels.