Privacy Notice — Bina Center
| Version / effective date | 2026-10-25 |
| Controller | Bawabet Al-Tarmeem Company (شركة بوابة الترميم), Limited Liability Company, Commercial Registration No. 7041438321, National Address: Building No. 7277, King Fahd Branch Road, Al Olaya District, Additional No. 3333, Riyadh 12212, Kingdom of Saudi Arabia |
| Brand and services | Bina Center (بناء سنتر): binacenter.com, app.binacenter.com, the Partners portal |
| Governing language | This notice is issued in Arabic and English. The Arabic version is authoritative and prevails in the event of any conflict. |
| Related documents | Terms of Service · Cookie settings |
This Privacy Notice explains how Bawabet Al-Tarmeem Company processes personal data when you use Bina Center. It is issued under the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 9/2/1443H, as amended by Royal Decree M/148 of 5/9/1444H), its Implementing Regulations, and the Regulation on Personal Data Transfer outside the Kingdom (together, the "PDPL").
Article 1 — Who we are and scope#
1.1 Controller. Bawabet Al-Tarmeem Company, Limited Liability Company, CR No. 7041438321, Building No. 7277, King Fahd Branch Road, Al Olaya District, Additional No. 3333, Riyadh 12212, Kingdom of Saudi Arabia ("we", "us", "the Company") is the controller of the personal data described in this notice.
1.2 What we do. Bina Center is a construction project marketplace. Customers publish renovation and construction projects; verified contractors submit offers; engineers appointed by the platform supervise projects; affiliate partners refer users to the platform. The Company is an intermediary. Any contract for works is concluded between the customer and the contractor.
1.3 Scope. This notice applies to the landing site (binacenter.com), the web application (app.binacenter.com), the Partners portal, our internal administration tools, and the service messages we send. It applies to customers, contractors, engineers, affiliates and affiliate partners, engineer applicants, and visitors who use the landing-page forms.
1.4 Privacy contact. Email: privacy@binacenter.com. Phone: +966 57 357 2442. Postal: the national address above.
1.5 Privacy Officer. The Company has designated its Chief Technology Officer as Privacy Officer, responsible for this notice, data-subject requests and contact with the Saudi Data and Artificial Intelligence Authority (SDAIA). The Company has not appointed a Data Protection Officer.
Article 2 — Definitions#
| Term | Meaning in this notice |
|---|---|
| Personal data | Any information, in any form, that identifies you or makes you identifiable, directly or indirectly, including name, ID number, address, phone number, images and records. |
| Processing | Any operation on personal data: collection, recording, storage, use, sharing, transfer, disclosure, destruction. |
| Controller | The entity that decides the purpose and manner of processing. In this notice, the Company; for financing partners and payment providers, those entities themselves. |
| Processor | An entity that processes personal data on our behalf and under our instructions (for example a hosting or email provider). |
| Credit data | Personal data relating to a request for, or eligibility to obtain, financing. Under the PDPL it carries additional protection and may be disclosed only with your explicit consent. |
| Consent | Your free, specific, informed and unambiguous indication of agreement, given through an affirmative action. Explicit consent is consent given in a separate, clearly worded step. |
| SDAIA | The Saudi Data and Artificial Intelligence Authority, the competent authority for the PDPL (sdaia.gov.sa; National Data Governance Platform dgp.sdaia.gov.sa). |
| Platform / Apps | binacenter.com, app.binacenter.com, the Partners portal and the Company's internal administration tools. |
Article 3 — Personal data we collect#
Mandatory items are marked (M); optional items (O). The consequence of not providing a mandatory item is stated in each table.
