Privacy Policy
Last Updated:
Introduction
Alqimma alhama Company For financial technology "known as Vrtx"(hereinafter referred to as the "Company") is a Saudi company licensed by the Saudi Central Bank (SAMA) to provide digital financial services and to enable businesses to offer financial products to their beneficiaries through their own platforms. The Company operates as the issuing and operating entity for these services and bears full regulatory responsibility toward SAMA for all services provided.We at the Company respect the privacy of all our customers — whether businesses we contract with, or individuals, or legal entities who use our digital services — where all data is managed exclusively by the Company in its capacity as the data controller and processor under its regulatory licence and in accordance with the laws of the Kingdom of Saudi Arabia. We process your personal data (“Personal Data”) in accordance with the provisions of the Personal Data Protection Law, its Implementing Regulation, and related regulations and instructions.
This Privacy Policy constitutes an integral part of your agreement with us, and applies to you whether you are using our electronic wallet services as an individual user or a merchant, as well as to any person authorised to access and manage a merchant wallet account and related services, and any person who accesses, operates, or uses such accounts (collectively "Customers").
This Policy explains how personal data is collected, used, stored, processed, and shared when you use our services.
Your continued use of the services after reading this Policy constitutes your explicit and binding consent to its terms, while you retain all your statutory rights set out herein.Definitions
For the purposes of this Policy, the following words and phrases shall have the meanings shown opposite each of them, wherever they appear, unless the context requires otherwise:
The Company: Alqimma alhama Company For financial technology "known as Vrtx" (a Closed Joint Stock Company)
The Platform: The website, applications, and digital channels operated by the Company through which it provides its services
The Services: The digital financial services and technical solutions the Company provides to its customers through its platforms or digital channels
The Customer: Any natural or legal person who uses or benefits from the Company's services, including beneficiaries, merchants, and persons authorized to access or manage customer accounts or use related services
Personal Data: Any data — regardless of its source or form — that identifies an individual specifically, or makes them identifiable, directly or indirectly, in accordance with the provisions of the Personal Data Protection Law
Data Subject: The person to whom the personal data being processed relates
Processing: Any operation performed on personal data by any means, including collecting, recording, saving, organizing, storing, amending, updating, using, sharing, transferring, disclosing, restricting, destroying, or any other operation performed on itData Controller: The Company, as the entity that determines the purposes and means of processing the personal data collected through the Platform
Data Processor: The Company, or any other entity engaged or contracted to process personal data, in whole or in part, on behalf of the Company, in accordance with applicable regulations and controls
Know Your Customer (KYC): The set of procedures and measures taken by the Company to verify the identity of the customer and the beneficial owner and any legal representative — if any — and to understand the nature and purpose of the relationship, through information and documents provided by the customer and information obtained from official or relevant authorities or approved electronic linkage systems, enabling the Company to assess the associated risks
Know Your Business (KYB): The set of procedures and measures taken by the Company to verify the identity of legal-person customers, confirm their legal existence, ownership structure, and beneficial owner, and identify their legal representatives, and to understand the nature of their activity and the purpose of the relationship, through information and documents they provide and information obtained from official or relevant authorities or approved electronic linkage systems, enabling the Company to assess the associated risks
SAMA: The Saudi Central Bank
Personal Data We Collect
We collect only the data necessary to provide our services securely and in compliance with applicable regulations. Data is collected directly from Customers or their authorised legal representatives, or through regulatory authorities or approved verification service providers, and includes, without limitation, the following:Individual Users
We may collect your personal data directly from you, including, without limitation, the following:
Basic data such as: full name, email address, national ID or residency card (Iqama), residency status, passport number, nationality, mobile phone number, national address, date of birth, and current location.Employment information such as: salary, sector of employment, cash income, cash spending patterns, income and expenditure information, and related documents.
Credit and financial information such as: credit card data, bank account, data on financial products or debts, credit score, and credit performance.
Biometric data such as: fingerprint and facial recognition, used for identity verification and secure access to the service after obtaining the explicit consent of the data subject.
Transaction- and account-related data such as: account details within the application, and information you enter or provide when using the application.
Identity verification results from national databases and electronic verification providers.
Results of screening against prohibited/sanctions lists issued by local and international authorities.
Merchants and Authorized Representatives
We may collect personal data relating to the merchant or authorized representative directly upon creation or use of the merchant portal, including, without limitation, the following:Identification and regulatory data such as: commercial registration, unified national ID, registration with the General Organization for Social Insurance (where applicable), tax numbers, and the basic identifying data of the merchant's authorized representative.
