Al Ramz Employee Privacy Notice

This Employee Privacy Notice provides you with information on how Al Ramz Real Estate (“Al Ramz”, “we”, “us”, “our”) collects and processes personal data that we may obtain from you. Al Ramz values your trust and is committed to the responsible management, use and protection of your personal data.

Introduction

Al Ramz is committed to protecting the privacy and security of your personal data. This Employee Privacy Notice describes how we collect and use personal data about you during and after your working relationship with us, in accordance with the Personal data Protection Law (PDPL) or other applicable privacy laws. It applies to all employees, workers and contractors.

Al Ramz is a “controller” of your personal data. This means that we are responsible for deciding how we hold and use your personal data. We are required under Applicable Laws, namely the PDPL to notify you of the information contained in this Employee Privacy Notice. This Employee Privacy Notice applies to current and former employees, workers and contractors. It is important that you read and retain this Employee Privacy Notice, together with any other Additional Notices we may provide you, on specific occasions when we are collecting or processing personal data about you so that you are aware how to exercise your PDPL or other applicable privacy rights, you may have.

About us

Al Ramz was established in September 2016 in the Kingdom of Saudi Arabia, and is forward looking company fuelled by its passion for establishing a new concept for the architectural environment and residential communities.

If you have any questions or concerns regarding our use of your personal data, or if you wish to exercise any of your rights described in this Employee Privacy Notice, please contact Infoprivacy@alramzre.com.

Additional Notices

We also may provide applicants with additional notices about our information collection practices.

Definitions

“Applicable Laws” means the applicable privacy and data protection legislation in your jurisdiction.

“Competent authority” means the public authority that operates independently and tasked with making sure the PDPL is being followed, in this case SDAIA.

“Contractor” means an individual who works under any agreement that is not a contract of employment.

“Data subject” means the individual to whom the personal data relates.

“Employee” means an individual who works under a contract of employment and has recognised rights and duties under applicable labour laws. For avoidance of doubt, references to employees where used in this Privacy Notice shall include contractors, unless stipulated otherwise.

“Personal data” means any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature, including any sensitive data as defined under Applicable Laws.

“PDPL” means the Personal Data Protection Law.

“Sensitive data” means any racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or genetic data for the purpose of identifying the person, health data, and data that indicates that one or both individual’s parents are unknown.

What personal data do we collect?

We may collect, store and use personal data or categories of personal data described below, that is mandatory to carry out our activities and obligations as your employer to administer the employment relationship or engagement with you. There is also some information, such as sensitive data that may be collected indirectly. This information will generally be received either from you personally or from the company with whom you are working (if you are a contractor). At times, we may collect information from other sources when managing our employment relationship or engagement with you.

Personal data we may collect and process about you, includes:

Contact and communication information

Your contact details, including email addresses, telephone numbers and postal address.
Contact details for family members, or dependents, and next of kind, including emergency contact details.
Records of communications and interaction we have with you.

Biographical, education and social information

Your name, title, signature, gender, nationality, date of birth.
Citizenship, residency, work authorisation, and immigration status.
Image and likeness including as captured in photographs taken for business purposes.
Details of your education and references from your institutions of study.
Lifestyle information and social circumstances, for example life events, such as marriage, divorce, bereavement, or birth of children.
Your interests, languages you speak, and extracurricular activities.

Financial information

Your bank account details (used for paying your salary and processing other payments).
Salary details, and benefits.
Insurance information where relevant to mandatory or optional insurances related to or offered as a benefit of, your employment (including collecting any personal data of your family members and dependents (including children) if applicable to you).

Work related information

Work location, and work contact information (including any international secondments or assignments).
Employee ID number.
Details of your work history and references from your previous employers(GOSI).
Performance assessments and reviews.
Leave entitlements including when leave is submitted and the purpose of the leave.
Interactions with us, including queries, complaints, and records of communications.
Employment agreements or contracts and/or other records relating to the terms and conditions of your employment or contract with us.
Engagement or other employment related surveys including verbatim comments.
Training and education needs and completion.
Investigation records, grievance, and complaint records.
Work permit.
Visa status.
Other employee related benefits, such as pension details.

Government issued identification and identifiers

Passport.
Drivers’ licenses.
National ID number or Iqama.

Digital or electronic information

Telecommunication data, including emails, instant messaging, and internet browsing, use of business-related social media.
Audio, electronic, visual, or similar information, such as; CCTV/video footage, photographs.
Pages viewed and browsing behaviour on our work devices.

We may also collect, store and use the following more sensitive types of personal data such as information below:

any medical condition and sickness records;
the reason for leaving is determined to be ill health, injury or disability, the records relating to that decision;
details of any absences (other than holidays) from work including time on statutory parental leave and sick leave;
biometric data for access purposes.

