Privacy Notice and Policy

1. Introduction

Amana Cooperative Insurance Company is committed to protecting your personal data and respecting your privacy rights.

This Privacy Notice explains how we collect, use, disclose, and protect your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and other applicable regulations for the purposes of providing our products, and access to them.

For the purposes of this document the term “Law” shall refer to the Personal Data Protection Law brought into effect by the Saudi Data & AI Authority (SDAIA). The term “Regulation” refers to the Personal Data Protection Regulations published by SDAIA to aid the implementation of the Law.

2. Data Controller

The data controller of any personal information given to us about you, or other people named on the policy, quote or claim is Amana Cooperative Insurance Company.

If you have any questions about how we process personal information, please get in touch with us by visit us to:

Platinum Center, Salah Al Din Al Ayoubi Road, Al-Zahra neighborhood, Riyadh.

Or through the following:

3. Reasons for Collecting & Processing your Personal Data

By law, we must have a legal justification to process your personal information for the purposes described in this document.

Amana Cooperative Insurance Company collects your personal information to provide our customers with quotes, products and services. We do this to enter into and / or perform insurance contract. This includes arranging, underwriting and managing our products and handling claims in accordance with the terms of this document.

As a regulated insurance services company, we are required to comply with legal and regulatory obligations. This includes meeting responsibilities we have to our regulators, law enforcement and any other legal responsibilities we have, such as the prevention, detection and reporting of fraud and other financial crime.

Amana Cooperative Insurance Company may process your personal information for our legitimate interests, when we have a business reason to do so.

Our reasons for processing your personal information include:

  • Providing insurance services and products
  • Accessing customer details from government portals
  • Calculating insurance premiums
  • Assessing and managing risks
  • Claims processing and management
  • Compliance with legal and regulatory obligations
  • Fraud prevention and detection
  • Customer service and communication

The legal basis for processing your personal data of our customers includes:

  • The informed consent of an individual
  • Performance of a contract to which our customers are party
  • Compliance with legal obligations
  • Legitimate interests pursued by us or third parties

These processes are executed with strict adherence to established protocols and regulatory guidelines, underscoring our commitment to the secure and compliant handling of sensitive data about clients, shareholders, and employees.

In cases where Amana Cooperative Insurance Company is required by regulatory bodies to process data for a purpose other that what it was collected for, Amana Cooperative Insurance Company shall comply with Article (10) Point (7) from personal data protection law, which states that we may process your personal data to achieve legitimate interests of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed.

4. The Use of Your Personal Data

Company collects and uses your personal information to carry out the transactions you have requested and to operate and improve its website.

These uses may include providing you with more effective customer service and making the Services more user-friendly by removing the need to repeatedly enter the same information and conducting research and studies aimed at improving and developing our products and services.

We also use your personal information to communicate with you. We may send you certain messages such as welcome letters, payment Due Notifications, information related to your insurance contracts, offer materials and products.

We may from time to time send you product or service surveys and promotional emails to inform you of other products or services currently available at Amana based on your consent.

5. Exemptions for Disclosure of Personal Data

As per the laws and regulations within Saudi Arabia, Amana Cooperative Insurance Company shall not disclose your personal data unless the following conditions are met:

  • Data Subject consents to the Disclosure in accordance with the provisions of the Law.
  • The personal Data has been collected from a publicly available source.
  • The entity requesting Disclosure is a Public Entity, and the Collection or Processing of the Personal Data is required for public interest or security purposes, or to implement another law, to fulfill judicial requirements.
  • The Disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals.
  • The Disclosure will only involve subsequent Processing in a form that makes it impossible to directly or indirectly identify the Data Subject.
  • The Disclosure is necessary to achieve legitimate interests of Amana Cooperative Insurance Company, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed.

However, Amana Cooperative Insurance Company may not disclose your personal data in the situations stated above if the disclosure:

  • Represents a threat to security
  • Harms the reputation of the Kingdom
  • Conflicts with the interests of the Kingdom
  • Affects the Kingdom’s relations with another state
  • Prevents the detection of a crime
  • Affects criminal procedures
  • Compromises the safety of an individual
  • Violates privacy of another individual
  • Violates professional obligations
  • Involves a violation of legal obligations or judicial decisions
  • Exposes confidential sources of information

6. Data Sharing and Transfers

We may share your personal data with the following entities:

  • Regulatory authorities (e.g., Insurance Authority) as required by law
  • Third-party service providers who assist us in providing our services
  • Reinsurance companies for risk assessment and management

We ensure that any third parties who process your data on our behalf provide sufficient guarantees to implement appropriate technical and organizational measures to meet PDPL requirements, as outlined in Article (17) of the Regulations.

7. Purposes and Legal Basis for Processing

By law, we must have a legal justification to process your personal information for the purposes described in this privacy notice.

We collect personal information to provide our quotes, products and services to you. We do this to enter into and / or perform the insurance contract with you. This includes arranging, underwriting and managing our products and handling claims in accordance with the terms of the policy.

As a regulated insurance services organization, we are required to comply with legal and regulatory obligations. This includes meeting responsibilities we have to our regulators, tax officials, law enforcement and any other legal responsibilities we have, such as the prevention, detection and reporting of fraud and other financial crime.