Employee information necessary to provide the services offered by the Company, such as: name, job title, mobile phone number, national ID, passport number, and account details (where applicable).
Credit and financial information such as: credit card data, bank account, data on financial products or debts, credit score, and credit performance.
Biometric data such as: fingerprint and facial recognition, used for identity verification and secure access to the service after obtaining the explicit consent of the data subject.
Transaction- and account-related data such as: account details within the application, and information you enter or provide when using the merchant portal.
Customer and supplier information relating to your business transactions, to the extent necessary to provide the services offered by the Company.
Identity verification results from national databases and electronic verification providers.
Results of screening against prohibited/sanctions lists issued by local and international authorities.
Technical and Usage Data
The Company may collect technical data to improve platform performance and ensure its security and stability. This includes: IP address, device type and operating system, login records and usage patterns, pages visited and browsing duration, and keywords used within the platform. This data is used to analyse technical performance, monitor issues, and detect unauthorised access attempts.Support and Communication Data
Collected when you contact the Company's support team, including: the content of messages and conversations, the date, time, and subject of the request, and any documents or images uploaded to support the query or request.Marketing Data and Preferences
Based on customer consent, the Company may collect data related to communication and marketing-message preferences, including subscription to messages and offers, preferred communication channels, interests, survey results, and unsubscribe preferences, with the aim of improving the customer experience and providing content and services suited to their interests.
How We Collect Your Data
The Company applies the principle of data minimisation when collecting personal data in the course of service delivery, in accordance with governance and transparency standards. Data may be collected through the following methods:Directly from Customers
At registration and account or wallet opening; when submitting identity verification requests (KYC/KYC-B); when using platform services such as transfers, card requests, and or any other services the Company provides through the Platform ; and when contacting the customer support team for any technical or operational purpose.Automatically upon use of the Platform
Through cookies and tracking technologies, usage and activity logs within the application, device data and IP address upon login or completion of any transaction, activity monitoring and fraud and money laundering prevention, or for performance analysis and security stability.From Regulatory Authorities and Approved Service Providers
Such as national databases for identity verification, providers of local and international prohibited list screening services, and correspondent banks and card networks when processing transfers and payments.From Business Customers
When registering new customers through the platform for onboarding purposes, provided that the business customer must ensure that the necessary consents are obtained before submitting any data to the Company.
Accuracy of Personal Data
You agree and undertake to provide us with accurate, complete, up-to-date, and appropriate personal data for the purpose for which it was collected. We will take reasonable steps to ensure the accuracy, completeness, currency, and appropriateness of your personal data; however, we will not be responsible for any inaccuracy, incompleteness, outdatedness, or unsuitability of that data - whether resulting from an error or omission on your part - unless attributable to an error or omission on our part.Purposes of Collecting and Processing Data
The Company collects and processes personal data for lawful and legitimate purposes aimed at enabling it to deliver its services effectively and securely, and ensuring compliance with applicable regulations. These purposes include:Digital Wallet Issuance and Financial Services Management: to open and manage digital wallets for Customers, issue virtual and physical cards, process domestic and international financial transfers, execute payroll disbursements through the Wage Protection System, and assign Virtual IBANs to each wallet.
Verification and Regulatory Compliance: to verify Customer identity and implement Know Your Customer (KYC/KYC-B) requirements, Anti-Money Laundering and Counter-Terrorism Financing (AML/CFT) requirements, and prohibited list screening; to maintain financial records in accordance with regulatory authority instructions; and to submit mandatory reports to SAMA.
Security Enhancement and Customer Protection: to detect suspicious activities and prevent fraud, to secure accounts and wallets using encryption and multi-factor authentication, and to monitor transactions to ensure the safety of funds and data.
Customer Relationship Management: to send notifications relating to transactions, regulatory and security updates, to respond to enquiries and process technical support requests, and to provide Customers with information about their services and balances.
Marketing Purposes (with Customer's explicit consent only): to send offers and updates about new services, and to conduct opinion surveys and measure Customer satisfaction. You have the right to withdraw your consent to this purpose at any time without affecting the processing of your data for operational or regulatory purposes.
