Privacy Policy

Updated on: 30 September 2024

Preamble:

Welcome to the page of the applicable privacy policy.

Tamara respects your privacy and shall be committed to protect your personal data. Therefore, we will review this privacy policy and the ways to take care of your personal data when you visit our application/website (regardless of where you visit the application or site). Also, we will inform you of your privacy rights and how to provide legal protection to you, and whenever you access or use Tamara's products, services, features and technologies including the Tamara mobile application, you accept this privacy policy.

Therefore, please read the Privacy Policy carefully. This Privacy Policy does not apply to information provided or collected through sites maintained by other companies or organizations that we may link to or that may link to us, so we are not responsible for the procedures and privacy policies of third-party sites.

Terminologies:

Legal Basis:-

Legitimate interest: It means the interest related to our business and its management, through which we can provide you with the best services, and even the best and most secure experiences for you, knowing that we make sure to take into account any potential impact on you (whether positive or negative). Even to achieve the required balance, and to take into account your rights before initiating the processing of your personal data to achieve our legitimate interests. Also we do not use your personal data for activities in which our interests must be disregarded because of their impact on you (unless we have your consent or we have a legal obligation or we are permitted by law to do so).You can contact us for more information on how we assess our legitimate interests in light of the potential effects on you when conducting certain activities.
Implementing the contract: This means of processing your data if it is necessary to implement a contract to which you are a party or to take measures at your request before concluding that contract.
Fulfilling a legal obligation: This means processing your personal data if it is necessary to fulfill a legal obligation to which we are subjected.

Third parties:-

Third parties from within our group: They mean other companies within the Tamara group that act as controllers or processors, and these companies are based in the Kingdom of Saudi Arabia and provide information technology, systems management and reporting services.
Third parties outside of our group: They mean service providers who process personal data on behalf of and pursuant to instructions given by Tamara and, for example, provide information technology and systems administration services.
Competent advisors: Those who act as data processors or controllers, including lawyers, bankers, accountants, and insurance companies who provide advisory, banking, legal, insurance and accounting services.
Government agencies and other public authorities or institutions: Those who act as independent controllers in the Kingdom of Saudi Arabia and exercise authority over Tamara and may, for example, request reports on Tamara activities in certain circumstances or situations.

1. Important information and our identity:-

1.1 The purpose of this privacy policy:

This privacy policy aims to provide you with information about the ways Tamara collects and processes your personal data received through your use of the website or mobile application, including any data you provide through the application or website when you sign up to access newsletters, register or when you download or sign up to access any Tamara platform or any of our mobile applications.
It is important that you read this Privacy Policy as well as our applicable
terms and conditions, especially when we collect or process your personal data so that you can be fully aware of how the use of your data and the means to do so. Bearing in mind that this privacy policy is a supplement to the notices and other privacy policies, and is not intended to cancel or invalidate them.

1.2 Who is responsible for your personal data:

Tamara Financing Company, having its registered seat at King Abdullah Branch Road, King Salman Dist. Building No. 2907, Postal Code 12444, Riyadh, Kingdom of Saudi Arabia is considered the party responsible for your personal data (referred to in this document as "Tamara" or the pronouns “we”, “our” or "us” in this privacy policy) and Tamara is also responsible for supervision over this application or the website. You can contact Tamara using following contact details: : privacy@tamara.co
We have appointed a data protection officer, who is responsible for following up on inquiries related to this privacy policy. If you have any inquiries about this privacy policy, including any inquiries about business practice, please contact our data protection officer at: privacy@tamara.co.

2. The data we collect about you:

Personal data or information about you means any information about a person from which that person can be identified, and does not include any data where the identity has been irreversibly removed.

We also collect, use, store and transfer different types of personal data relating to you, including in general but not limited to the following data:

Identity data, including (first name, middle name, last name, user name or similar identification data, date of birth, gender, etc.).
Contact data, including (e-mail address and phone numbers).
Geographical location information and financial account information you provide, such as credit or debit card numbers.
Technical data, including Internet Protocol (IP) address, your access data to the Website/Application, browser type and version, time settings, browser plug-in and version types, operating system and platform, and other technological data about the devices you use to access the Website .
Profile data, including your user name and password, data of your interests and survey processes).
Usage data, including call history and information about how you use our website, products, and services.
You can choose to provide us with access to some personal information stored by third parties such as social networking sites (such as: Facebook, Instagram and Twitter). The information we may receive varies by site and is controlled through this site. By linking an account operated by a third party to your Tamara account and authorizing Tamara to access this information, you agree that Tamara may collect, store, and use this information in accordance with this privacy policy.