3(a) Data you provide, by role
| Role | Data | Status | If not provided |
|---|---|---|---|
| All account holders | First and last name, email, phone, password (stored as a hash), role, city | M | Account cannot be created |
| All account holders | Avatar, language, preferred contact time | O | None |
| All account holders | Chat messages and attachments, notification settings, web-push subscription keys | O | Related feature unavailable |
| Customer | Project name and description, site address, category form answers, project photos and files, comments, reviews, dispute (conflict) text, payment records if any | M for publishing a project | Project cannot be published |
| Customer | Affiliate referral link (if you arrived through one) | O | None |
| Contractor | Legal name, bio, years of experience, portfolio images, website | Legal name M; others O | Profile incomplete |
| Contractor | Verification submission: Commercial Registration number and document, VAT number, national ID of the representative, national address document, cities served, skills | M to become verified | Cannot be verified or submit offers |
| Contractor | Offers (price, text), subscription and payment records (name, email, phone, amount), monthly application counts | M for paid features | Cannot subscribe or bid |
| Engineer (appointed) | Assigned projects, engineer files and notes | M | Role cannot be performed |
| Affiliate / affiliate partner | Affiliate code, company name, commission rates; payout bank name, IBAN, account name; payout requests (amount, bank snapshot, receipt) | Bank details M to receive payouts | Payouts cannot be made |
| Affiliate partner (SSO) | Partner organisation name and logo | M | Portal access unavailable |
| Landing-page visitor | Contact form: name, phone, subject, message (email optional) | M for sending | Message cannot be sent |
| Landing-page visitor | Financing form: name, phone, applicant type, financing goal, estimated amount, message (email optional) | M for a financing request only | Cannot be referred for financing |
3(b) Data collected automatically
| Data | When |
|---|---|
| IP address, user agent, device and browser type, locale | Each request to the platform; recorded in the audit log and at legal acceptance |
| Pages visited, timestamps, actions taken (audit log: action, email, IP, user agent) | While using the platform |
| Last login time | On login |
| Cookies and local storage (Article 13) | As described in the cookie table |
| Usage analytics, session recordings and campaign measurement (Google Tag Manager / Analytics / Ads, Microsoft Clarity, Hotjar, Snapchat pixel) | Only with your consent through cookie settings |
3(c) Data about you from other users
| Data | Source |
|---|---|
| Reviews and ratings of a contractor | Customers |
| Comments, dispute statements and chat messages mentioning you | Other parties to the project |
| Admin notes about a user | Our operations team, for account and dispute handling |
| Phone-reveal log (which contractor viewed a customer's phone, and when) | Generated by the platform |
3(d) Data from third parties
| Source | Data | Purpose |
|---|---|---|
| SSO partner organisation (affiliate partners) | Name, email, organisation membership | To sign you in to the Partners portal |
| Affiliates and affiliate partners | The referral code that brought you to the platform | To attribute the referral |
| Payment provider (Tamara) | Payment status, transaction reference, amount | To activate and record your subscription |
Article 4 — Purposes and legal basis#
| # | Purpose | Data used | Legal basis (PDPL) | Retention |
|---|---|---|---|---|
| 1 | Create and operate your account; match projects with contractors and engineers; chat; notifications; offers | Account, profile, project, offer and chat data | Performance of the contract with you (Art. 6(2)) | Art. 10, row A, F |
| 2 | Verify identity, phone and email (one-time codes via Authentica WhatsApp/SMS); verify contractor Commercial Registration and ID | Phone, email, verification documents | Legal obligation; contract; fraud prevention as a legitimate interest for non-sensitive data (Art. 6(4); Article 4.4(a)) | Art. 10, row C |
| 3 | Payments, subscriptions, invoices, affiliate payouts, tax and Zakat records | Payment, subscription, payout and bank data | Contract; legal obligation (ZATCA requirements) | Art. 10, row D |
| 4 | Automated screening of offers and comments for contact details and prices (Article 5) | Text of offers and comments | Legitimate interest: platform safety and prevention of fee circumvention (Art. 6(4); Article 4.4(c)) | Art. 10, rows F, O |