Legal Basis for Processing Data
Personal data is processed on the basis of lawful grounds recognised by the Personal Data Protection Law (PDPL) and the regulations of the Saudi Central Bank (SAMA). These grounds include:Explicit Consent: when collecting biometric data, sending marketing communications, or sharing data with third parties for non-operational purposes.
Contractual Performance: when opening wallets, issuing cards, processing transfers, executing payroll, and processing invoices and fees.
Legal and Regulatory Obligation: to implement KYC/KYC-B procedures, comply with anti-money laundering and counter-terrorist financing requirements, mandatory reporting to SAMA, and compliance with orders from judicial and regulatory authorities.
Legitimate Interest: to prevent fraud, protect the platform and technical infrastructure security, and improve services delivered — provided such interest does not conflict with your fundamental rights and freedoms.
Protection from Serious Harm: where a documented security threat requires disclosure of data.
Public Interest / Security Considerations: personal data may be processed where necessary to serve a public interest or for security reasons, in accordance with the Applicable Laws and the requirements of the competent authorities.Vital Interest: personal data may be processed where necessary to protect the life or vital interests of the data subject, in situations where obtaining their consent is impossible or impracticable.
The Company confirms that it does not process data for any other purposes not authorised under applicable law. You have the right to withdraw your consent where processing is based on it, without affecting the lawfulness of processing carried out prior to withdrawal.
Provision of Personal Data
The provision of personal data we request from you is mandatory for the Company to be able to provide the Wallet Services to you. Accordingly, failure to provide such personal data for the purposes referred to above will prevent the provision of the relevant services or may affect service quality, which may lead us to decline to execute any request, instruction, or to provide that service.The provision of certain data relies on sources approved by government authorities (such as the National Information Centre, Elm, and SIMAH), and your involvement in providing that information is therefore limited. Should verification of such data prove impossible, we may be unable to grant you access to the wallet account or certain other services.
Display of Account Name and Consent
With your consent, the Company may display your account holder name to other parties involved in a transaction, including payment recipients, billers, and payment request recipients, or to complete financial transactions or regulatory procedures.Your acceptance of this Policy constitutes your explicit consent to the display of your name in the course of providing our services to you. If you wish to withdraw your consent, we will stop displaying it in future transactions, and you may manage your consent preferences by contacting our technical support.
Sharing and Disclosure of Data
The Company maintains the confidentiality and security of data and does not share or disclose it except in cases permitted by applicable law or expressly agreed with Customers, and only to the extent necessary to deliver the services, as follows:Saudi Central Bank (SAMA): to submit mandatory regulatory reports and respond to investigation or inspection requests. The Company is committed to immediately disclosing any data requested by SAMA pursuant to a formal order, and will notify the Customer of such disclosure to the extent permitted by law.
Card Networks and Correspondent Banks: to process card transactions through Mada, Visa, and Mastercard networks, and to execute international transfers through correspondent banks, using only the minimum data necessary to complete the transaction.
Identity Verification Service Providers: to conduct KYC checks, electronic identity verification, and prohibited list screening, in accordance with SAMA requirements.
Contracted business customers: necessary personal data may be shared with contracted business customers to the extent necessary to provide services or complete transactions, including certain identification or contact data where applicable, limited to the data necessary to achieve the purpose of sharing, in accordance with applicable regulations.
Judicial and Security Authorities: in response to judicial orders or formal investigations issued by competent authorities, and only to the extent required by those orders.
Technology and Cloud Service Providers: to operate the platform and store data securely within the Kingdom of Saudi Arabia exclusively. These providers are required to sign strict data processing and confidentiality agreements.
Professional Service Providers: data may be disclosed to entities providing professional or advisory services, including accounting, legal, tax, and financial consulting services.
Platform-Related Service Providers: data may be disclosed to companies providing services on behalf of the Company in connection with the operation of the Application, including data analysis, payment services management, and marketing activities.
Sharing Data with External Parties Outside the Kingdom
For the purposes of providing payment services to you, personal data may be shared with recipients outside the Kingdom of Saudi Arabia, provided that: (1) data transfers are conducted in accordance with the Applicable Laws; and (2) the recipients act as data processors or independent data controllers. In all cases, we ensure that an adequate level of protection is maintained and that all data transfers are carried out lawfully.
Third-party websites or applications are not subject to the Company's control or the provisions of this Policy. Customers are advised to review the privacy policies of those parties before submitting any personal data.