We also collect, use and share aggregate data, such as statistical and demographic data for various purposes, and aggregate data may be generated through your personal data, but it is not considered personal data under the law, as this data does not contain any information about your identity, either directly or even indirectly. Directly, for example, we may collect your usage data to calculate the percentage of users who access a specific feature of the website, however if we collect aggregate data with your personal data, it can identify you either directly or indirectly, and for this we deal with data collected as personal data, and its use is subject to the provisions of this privacy policy.

If the non-personally identifiable information is directly linked to the personally identifiable information,; it will be then considered personally identifiable information while it is linked. For example, if your payment history and information history are associated with your name, then this information will be considered personally identifiable information and subject to the strictest privacy and security restrictions as set out in this privacy policy.

We do not collect any special (sensitive) types or categories of personal data about you, including any details about race, ethnicity, religion, philosophical beliefs, political opinions, information about your health status, genetic, biometric or biological data about you, nor do we collect any personal information about you on any criminal judgments of conviction or any criminal acts or security-related data.

3. How your personal data is collected and stored:

We use various methods to collect data from or about you, including the following:

3.1 Direct Transactions:-

You may provide us with your identity data, contact data and your financial data by filling in data forms or by communicating with us by regular mail, telephone, e-mail or otherwise, including your interactions with or use of Tamara services, and your contact with our customer support team.

3.2 Indirect Transactions:-

Third parties, such as data collectors, your bank, or merchants with whom you transact through our websites, use of cookies, web beacons, mobile application plug-ins, and similar technologies.

Given the nature of Tamara's services, your personal data will be stored in electronic form in our IT systems. Further information on the time periods for which your personal data will be stored can be found in our Data Retention Policy.

4. Failure to provide personal data:

If we need to collect personal data in accordance with the law or according to the terms of a contract we have with you, and you fail to provide that data when requested from you, we may not be able to implement the contract concluded or that we are working to conclude with you (for example, our provision of services to you). In this case, we may have to cancel the service you enjoy through us, but we will notify you if the cancellation is actually due to this matter, and you must notify us of any changes in your personal data.

5. How we use your personal data:

We will use your personal data only when permitted by law and generally we may use your personal information to:

Provide Tamara services and customer support.
Process transactions and send notifications about your transactions.
Resolve disputes and collect payments and fees.
Verify the accuracy and authentication of your information.
Detect, investigate and prevent potentially prohibited or illegal activities, such as fraud.
Communicate about accounts or transactions and send information about advantages and improvements.
Contact you, for example by phone, text message (SMS) or email.
Transferring changes to our policies.
Personalize content and experiences, including making recommendations based on your preferences.
Send offers or promotions for Tamara's services (if you have consented to receiving such offers or promotions).
Serve advertisements, including advertisements based on your use of Tamara Services or third-party websites.
Conduct statistical, demographic and marketing analyses of users of Tamara's services and their purchasing patterns.
Conduct any other legitimate business activities not otherwise prohibited by law when necessary for the purpose of achieving our legitimate interests. Your interests and fundamental rights do not override or supersede those interests when we need to fulfill a legal obligation or when we need to create and manage an account for you, for example.

6. What do we do if the information is incorrect?

We conduct checks on the information you provide to us in order to track any errors or omissions and you have the right to request the following:

Correction of any personal data associated with you that you consider to be inaccurate.
Finishing or completion of missing information, including submitting any supplemental or corrective statement, known as the right to correct. If you do not exercise your right of correction, we will take measures to examine the information and correct it if necessary.

7. Personal information of those under 18 years of age:

We do not intend to request for collecting personal information from anyone under the age of 18. If Tamara suspects that a user is less than 18 years, we will ask the user to close his account, and we will not allow the user to continue using Tamara's services. Please notify us if you know of any individuals who are under the age of 18 using Tamara's services so that we can take appropriate actions.

8. The purposes for which we use your personal data and applicable legal grounds of such use:

8.1 Implementation of a contract

We process your personal data as necessary for the purpose of implementing a contract in which you are a party or to take steps at your request before concluding a contract or agreement.