How do we collect your personal data?

We collect majority of personal data that we process directly from you. In limited circumstances third parties may provide your personal data to us, such as former employers, other employees or contractors, professionals or other third parties such as recruitment agents.

How do we use your personal data, and the legal basis for collecting and processing your personal data

We typically rely on one of four bases for the processing of your personal data such as; consent, to perform contractual obligations, to meet legal obligations and for our legitimate interests. Where we process sensitive data, we rely on multiple legal bases.

Consent

This means we will not process your personal data without consent which will be freely given, specific, informed, and unambiguous. We may rely on consent for the following:

To provide you with the most appropriate health or medical care, including occupational health and safety services and monitor and take decisions as to your ability to undertake certain roles, fitness for work or ability to return to work. If you do not consent, we may be unable to help and support you and provide you with the most appropriate support and care. In certain circumstances we may rely on other legal bases for processing including to comply with contractual and to comply with legal obligations to provide you with a safe and secure workplace, and for our legitimate interests;
To check references you provide to us in relation to your employment history. If you do not consent, we may be unable to offer or continue your employment or contract;

To enable travel and global mobility, for example, when passport, visa, nationality, citizenship information is required. If you do not consent, you may not be able to travel or be part of any global mobility programs;
To use photographs and images for promotional purposes publicly.

We will rely on consent where this is the only legal basis for processing your personal or sensitive data. In such cases, we will be clear with you that we cannot rely on any other basis and if you do not consent, we may be unable to offer or continue or provide you with support or offer benefits to you.

To meet contractual obligations

This means we need to process your personal data to comply with obligations in the employment agreement or contract between us. To rely on this legal basis a signed employment agreement or contract will be in place between you and us. If we are processing sensitive data as part of your contract, we will also identify a separate lawful basis.

Description of why we will process your personal or sensitive data under this lawful basis:

To pay you and to administer benefits (including payment of superannuation and pensions and to assess and pay short and long-term incentives, as applicable) in connection with your employment or contract with us;
To process transactions related to your employment, for example, to process any leave entitlements, to update you about changes to your employment or contract terms and conditions, or when there are changes to your superannuation or pension fund arrangements;
For investigation of any known or suspected breach of any part of your employment agreement or contract as per the obligations set out in that agreement or contract;
To provide HR services to you, including answering any queries regarding your employment agreement or contract or your ongoing employment, or contract;
To conduct performance reviews, manage performance, determine opportunities for performance improvements and ongoing performance requirements.

Legal obligations

We may need to process personal data to comply with legal obligations.

Description of why we will process your personal or sensitive data:

To address, manage and mitigate health and safety issues and situations under relevant work, health and safety laws, or our duty of care obligations (or equivalent).
During emergency situations or where the law requires us to take steps to protect the health and safety of people under relevant work, health and safety laws or duty of care obligations (or equivalent). For example, declaration of a pandemic;
To comply with valid legal processes such as search warrants, subpoenas, regulatory orders or enquiries, or court orders under relevant legislation listed in the official legal notice;
To take action to protect and defend our rights or property and/or the rights or property of our clients or to protect the public against dishonesty, malpractice or seriously improper conduct, unfitness or incompetence, mismanagement or failures in services provided;
To meet our legal and regulatory obligations, such as compliance with Applicable Laws.

Vital interests

We may need to process personal data to protect your life.

Description of why we will process your personal or sensitive data:

If you are involved in an emergency and you require emergency care or medical treatment;
To contact you or your family members where appropriate, for compliance with health and safety requirements or during medical emergencies.

Legitimate interests of Al Ramz

For the performance of a contract or employment agreement with you during and after your employment with us or to take certain steps prior to entering such agreement or contract. Our legitimate interests include effective management of our business;

Our legitimate interests include employee productivity, protecting company assets, preventing misconduct, fraud or crime and network and information security;
For monitoring at work, including monitoring entry to our premises. Our legitimate interest is protecting our systems and devices, preventing, detecting, and recovering from misconduct, ensuring the safety and security of our people and that only people authorized to access our premises are doing so;
To prepare management reporting, including staff absences, attrition levels and tracking individual reasons for leaving Al Ramz. Our legitimate interests include effective management of our business;
To conduct staff surveys including, but not limited to those related to engagement, business improvement, employee development, to develop insights and data analysis and to understand more about the employee relationship and our working environment. Our legitimate interests include effective management of our business, and the outputs of these activities will not be disclosed to third parties unless they have been aggregated and/or undergone a de-identification process or the disclosure is otherwise agreed with you or permitted by Applicable Laws;
For conducting and processing data analytics and/or generating insights for the benefit of Al Ramz including for determining and assessing workplace planning, enhancing the workplace experience, optimising our environment for efficiency and productivity, resource efficiency, promoting flexibility and collaboration, as well as for labour productivity, the probability of implementing any measures and assessing the impact of any measures introduced.