Transfer of Data Outside the Kingdom of Saudi Arabia
The Company is committed to the data localisation principle in accordance with the Personal Data Protection Law and SAMA regulations. Accordingly, all Customer data is stored exclusively within the borders of the Kingdom of Saudi Arabia and is not transferred abroad except in cases strictly required by international remittances, where the data transferred is limited to the minimum necessary to execute the transaction. Any potential international transfer is subject to adequate protection guarantees that satisfy applicable regulatory requirements. and after satisfying the necessary statutory safeguards and obtaining the required approvals where applicable.Access to Your Data and Your Statutory Rights
The Saudi Personal Data Protection Law guarantees you a set of rights that the Company is committed to respecting and facilitating:Access to Personal Data
You have the right to access the personal data held by the Company about you and to obtain a copy, by logging into your account and viewing account details, transactions, and activity records.Rectification and Update of Data
You have the right to request correction or amendment of any inaccurate, incomplete, or outdated personal data. You may update most of your data directly through your account settings; if assistance is needed, please contact the support team. The Company reserves the right to verify your identity before making any amendment. If a request is refused on regulatory grounds, you will be notified of the reasons within a reasonable period.Request for Deletion or Restriction of Processing
Right to Erasure: you have the right to request deletion of your personal data in the following cases: if the data is no longer necessary for the purpose for which it was collected; if you withdraw your consent and there is no longer any other legal basis for processing; if the data was collected in a manner contrary to applicable law; or if the account has been permanently closed with no legal obligation requiring retention.
Right to Restriction of Processing: you have the right to request limitation of processing if there are objections to the accuracy of the data pending review; if the processing is unlawful and you prefer restriction rather than deletion; or during the period of consideration of an objection submitted by you.
Exceptions: the Company reserves the right to refuse deletion or restriction where the law or regulatory authority requires retention, where retention is necessary for legal, financial, or audit purposes, or where the data relates to financial transactions or contractual obligations not yet completed. In the event of refusal, the applicant will be notified of the legal grounds and the applicable retention period.
Right to Object: you have the right to object to the processing of your data for marketing purposes or on the basis of legitimate interest.
Right to Data Portability: you have the right to request the transfer of data you have provided with your consent to another party, in accordance with applicable statutory provisions.
Right to Compensation for Material and Moral Damages: you have the right to bring a claim before the competent court to seek compensation for any material or moral harm resulting from a violation of the provisions of the Personal Data Protection Law.
Right to be Informed of the Legal Basis: you have the right to request information relating to the purposes and legal basis pursuant to which your personal data is processed.
Right to Lodge a Complaint: you have the right at any time to contact the Saudi Central Bank "SAMA Cares" for customer complaints at 8001256666 or through the website www.sama.gov.sa. You may also contact the Saudi Data and Artificial Intelligence Authority (SDAIA) as the supervisory body for personal data protection.
How to Submit Requests
You may submit any request to exercise your rights by email to: [privacy@vrtx.sa], including: your full name, national ID number or commercial registration number, a brief description of the request, and a contact method for the response. The Company will respond within fifteen (15) working days of receipt, unless an additional period is required for regulatory reasons, of which the applicant will be notified.Storage and Destruction of Data
The Company is committed to collecting only the data necessary to operate its services and processes and stores it to the highest standards of protection and security, in accordance with the Cybersecurity Framework issued by the Saudi Central Bank and the requirements of the Saudi Personal Data Protection Law.The Company stores data in secure, isolated environments on servers located within the territory of the Kingdom of Saudi Arabia, and applies comprehensive technical, organisational, and administrative measures to protect it from unauthorised access, use, modification, disclosure, or destruction. Security measures applied include: full data encryption in transit and at rest in accordance with the highest security standards; round-the-clock system monitoring; periodic penetration testing; restricting access to authorised personnel bound by confidentiality obligations; and prohibiting storage of data on portable devices or removable media except under strict encryption controls.
The Company maintains accurate electronic records of all data processing operations and account activity to ensure security, compliance, and the ability to audit and trace procedures when required by competent regulatory or judicial authorities.
In the event of any data breach affecting your personal data, the Company is committed to notifying you as soon as possible upon discovery of the breach, and notifying the competent regulatory authorities in accordance with the applicable statutory procedures.
Data Retention Period
The Company retains personal data for the period necessary to achieve the purpose for which it was collected and not exceeding the statutory retention period required by applicable Saudi regulations.