We may process personal information for our legitimate interests, when we have a business reason to do so.

We will also need your consent to be able to process your personal data for the following purposes:

  • Providing insurance services and products
  • Accessing customer details from government portals
  • Calculating insurance premiums
  • Assessing and managing risks
  • Claims processing and management
  • Compliance with legal and regulatory obligations
  • Fraud prevention and detection
  • Customer service and communication

The legal basis for processing your personal data includes:

  • Your consent
  • Performance of a contract to which you are a party
  • Compliance with legal obligations
  • Legitimate interests pursued by us or third parties

8. Data Minimization and Accuracy

We collect only the minimum amount of information necessary to provide our services and fulfill our legal obligations.

We ensure this by only collecting the data necessary to access your information directly from government portals.

We also take steps to ensure that the personal data we process is accurate, complete, and kept up-to-date, including regular retrieval of data from government portals.

9. Data Storage & Destruction

All personal data related to customers is stored in our database.

Your personal data is not transferred outside the Kingdom of Saudi Arabia for any purpose without the approval of the Insurance Authority.

In accordance with the regulatory requirements outlined in the Insurance Market Code of Conduct Regulation published by the Kingdom of Saudi Arabia (Insurance Authority), we are required to retain your data for 10 years.

After this period, we will securely delete or anonymize your data unless we are required to keep it longer for legal or regulatory reasons.

Should you decide to prematurely end your policy, your data will be stored for a period of 10 years, in line with the requirements outlined by Insurance Authority and SDAIA, after which it shall be deleted.

Once the 10-year period is over, we shall ensure that all of your personal data is removed from any and all systems in which it may have been stored unless we are required to keep it longer for legal or regulatory reasons.

10. Data Subject Rights

All data subjects in the Kingdom of Saudi Arabia have the following rights regarding their personal data:

  • Right to be informed about the collection and use of your personal data
  • Right to access your personal data
  • Right to request copies of your personal data in a readable and clear format
  • Right to request correction, completion, or updating of your personal data
  • Right to request deletion of your personal data (subject to retention requirements, as mentioned in Section 9)
  • Right to withdraw consent at any time
  • Right to object to processing based on legitimate interests
  • Right to data portability

To exercise these rights or make a request, please contact our Data Protection Officer at:

Privacy@amana-coop.com.sa

We shall, upon receiving your request regarding your rights, as stipulated in the Law, do the following:

  • Act on your request exercising your rights under the Law within a period not exceeding (30) days and without delay.
  • This period may be extended in case the implementation requires disproportionate effort, or if we receive multiple requests from you, provided that the extension period does not exceed an additional (30) days and that you are notified in advance with the reasons for the delay.
  • Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising your rights.
  • Take appropriate measures to verify your identity before executing the request in accordance with legal requirements.
  • Take the necessary measures to document and keep record of all received requests including oral requests.

While you as a data subject have the right to withdraw consent for the processing of your personal data at any time, this will mean the cancellation of any services provided by Amana Cooperative Insurance Company related to the processing of that personal data.

You as a Data Subject must also note that while processing activities may stop, your data must still be stored for a period of 10 years as required by Insurance Authority.

As defined in the Law, we may refuse a Data Subject Right’s request when it is repetitive, manifestly unfounded, or requires disproportionate efforts, in which the Data Subject shall be notified of such reason.

In cases where you, as the Data Subject, fully or partially lack legal capacity, your legal guardian shall exercise your rights on your behalf.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

These measures include:

  • Encryption of personal data
  • Regular security assessments and audits
  • Access controls and authentication measures
  • Employee training on data protection and security

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or for legal reasons.

We will notify you of any material changes and obtain your consent where required.

13. Complaints

If you have any concerns about how we handle your personal data, you can contact our Data Protection Officer.

You also have the right to lodge a complaint with the Insurance Authority.

14. Consent

To use our services, you must consent to the collection and processing of your personal data as described in this Privacy Notice.

You have the right to withdraw your consent at any time, although this may affect our ability to provide certain services to you.

You must also separately provide consent if you would like us to contact you with advertisements about services and awareness materials.

15. Opt Out

If you no longer wish to receive correspondence, emails, surveys, awareness materials, or other communications from us, you may opt-out by:

  • Logging into your account settings and updating your preferences through:

www.amana.sa

  • Contacting us using the DPO by the email provided below:

Privacy@amana-coop.com.sa

Feel free to contact us — our team is ready to assist you.

You may submit a request through any of the following channels:

  • Online: Complete the complaint form below and click Submit
  • Email: customercare@amana-coop.com.sa
  • Call Center: 8001240242
  • Social Media (X Platform): @amanasaudi

Next Steps:

You will receive a request reference number once you submit your request through our channels. You can follow up with us using this reference for any update. We aim to address all requests within five (5) working days, though some complex cases may take longer.

To help us serve you efficiently, please provide:

  • Full Name
  • Policy or Claim Number (if applicable)
  • Contact Information (mobile number and email)
  • Category (e.g., Motor, Medical, Home, etc.)
  • Description of the issue and any supporting documents

If you are dissatisfied with our final response or dissatisfied with any delay in our response (beyond 5 working days), you may refer your complaint to the insurance regulator.