| 5 | Security, audit logs, abuse prevention, backups | IP, user agent, actions, account identifiers | Legitimate interest (Article 4.4(a), (b)); legal obligation | Art. 10, rows G, H, K |
| 6 | Record of acceptance of the Terms and this notice (version, time, IP, user agent) | Acceptance record | Proof of consent; legal obligation | Art. 10, row B |
| 7 | Service communications only: one-time codes, project updates, offers, payment confirmations, legal notices, security alerts | Email, phone, push keys | Performance of the contract | Art. 10, rows I, J |
| 8 | Sharing with financing partners (Article 7) | Fields listed in Article 7.3 | Your explicit, separate consent (Art. 15(1); IR Art. 11(2)(b)) | Art. 10, row N |
| 9 | Usage analytics, session recording and measuring which campaigns bring visitors | Device, pages, interactions, campaign identifiers | Your consent via cookie settings (Art. 6(1)) | Art. 13 |
| 10 | Responding to your requests and complaints; handling disputes between users; cooperating with SDAIA and other authorities | Request, account and dispute data | Legal obligation; legitimate interest for disputes and complaints (Article 4.4(d)) | Art. 10, rows A, F, M |
| 11 | Engineer recruitment | Application data | Steps taken at your request prior to a contract | Art. 10, row L |
| 12 | Aggregate service statistics (for example numbers of projects, offers and response times), without profiling | Project, offer and activity records, used only in aggregated form | Legitimate interest (Art. 6(4); Article 4.4(e)) | Art. 10, rows F, G; aggregated results contain no personal data |
4.1 Purpose limitation. We use your personal data only for the purpose for which it was collected and disclosed to you in this notice (Law Art. 10; IR Art. 4(6)).
4.2 No marketing. We do not send marketing messages of any kind, by any channel. We do not build advertising or marketing profiles. We do not add you to marketing audiences. We do not sell, rent or otherwise trade personal data. The only messages you receive from us are the service messages listed in row 7 above (Law Art. 13(2), Art. 25).
4.3 New purposes. If we ever wish to process your data for a purpose not stated in this notice, we will first publish an updated notice (Article 16) and, where the PDPL requires it, obtain your separate consent before any such processing begins (IR Art. 11(1)(e)).
4.4 Legitimate interests. Where this notice relies on our legitimate interests (Law Art. 6(4)), it does so only for the following purposes, and never for sensitive data: (a) prevention of fraud and abuse, including verification checks and detection of fake accounts, offers, reviews and referrals (rows 2 and 5); (b) security logging and incident response (row 5); (c) automated content moderation to enforce the Terms of Service (row 4; Article 5); (d) handling disputes between users and complaints (row 10); (e) aggregate service analytics computed from platform records, without profiling (row 12), which is separate from the consent-based analytics tools in row 9 and Article 13. No marketing relies on this basis, and we carry out no marketing of any kind (Article 4.2). We have weighed each of these purposes against your rights and interests and keep a written assessment, which we provide to SDAIA on request.
Article 5 — Automated processing#
5.1 What is automated. Offers and comments submitted on the platform are screened automatically, using pattern rules and a language model (Google Gemini), to detect contact details and prices. The purpose is to prevent parties from moving a deal off the platform. An item that triggers a rule is blocked and you see an error message explaining that it was rejected. A blocked item is not deleted: your text stays in the form so that you can edit it and submit it again immediately, and a copy of the blocked item is kept for review for the period in Article 10, row O.
5.2 Scope of the decision. The screening decides only whether a specific text may be published. It has no legal effect on you and does not affect your account standing. We do not carry out profiling, and we make no automated credit, eligibility or scoring decisions.
5.3 Human review. If you believe an item was rejected wrongly, email privacy@binacenter.com with the project reference and the text. A member of our team will review it and reply within five business days (Sunday to Thursday, excluding official public holidays in the Kingdom of Saudi Arabia). You can also request review directly from the error message in the app. A review request that has not been answered within two business days is escalated internally.