Following permanent account closure or termination of the contractual relationship, the Company retains the minimum data necessary for regulatory compliance, unless a competent regulatory or judicial authority requires a longer period or data must be frozen pending an ongoing dispute or formal investigation. .After permanent account closure or termination of the contractual relationship, the Company retains the minimum data necessary for regulatory compliance, unless a competent regulatory or judicial authority requires a longer period or data must be frozen pending an ongoing dispute or formal investigation. Upon expiry of the retention period or based on an accepted deletion request, we follow the following procedures:Secure Erasure: deletion of data from all systems permanently and irrecoverably.
Anonymisation: if complete deletion is not possible for technical or regulatory reasons, the data subject's data is anonymised such that re-identification becomes impossible.
We will not be able to comply with a deletion request if it conflicts with our regulatory, supervisory, or legal obligations or impedes the provision of evidence required in any ongoing legal dispute.
Cookies
The Company's platform uses cookies to improve the user experience and ensure the platform operates efficiently and securely. These are small text files stored on your device when you visit the platform. They are necessary for platform operation, maintaining the user session, and enabling login and completion of transactions, and cannot be disabled without affecting core platform functions. There are also cookies to save your preferences and settings and personalise your experience, or to analyse how users interact with the platform and improve overall performance, or to detect suspicious activities and prevent unauthorised access attempts.Cookies are not used for marketing purposes except with your explicit consent, and are not shared with any third party for commercial or advertising purposes. You may manage cookies through the platform settings or your browser, noting that disabling strictly necessary cookies may affect some core platform functions.
Your continued use of the platform after the cookie notice appears constitutes implicit consent to the use of strictly necessary cookies.
External Links
The Platform may include links to third-party websites, applications, or services. These links are provided to facilitate access to related services or information. The Company bears no responsibility for the content, privacy practices, or data-processing methods followed by such external websites or platforms. Any use by a user of such external links or services is at their own personal responsibility and is subject to the policies and terms adopted by those parties.Legal Eligibility to Benefit from the Services
The services provided through the Platform are directed at persons who are legally eligible to benefit from them. The Company does not target the collection of personal data of legally ineligible persons independently, except through a guardian, custodian, or legal representative, and where this is necessary and permitted by regulation. If the Company determines that personal data of a legally ineligible person has been collected without an appropriate justification or legal basis, it will take the necessary measures to address this in accordance with applicable regulations and instructions.
Where it is necessary to process the data of a legally ineligible person, the Company may request proof of the capacity and authority of the guardian, custodian, or legal representative before collecting or processing the data.Automated Decision-Making
The Company may use automated systems to make certain decisions relating to Customers, including: accepting or rejecting onboarding requests based on automated KYC screening results; detecting suspicious transactions and flagging them automatically for review; and determining the risk level of transactions and accounts. You have the right to request manual review of any automated decision that materially affects you, by submitting a request to the compliance team by email: [privacy@vrtx.sa]Policy Updates
The Company reserves the right to amend or update this Policy from time to time in line with technical developments or regulatory and legislative changes. The Company is committed to notifying Customers of any material updates at least thirty (30) days before they take effect, via the registered email address or through a notice within the platform. Amendments take effect from the date of their publication.
Your continued use of the services after the notification period has lapsed constitutes implicit consent to the Policy in its updated form. Customers are advised to review the Policy periodically to stay informed of the latest updates.
Contact and Data Protection Officer
The Company is committed to responding to privacy enquiries and requests to exercise rights within fifteen (15) working days of receipt. To contact the Data Protection Officer:Email: [privacy@vrtx.sa]
Postal address: Prince Khalid bin Bandar Rd, An Narjis District, Kingdom of Saudi Arabia
Working hours: Sunday – Thursday, 9:00 AM – 5:00 PM (Riyadh time)
If you are dissatisfied with the response or the action taken, you have the right to lodge a formal complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority for the oversight of personal data protection in the Kingdom of Saudi Arabia.
Governing Law
This Policy is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its implementing regulations, the regulations and rules of the Saudi Central Bank (SAMA), the Anti-Money Laundering and Counter-Terrorism Financing Law, and any other applicable Saudi regulations and rules. The judicial and supervisory authorities in the Kingdom shall have jurisdiction to consider any dispute arising in connection with this Policy in accordance with the relevant regulations.Acknowledgment and Consent
Your review of this Privacy Policy constitutes an acknowledgment and consent to the collection and processing of your personal data in accordance with the provisions set out herein and the Applicable Laws.