In this regard, we may share or transfer your personal data to the following entities to the extent permitted by applicable law:

Independent third parties, whom we appoint to assist us in providing services to you and who will process your data pursuant to our instructions and for purposes determined by us.
Our specialized consultants, if it is necessary for us to obtain advice or assistance from them, including lawyers, accountants, information technology specialists and public relations consultants.
Our data storage service providers.
Our subsidiaries and related companies.
Our partners, suppliers, and service providers that assist in our business operations, including with respect to fraud prevention, identity verification, payment collection, marketing, customer service, and technology services.
Our merchants, so that they can provide goods or services to you or respond to a complaint by you, or to help them improve the quality and level of service they provide you.
Financial institutions with which we may partner to jointly create and offer a product.
Credit reporting and collection agencies, including reporting account information, as permitted by law. When we share your personal information with credit reporting agencies, we allow them to use that information for the purposes of providing their credit reporting services. To request a credit report, we will provide information to the credit reporting authority that identifies you.
Banking partners as required by Credit Card Association rules for inclusion in the list of terminated merchants.
Companies we plan to merge with or acquire, or in which we may invest.
Government agencies or officials pursuant to a subpoena, court order, or other legal process or requirement applicable to Tamara, when we need to do so to comply with the law or credit card rules, or when we believe, in our sole discretion, that disclosure of personal information is necessary to prevent physical harm or financial loss, or to report suspected illegal activity or to investigate suspected violations of our User Agreement.
Any other third parties such as mediation bodies whom we introduce to you, knowing that we will, whenever possible, inform you of their identity, before proceeding to introduce them to you.
Any other parties with your consent or direction to do so.

In this regard, we use your personal data for the following purposes:

For the purpose of preparing a proposal for you regarding the services that we offer you.
For the purpose of providing services to you in accordance with the scope of our services or as agreed with you from time to time.
For the purpose of dealing with any complaints or comments made by you.
For any other purpose for which you provide us with your personal data.

8.2 Consent

Tamara may request your consent to use or disclose your personal information if it needs to use your information for a purpose that is not related to the purpose for which it was collected. If you do not consent to Tamara collecting, using or disclosing your personal information for such other purposes, this may affect the ability of Tamara to provide and improve our products and services, or to do business with you.

Additionally, you should note that merchants from whom you purchase goods or services (even if those goods or services were purchased using Tamara's services) have their own privacy policies and that Tamara is not responsible for their actions.

8.3 Our legitimate interests:

We also process personal data about you as necessary to serve our legitimate interests, and in this regard we use personal data for the following purposes:

For the purposes of managing and organizing work, including carrying out archival or statistical analyses.
Or to obtain an advisory opinion on our rights and obligations, as we ask for the opinion of our legal advisors, and in this regard we will share your personal data with our advisors or agents if necessary to obtain their advice or support, and with third party and with their advisors if this third party owns or is deemed to own a part of our business.

8.4 Legal Obligations:

We also process your personal data for the purpose of fulfilling a legal obligation that we must comply with. In this regard, we will use your personal data for the following purposes:

To fulfill our regulatory and legal obligations.
To fulfill the requirements of the tax authorities or any competent court or official body, and in this regard, we will share your personal data with the following entities:
1. Our legal advisors, if necessary, to obtain their advice or support.
2. Our financial controllers, if this information sharing is considered part of their supervisory duties.
3. Third parties who assist us in carrying out identity verifications.
4. The competent regulatory authorities or law enforcement agencies, if we are required to do so.

9. SMS Terms and Conditions:

By entering your mobile number, you agree to receive text messages for service notifications and Tamara verification codes, and the frequency of messages will vary such as a response to "help" for help, stop to stop (or cancel) standard message. Data rates may apply. Tamara is not responsible for late or undelivered messages.

10. Marketing:

Provided that we have your consent, we (or third parties acting on our behalf) will send you marketing messages about the services we provide that may be of interest to you via text and/or email, and we will send you other information in the form of alerts, newsletters, discounts or tasks that we think may interest you or for the purpose of providing you with new news that we think may be related to you. In such a case and provided that additional legal requirements are met, we may use your personal information to make inferences and provide more relevant content, such as your buying and spending habits. We will send it to you in a number of ways, depending on your choice, including correspondence by regular mail, by phone, by email, or other digital communication channels. You will have the right to withdraw your consent to said marketing acts at any time, by communicating with us in this regard.