5.4 Only the text of the offer or comment is sent to the language model. No name, account identifier or contact field is sent with it.
Article 6 — Sharing with other platform users#
Sharing between users is a core function of the platform. It is limited to what each role needs:
| Who sees | What they see |
|---|---|
| Contractors | Customer's name, project details, site address and photos. The customer's phone number is shown only after the contractor uses a phone-reveal entitlement under their subscription tier. |
| Customers | Contractor's legal name, rating, portfolio and the offer submitted. |
| Engineers | The assigned project and the customer's contact details for that project. |
| Affiliates and affiliate partners | The referred user's first name, email and referral status (registered, hired, commission reviewed). |
| Company administrators | All of the above, for operations, verification, dispute handling and support, under role-based access and audit logging. |
Article 7 — Sharing with financing partners#
7.1 Separate explicit consent. We share your data with the financing partners listed in this Article only if you tick the separate, unticked consent box labelled "financing-partner sharing" when registering, when creating a project, when submitting a financing request, or at any time in your account settings. This consent is independent of your acceptance of the Terms and of this notice (Law Art. 15(1); IR Art. 11(2)(b)).
7.2 Credit-data notice. The data shared under this Article is credit data under the PDPL, because it relates to your request for financing. We disclose it only on the basis of your explicit consent, and we will notify you when a disclosure has been made (Law Art. 24; IR Art. 27).
7.3 Data fields shared. Name; phone; email (if you provided one); city; applicant type; project type or financing goal; estimated project cost or requested financing amount; your free-text message. No other data is shared.
7.4 Partners. Your consent covers sharing, for the purpose and data fields stated in this Article, with the financing partners listed in this Article, each licensed by the Saudi Central Bank (SAMA) and acting as an independent controller of the data it receives. Sharing takes place in regular batches of new consenting requests. The data shared is exactly the data you entered on the Platform, in the financing request form or in your account details, limited to the fields in Article 7.3. The Company does not verify that data, and you are responsible for its accuracy.
Current financing partners
| Partner | Role | Data shared | Country |
|---|---|---|---|
| No financing partner is engaged at this time. This table is updated before any sharing begins, and your consent is requested only once a partner is listed here. | — | — | — |
We update this list when a partner is added or removed; the purpose of the sharing and your consent do not change. Any change to the purpose or the data categories requires your new consent.
7.5 Withdrawing consent. You may withdraw at any time in your account settings or by emailing privacy@binacenter.com. Withdrawal is as easy as giving consent.
7.6 Effect of withdrawal. Your data is excluded from all future batches. We instruct the partner to destroy the data we shared, except where the partner has an independent legal obligation to retain it (IR Art. 12(4)). Withdrawal does not affect the lawfulness of sharing that took place before it.
7.7 Not a condition of service. Declining or withdrawing this consent does not affect your ability to use any other part of Bina Center (Law Art. 7).
7.8 We are not a financing entity. The Company does not offer, arrange or decide on financing. Any financing contract is concluded directly between you and the partner under the partner's own terms, its privacy notice, and the rules of the Saudi Central Bank.
