Clause 1: Introduction

Saudi Power Procurement Company (Principal Buyer) was established to lead the operations of electricity power purchase and sale agreements with a clear vision and a strong commitment to excellence. In 2022G, the Principal Buyer became fully owned by the government, marking a strategic turning point that unlocked vast opportunities to strengthen its leadership, both locally and globally. The Principal Buyer expanded its scope of work in developing the electricity sector by initiating, managing, and leading energy projects, as well as overseeing the procurement, sale and trading at both local and international levels, in addition to efficiently managing supply chains.

This comes as part of the Principal Buyer’s ongoing efforts to achieve an optimal energy mix that aligns with the objectives of Saudi Vision 2030 and the aspirations of the Kingdom’s wise leadership.

Clause 2: Privacy Notice Updates

The Principal Buyer reserves the right to update this Privacy Notice when necessary, in accordance with changes in practices, applicable laws and regulations. Any material updates will be highlighted in this clause along with their effective dates.

You are recommended to review this section periodically to stay informed about how personal data is protected.

The Arabic language shall be the official language for interpreting the provisions of this Notice. In the event of any discrepancy between the Arabic and English texts, the Arabic version shall prevail.

Clause 3: Personal Data Collected

• Internet Protocol (IP) address
• Date and time of visit
• Referring website address
• Full name
• Email address
• Contact details
• National ID and related government records
• Educational and professional documents

Clause 4: Methods of Personal Data Collection

• Direct Collection: When personal data is provided directly by the data subject (e.g., registration, requests, inquiries, suggestions, or complaints).
• Indirect Collection: Through cookies and similar technologies when visiting the website.

Clause 5: Use of Personal Data

• Completing registration and processing service requests for the services provided on the website, including recruitment and registration of suppliers.
• Analysis of trends and statistics related to visitors’ use of our websites.
• Addressing inquiries, as requested.
• Verifying beneficiary identity.
• Documenting and managing service beneficiaries.
• Improving user experience and service quality.

Personal data shall not be used for commercial or marketing purposes, nor disclosed to any third party other than the Principal Buyer, except with the explicit consent of the data subject or in cases permitted by the Personal Data Protection Law and its Implementing Regulations.

Clause 6: Legal Basis for Collecting and Processing Personal Data

• Consent: Explicit consent of the data subject, which may be withdrawn at any time without affecting prior lawful processing.
• Contractual Obligation: To fulfill obligations under contracts or government procurement regulations.
• Legal Obligation: To comply with relevant laws and regulations.
• Vital/Public Interest: To protect vital interests or achieve public or legitimate objectives of Principal Buyer.

Clause 7: Retention, Storage, and Destruction

• Personal data is stored securely within Saudi Arabia, either at Principal Buyer premises or with authorized cloud service providers.
• Data is safeguarded in compliance with the National Cybersecurity Authority (NCA) policies and international standards.
• Your personal data is stored as long as necessary, in accordance with the defined retention periods, for the purposes for which it was collected and to meet any legal, regulatory, or reporting requirements. Once no longer needed, data will be securely destroyed using approved methods and cannot be accessed or restored.

Clause 8: Data Subject Rights

• Right to be Informed
• Right of Access
• Right to Obtain a Copy
• Right to Rectification
• Right to Erasure
• Right to Withdraw Consent

Clause 9: Exercising Data Subject Rights

These rights shall be exercised free of charge, unless otherwise provided by law and its implementing regulations. Requests may be submitted to the Data Management Office via email: dmo@spb.com.sa. Principal Buyer will respond to requests within thirty (30) days of receipt.

Clause 10: Protection of Personal Data and Disclosure

1. Disclosure and Sharing

Personal data shall not be disclosed or shared except where required by law, pursuant to a lawful request, or where necessary to provide services or technical support, and always in accordance with the controls and procedures prescribed under the PDPL and its Implementing Regulations.

2. Cross-Border Transfer

Personal data shall not be transferred outside the Kingdom of Saudi Arabia, nor disclosed to any external party, except in the circumstances and exceptions expressly provided for under the PDPL and its Implementing Regulations.

3. Disclosure to External Parties

Personal data shall not be disclosed to external parties without the consent of the data subject, except in the circumstances and exceptions expressly permitted under the PDPL and its Implementing Regulations, and subject to compliance with the applicable controls and procedures therein.

Clause 11: Complaints and Inquiries

For any complaint or inquiry regarding this Privacy Notice or the processing of personal data, please contact the Data Management Office:
Email: dmo@spb.com.sa

If unresolved, please escalate your complaint to the Saudi Data & AI Authority (SDAIA) and other competent authorities as specified under PDPL.

Clause 12: Related Regulation and Policies

• Personal Data Protection Law (PDPL) and its Implementing Regulations
• Regulation on Personal Data Transfer Outside the Kingdom
• National Data Governance Policies issued by SDAIA
• Essential Cybersecurity Controls issued by the National Cybersecurity Authority (NCA)

Clause 13: Contact Information

Department: Data Management Office
Email Address: dmo@spb.com.sa