How do we share your personal data, and to whom?

We may disclose/share your personal data with the following:

Recipient (and country)	Purpose	Personal data
Microsoft office 365 (Europe)	Communication and collaboration, Emails.	Any limited or all personal data as described above, on a need to know, and as and when required depending on role with whom the data may be shared.
Menaitech (KSA)	This is our HR administration and management system.	All personal data as described above.
Tawuniya (KSA)	Health Insurance	Contact information.
Tara (KSA)	Evaluation	Yearly Evaluation/ KPI’s for all employees.
HR Health One	HR	Human Capital project consultancy.
Internal between Al Ramz sites and offices (KSA)	Business/HR reasons;Role based access.	Any limited or all personal data as described above, on a need to know, and as and when required depending on role with whom the data may be shared.
Our external advisors, such as lawyers (KSA)	To provide us with internal advice to protect our interests or defend our legal rights.	Contact information, and any other information as required.
Government entities in KSA, such as; General Organization for Social Insurance (GOSI), or Ministry of Human Resources and Social Development (HRSD)	To comply with our legal obligations, including, but not limited to; protecting the rights and safety of others, and completing information as required in QIWA, Mudad, Nitaqat and Muqeem platforms.	All personal data as described above, required by the entities, by law.
Health care professionals (KSA)	In case a health related incident occurred when you are working at any of our sites.	Contact information, and any other information (including sensitive data) that may be applicable for your vital interests.

We may also share your information with law enforcement agencies, as and where required under law.

Cross border transfer of your personal data

We may process or transfer your personal data to any country where we engage third-party agents or service providers, as described above, and you understand that this means your information will be transferred to countries outside of your country of residence. Where the transfer is subject to appropriate safeguards for international transfers as prescribed by Applicable Law, for example if we are sharing your personal data with a third party, as required, the contract with them will have appropriate contractual clauses (and any standard contractual clauses, if the transfer is to a non-adequate country) or other obligations in the contract requiring appropriate technical, organizational and security measures to protect your personal data. To find out more. please email Infoprivacy@alramzre.com.

How do we store your personal data and for how long?

Personal data is stored in our HR administration and management system, namely; Menaitech. We also retain a hardcopy personnel file for each employee in a secure location with limited role based access.

We will only retain personal data for as long as necessary to fulfil the purpose for which it is processed or as required by Applicable Laws or any litigation hold, to which we are subject, including to meet any legal requirements. We will usually retain your data for 2 years after your relationship has ended with us, unless required otherwise by law.

Your personal data rights:

As a data subject, you have a number of rights under the PDPL (or other applicable laws depending on your resident location), which primarily depend on the purpose of personal data collection and processing, these include:

Right to be informed: you are entitled to be informed how we collect your personal data, legal basis for collection and processing, how such data is processed, stored, destroyed, and to whom it will be disclosed.
Right of access to your personal data: you are entitled to request access to your personal data by contacting us using the below mentioned information.
Right to request access to your personal data: you are entitled to request access to your personal data held by us in a readable and clear format if technically feasible through electronically encrypted means.
Right to request correction of your personal data: you are entitled to request correction of your personal data that you believe is inaccurate, incorrect or incomplete, by contacting us using the below mentioned information. Such data will be reviewed and updated within 30 days. In addition, you will be notified that your data has been corrected by email.
Right to request destruction of your personal data: you are entitled to request destruction of your personal data in certain circumstances, for example, we will not destroy your personal data if there is a legal or business requirement for us to retain your personal data, in accordance with Applicable Laws.
Right to withdraw your consent for processing your personal data: you are entitled to withdraw your consent for processing your personal data at any time unless there are legal bases that require otherwise. You may exercise your right to withdraw, by contacting us using the below mentioned information.

Please note, however, these rights are not absolute and we will explain to you if we rely on any exemptions when responding to you. If you would like to exercise any of these rights, please contact us using the below mentioned information.

Security of your personal data

We maintain technical, physical and organisational measures intended, as required under Applicable Laws, to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access.

Contact information and complaints

Should you wish to raise a complaint about how Al Ramz processes your data, we ask that you allow us the opportunity to rectify any issues you may have in the first instance, by emailing Infoprivacy@alramzre.com. If you are not satisfied with how we deal with your concerns, or we fail to respond within 30 days, you may lodge a complaint with the Competent Authority, namely SDAIA, here.

Changes to this Employee Privacy Notice and other information

This Employee Privacy Notice may be changed over time. You are advised to regularly review this Employee Privacy Notice for possible changes. This Employee Privacy Notice was last updated in July 2025.

For ease of reference, the Personal data Protection Law can be accessed here.