Article 8 — Processors and other recipients#
| Recipient | Data | Purpose | Country | Role | Safeguard |
|---|---|---|---|---|---|
| Google Cloud, through its Saudi partner CNTXT | All platform data, database, files, backups, secrets | Hosting | KSA (region me-central2) | Processor | Data processing terms. Operational logs are retained 30 days and may be processed outside KSA. |
| Resend | Recipient email, name, message content | Transactional email delivery | USA | Processor | Contractual clauses; necessity to deliver the service |
| Authentica | Phone number | One-time codes via WhatsApp / SMS | KSA | Processor | Contract |
| Tamara | Name, email, phone, amount | Subscription payments | KSA | Independent controller (SAMA-licensed) | Tamara's own notice applies |
| Google LLC (Gemini API) | Text of offers and comments only | Automated moderation (Article 5) | Outside KSA | Processor | Contractual terms; minimum data, no identifiers |
| Cloudflare R2 | Contractor portfolio images (public) | Image storage and delivery | Global | Processor | Contractual terms |
| Web push services (Google, Apple, Mozilla) | Notification text | Push notifications to your device | Outside KSA | Processor | Only if you enable push; contractual terms |
| Google Tag Manager / Analytics / Ads | Device, pages, interactions, campaign identifiers | Usage analytics and campaign conversion measurement | Outside KSA | Processor | Only with your consent (Article 13) |
| Microsoft Clarity; Hotjar | Device, pages, interactions, session recordings | Usage analytics and session recording | Outside KSA | Processor | Only with your consent (Article 13) |
| Snap Inc. (Snapchat pixel) | Device, pages, campaign identifiers | Measuring Snapchat campaign conversions | Outside KSA | Independent controller for its own use | Only with your consent (Article 13) |
| Firebase Hosting | Landing-page request data | Hosting of binacenter.com | Outside KSA | Processor | Contractual terms |
| Wkil | Text you type into the landing-page chat widget | AI chat assistance | Outside KSA | Processor | Contractual terms |
| Financing partners listed in Article 7.4 | Fields in Article 7.3 | Financing referral | KSA | Independent controller | Your explicit consent |
| Affiliate partners | Referred user's first name, email, status | Referral programme | KSA | Independent controller | Referral contract; this notice |
| SDAIA, courts, law-enforcement and regulatory authorities | As lawfully requested | Legal obligation | KSA | Authority | Disclosure only on a valid legal request |
Article 9 — Transfers outside the Kingdom and safeguards#
9.1 Your core platform data is hosted in the Kingdom (Google Cloud me-central2). The recipients below receive personal data outside the Kingdom. Each recipient receives only the data stated against it.
| Recipient | Purpose | Data that leaves the Kingdom | Destination |
|---|---|---|---|
| Google LLC (Gemini API) | Automated moderation (Article 5) | The text of offers and comments only, without any name, account identifier or contact field (Article 5.4). Attachments, files, images and identity documents are never sent. | Outside KSA |
| Resend | Transactional email delivery | Your email address, your name and the content of the service email being sent (for example a one-time code, a project or offer update, or a legal notice) | USA |
| Cloudflare R2 | Storage and delivery of contractor portfolio images | Contractor portfolio images, which are public | Global |
| Web push services (Google, Apple, Mozilla) | Push notifications, only if you enable them | Notification text | Outside KSA |
| Google Tag Manager / Analytics / Ads; Microsoft Clarity; Hotjar; Snap Inc. | Usage analytics, session recording and campaign measurement, only with your consent (Article 13) | Device, pages, interactions and campaign identifiers; session recordings (Clarity, Hotjar) | Outside KSA |
| Firebase Hosting | Hosting of binacenter.com | Landing-page request data | Outside KSA |
| Wkil | AI chat assistance on the landing page | Text you type into the landing-page chat widget | Outside KSA |
| Google Cloud (operational logs) | Operating the platform | Operational logs, retained 30 days | May be processed outside KSA |
9.2 Each transfer is made on the basis that it is necessary to perform the service you have requested from us, is limited to the minimum data needed, and is covered by contractual safeguards with the recipient (Law Art. 29; Transfer Regulation Art. 4). We assess each transfer before it begins and keep a record of that assessment (Transfer Regulation Art. 7).
9.3 We do not transfer verification documents, national ID images, bank details or financing-request data outside the Kingdom.