If you sign up to receive push notifications (including in-store marketing notifications), we'll send you recommendations we think you'll want, including information based on your geographical location and purchase history. You can opt-out at any time from receiving marketing notifications, including those based on your geographical location, using your application settings, you can also update your payment notification preferences at any time in the application's profile settings. If you opt-out we may still collect and process your geographical location for other purposes in accordance with applicable laws.

If you sign up to receive e-mail marketing, you can unsubscribe at any time and you can also unsubscribe and update your e-mail marketing preferences at any time in the application's profile settings.

11. Promotions and advertisements from us:

To the extent permitted by applicable law, we may use your identity data, your contact data, your technical data, your usage data or your file data with us for the purpose of forming a view about what you require or need or what interests you. Through this we can determine the appropriate services that are related to you (in marketing terms).

We sometimes work with online advertising vendors to provide you with relevant and useful advertisements. This may include advertisements displayed on or through our websites, and this may also include advertisements displayed on other companies' websites. These advertisements may be based on information collected by us, or by third parties for example your zip code may be used to target an advertisement to people in your area. These advertisements may also be based on your activities on our own websites or on third party websites.

12. The option to stop:

If you choose to stop receiving promotional messages, this will not affect the personal data you provided for other necessary purposes, such as processing your requests, maintaining our services, or fulfilling legal obligations.

13. Cookies:

We use cookies and track IP addresses across our websites so that we can improve our services on our websites and enhance your user experience. When you access our websites or use Tamara's services, we (including our partners and companies we work with) may place small data files on your computer or other device. These data files may be cookies, pixel tags, "cookies" or any other local storage provided by your browser or associated applications (collectively, "cookies"). We use cookies to check which web pages are visited and how often, to make our websites more user-friendly, to give you a better experience when you return to the website and to target advertisements to you that we think you might be interested in for example cookies allow us to save your password so you don't have to re-enter it every time you visit our site.

Most web browsers automatically accept cookies, and you can find information specific to your browser under the Help menu. You are free to refuse our cookies if your browser or browser add-on permits unless our cookies are required to prevent fraud or ensure the security of websites we control. However, rejecting our cookies may interfere with your use of our websites and payment services.

You can set your browsing system for the purpose of rejecting all or some cookies or to alert you when the application/websites set or enter cookies for you, but if you disable or refuse cookies, we would like to inform you that you may not be able to access some parts of this electronic website or these parts may not function properly.

14. Change in purpose:

We use your personal data only for the purposes for which we collect this data, unless there is a need for us to use this data for another purpose, and this purpose is consistent and does not conflict with the primary purpose of its collection and provided that such use is permitted by applicable data protection laws. We will always obtain your consent prior to processing your personal data for a new purpose. If you want to know how the processing is compatible to serve the new purpose with the original purpose of the data, please contact us. Please note that in exceptional circumstances, we may process your personal data without your consent, in accordance with the above-mentioned rules, if this is required by law.

15. Change in Privacy Policy:

Tamara reserves the right, in its entirety, to modify this Privacy Policy at any time, provided that such modification becomes effective once the modified terms are posted on the website.
You are responsible for checking the website periodically for any modifications that may be made to this Privacy Policy.

16. Disclosure of your personal data, including international transfers:

We are committed to observing the security of your personal data and dealing with it in accordance with the provisions of the law. We will not allow our third party service providers to use your personal data to serve their own purposes, but we will only allow them to process your personal data for specific purposes and in accordance with the instructions issued by us in this regard.

Your personal data may also be shared with and processed by entities outside the Kingdom of Saudi Arabia or the country from which your personal data was collected in accordance with applicable laws. We only share your personal data with entities that provide an adequate level of protection of your personal data with reference to adequacy decisions issued by the competent regulatory authority, or where we are otherwise permitted to do so by applicable law.

In the absence of an adequacy decision, we only transfer your personal data where we are otherwise permitted to do so by applicable law, if, for example, a special circumstance applies (e.g. the transfer is necessary for the performance of a contract with you, the transfer is necessary to comply with certain legal obligations or it is to protect your vital interests, etc.) and/or we have implemented certain additional and appropriate safeguards to protect it, such as standard contractual clauses or binding common rules.

In all cases, we implement necessary and appropriate measures to safeguard your personal data when we transfer it outside of the Kingdom of Saudi Arabia or other jurisdiction from where we have collected it and only ever share the minimum amount needed for the transfer.

You can contact us for more information about the safeguards we have put in place to ensure the adequate protection of your personal data when this is transferred as mentioned above using the contact details set out in section 1.2. of this Privacy Policy.