Article 10 — Retention and destruction#
| Row | Data | Retention | Then |
|---|---|---|---|
| A | Account profile | Life of the account | Destroyed or anonymised within 30 days after a deletion request is completed |
| B | Legal acceptance record | 5 years after account closure; IP and user agent removed after 1 year | Destroyed |
| C | Contractor verification documents | Until the verification decision plus 1 year, or life of the contractor account, whichever is longer | Destroyed |
| D | Payment, invoice and payout records | 10 years (ZATCA requirements) | Destroyed |
| E | Financing-request emails and landing contact emails | 12 months | Destroyed |
| F | Projects, offers, chat, comments, reviews | Life of the account plus 2 years | Anonymised |
| G | Audit logs | 400 days | Destroyed |
| H | Application logs | 30 days | Destroyed |
| I | Notifications | 180 days | Destroyed |
| J | Push subscriptions | Until disabled, or 90 days of inactivity | Destroyed |
| K | Backups | 7-day rolling cycle | Overwritten |
| L | Engineer applications that were not approved | 12 months from submission; an approved application follows the engineer's account (row A) | Destroyed |
| M | Admin notes | Life of the account | Destroyed with the account |
| N | Financing-partner consent record | 5 years after withdrawal | Destroyed |
| O | Blocked offers and comments kept for human review (Article 5) | 30 days; 180 days where human review was requested | Destroyed |
10.1 Destruction means secure deletion from the database and object storage, followed by expiry from the backup cycle. Where the law requires us to keep a record (for example tax records), we anonymise the record instead of deleting it so that it can no longer identify you.
Article 11 — Security measures#
We apply the following measures:
- TLS 1.2 or higher for all data in transit.
- Encryption at rest for databases, files and backups (Google Cloud default encryption).
- Authentication cookies marked httpOnly.
- Multi-factor authentication for all staff accounts.
- Least-privilege access controls, reviewed monthly.
- Role-based access within the platform.
- Audit logging of administrative and sensitive actions.
- Web application firewall (Cloud Armor) and rate limiting.
- Two-person approval for destructive administrative actions.
- A documented incident-response procedure.
- Daily backups.
No system is completely secure. If you believe your account has been compromised, contact privacy@binacenter.com immediately.
Article 12 — Your rights and how to exercise them#
12.1 Your rights (Law Art. 4; IR Art. 3, 5–8, 10, 12):
| Right | What it means | How to exercise |
|---|---|---|
| To be informed | To know the legal basis and purpose of processing; this notice serves that right | Read this notice; ask us for clarification |
| Access | To know what personal data we hold about you | Account settings or privacy@binacenter.com |
| Copy | To receive a copy of your personal data in a clear and readable format | privacy@binacenter.com |
| Correction | To have inaccurate or incomplete data corrected | Account settings or privacy@binacenter.com |
| Destruction | To request destruction of your personal data when it is no longer needed, or when you withdraw consent, subject to legal retention duties | Account settings (delete account) or privacy@binacenter.com |
| Withdraw consent | To withdraw consent for financing-partner sharing, analytics cookies and push notifications at any time | Account settings, cookie settings, device settings, or privacy@binacenter.com |
| Complain | To complain to us and to SDAIA | Article 12.6 |
12.2 Channel. Email privacy@binacenter.com or use the relevant option in your account settings. Please state which right you are exercising.
12.3 Identity verification. We verify that the request comes from the account holder (for example by a confirmation sent to your registered email or phone) before acting on it. We do not ask for more data than needed to verify you.
12.4 Timeline. We respond within 30 days of receiving a complete request. If a request is complex or we receive many requests, we may extend this once by a further 30 days and will tell you why before the first period ends.
12.5 No fee. Exercising your rights is free of charge. We will not charge any fee for responding to a request unless the PDPL expressly permits it, and we will inform you of any such fee before processing the request.
12.6 Refusal. If we cannot comply with a request in whole or in part (for example because the law requires us to keep the data), we will tell you the reasons in writing.
12.7 Complaint to SDAIA. If you are not satisfied with our response, you may file a complaint with SDAIA through the National Data Governance Platform (dgp.sdaia.gov.sa) within 90 days of the date of our response or of the incident (IR Art. 37).
12.8 Compensation. You have the right to seek compensation before the competent court for material or moral damage resulting from a breach of the PDPL (Law Art. 40).
Article 13 — Cookies and similar technologies#
| Name | Type | Purpose | Lifetime | Consent |
|---|---|---|---|---|
accessToken, refreshToken | First-party, httpOnly | Keep you signed in | Session / 7 days | Strictly necessary |
NEXT_LOCALE | First-party | Remember your language | 1 year | Strictly necessary |
sidebar_state | First-party | Remember UI layout | 7 days | Strictly necessary |
trmem_ref | First-party | Attribute an affiliate referral | 30 days | Strictly necessary for the referral programme |
slicewp_aff | First-party (landing page) | Attribute an affiliate referral | 30 days | Strictly necessary for the referral programme |
_ga, _ga_* | Third-party (Google Analytics) | Usage analytics | 2 years | Your consent |
_gcl_au | Third-party (Google Ads) | Measure campaign conversions | 90 days | Your consent |
_clck, _clsk | Third-party (Microsoft Clarity) | Usage analytics and session recording | 1 year / 1 day | Your consent |
_hjSession*, _hjid, _hjFirstSeen | Third-party (Hotjar) | Usage analytics and session recording | 30 minutes / 1 year | Your consent |
_scid, _scid_r | Third-party (Snapchat) | Measure Snapchat campaign conversions | 13 months | Your consent |
bc_consent | First-party | Remember your cookie choice | 12 months | Strictly necessary |
| Wkil widget storage | Third-party (landing page) | Keep landing-page chat state; loads only when you open the chat | Session | Strictly necessary once you open the chat |
| Local / session storage | First-party | Verification-flow progress flags; last list URL | Until cleared | Strictly necessary |
13.1 Analytics and session-recording tools load only after you accept them in cookie settings. You can change your choice at any time from the same page. Refusing them does not affect your use of the platform.
Article 14 — Children#
Bina Center is for persons aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we discover that an account or submission belongs to a minor, we close the account and destroy the data without undue delay. If you believe a minor has provided us with data, contact privacy@binacenter.com.
Article 15 — Data breaches#
If a personal data breach occurs that may cause harm to you or your rights, we notify SDAIA within 72 hours of becoming aware of it. We notify affected users without undue delay, in plain language, describing what happened, the likely consequences and the steps we are taking and recommend you take (IR Art. 24).
Article 16 — Changes to this notice and update record#
16.1 We may update this notice. For material changes we publish a new version with a new effective date, require you to accept it in the app before continuing to use the platform, and send you an email notice. Non-material changes (for example a corrected contact address) are published without re-acceptance.
16.2 Previous versions are available on request from privacy@binacenter.com.
16.3 Update record
| Version (effective date) | Status | Summary of changes |
|---|---|---|
| 2026-10-05 | Superseded | Initial privacy policy |
2026-10-25 | Current | Full rewrite: numbered articles; complete data inventory; legal basis per purpose; no-marketing commitment; automated-moderation disclosure; financing-partner consent; processor and transfer table; retention schedule; rights procedure; cookie table; Arabic authoritative |
Article 17 — Contact and governing language#
17.1 Contact. Bawabet Al-Tarmeem Company, Building No. 7277, King Fahd Branch Road, Al Olaya District, Additional No. 3333, Riyadh 12212, Kingdom of Saudi Arabia. Email privacy@binacenter.com. Phone +966 57 357 2442. Attention: Privacy Officer.
17.2 Supervisory authority. Saudi Data and Artificial Intelligence Authority (SDAIA), sdaia.gov.sa; National Data Governance Platform dgp.sdaia.gov.sa.
17.3 Governing language. This notice is issued in Arabic and English with identical article numbering. The Arabic version is the authoritative text and prevails in the event of any difference in meaning.
17.4 Governing law. This notice is governed by the laws of the Kingdom of Saudi Arabia.