17. Data Security:

We have put in place the appropriate procedures and means of security to prevent any accidental loss of your personal data, its use or unauthorized access to it, its change or disclosure in any way. In addition, we do not grant the right to access the personal data except to the extent of employees, agents or third parties who need to know the data to serve our business purposes. They will therefore process the personal data for you based on our instructions and will be obligated to maintain its confidentiality.

We have also established procedures to deal with every possible breach of personal data security we suspect, and we will notify you and any competent supervisory authority of that breach if we are required to do so by applicable law.

We also periodically review our security procedures to consider appropriate new technology and updated methods. Only properly authorized persons who need access to personal information to perform their work will be able to see or use this information, however, despite our reasonable efforts, there is no security measure perfect or impenetrable.

18. Third Party Links:

This platform (website, application for smart devices, customer portal and dashboard) may include links to third-party websites, additional electronic components and other applications. Therefore clicking on these links or allowing them to be activated will allow others to collect or share data about you. We do not have control over the applications or websites of third parties, and we are not even responsible for their privacy statements. Therefore, when you leave our application or website, we recommend that you review each applicable privacy policy in each application or website that you visit.

19. Data retention:

19.1 The period during which your personal data is retained.

We save your personal data for the period necessary to fulfill the purposes for which we collected the data, including the purposes related to fulfilling any legal, regulatory, tax, accounting or reporting requirements. We may save your personal data for a longer period in the event of a complaint or if we see that there is a possibility of litigation regarding the relationship with you.

To determine the appropriate period for saving any personal data, we take into account the amount, nature and sensitivity of the personal data, the potential for harm arising from unauthorized use of or disclosure of your personal data, the purposes, for which your personal data are processed, and whether we can achieve these purposes in other ways or not, and the legal, regulatory, tax, accounting or other requirements that are in force in this regard.

If it is no longer necessary for us to save your personal data, we will delete or otherwise destroy it.

(Regarding the periods of personal data retention for various purposes, these are outlined in our Data Retention Policy, which you can request by contacting our team).

20. What might we need from you?

We may ask you for certain information to help us identify you and ensure that you have access to personal data (or exercise any of your rights). This is a security measure to ensure that your personal data is not disclosed to anyone who does not have the right to view or obtain it. We may also contact you requesting more information related to your request to quickly respond to a topic from us.

21. Time required to respond:

Tamara is trying to respond to all your legitimate requests within 30 days, but it may take us longer, if the request received from you is a complex request that requires significant effort or if a number of requests are issued by you. In this case we will notify you of the matter and will continue to follow up with you.

22. Your legal rights:

You have the following rights:

A right to be informed about the legal basis and the purpose of the processing.
A right to request to access your personal data, which is a request that is generally known as a "data access request". You also have the right to request access to your personal data that we have and in a readable and clear format.
A right to request correction, updating or completion of the personal data we hold about you: It is a request through which you can request your data to be corrected, completed or updated, especially if it is incomplete or inaccurate, but we will then need to ensure the accuracy of the new data that you provide us with. We will restrict processing your data while we verify the accuracy of your personal data.
A right to request erasure of your personal data: This is a request through which you can request destruction or removal of personal data in certain circumstances, such as if there are no justifiable reasons for continuing to process it. You also have the right to ask us to cancel or remove your personal data if we process your information in conflict with the provisions of the law or if we are required to erase your personal data to comply with the provisions of local law. We may not be able to respond to your request to erase data if there are certain legal reasons that will justify further processing of the data, about which we will notify you (if it is necessary to be applicable) when you make the request.
The right to withdraw consent at any time, which is the consent that we rely on for the purpose of data processing, but this procedure will not affect the legality of any processing that took place before the withdrawal of the said consent. If you withdraw your consent, we may not be able to provide certain products or services to you, and we will inform you about this when you withdraw your consent.
You are not obligated to pay any fee for entering your personal data (or for the exercise of any other right), but if your request is unfounded or is an unjustified repetitive request or an excessive request, we may (instead of those fees) refuse to comply with your request, as the case may be.
You have also a right to lodge a complaint to a competent data protection authority, in case you believe that we have violated data protection laws. In the Kingdom of Saudi Arabia, the Saudi Data and Artificial Intelligence Authority is the competent authority supervising compliance with data protection legislation.

23. Whom should I contact to exercise my legal rights?

If you wish to make use of any of your rights listed above, please contact us using contact details provided in section 1.2. above.

‍