Data Privacy Policy

Last Modified Date: July 12, 2026

Daikin Air Conditioning Saudi Arabia, LLC. CR number 1010396723 P.O Box 14949, Riyadh 11434, AlSahafa District , Alsahafa Centre, 1st Floor, Office 12, (referred to as “DKSA” or "Daikin Saudi Arabia" or “we” or “our” or the “Company”) a registered company of the Kingdom of Saudi Arabia, is part of the Daikin Europe Group (DENV-G).

Daikin Saudi Arabia is committed to protecting the personal data collected from data subjects (the "User" or the "Data Subject"), whether such data is collected by:

Paper forms prepared for this purpose or contracts.
Online, through the www.daikin-ksa.com Website (the "Website").
Through DKSA's applications, software, or other digital tools (the "Applications").

This Data Protection Policy, issued in compliance with the Saudi Data and Artificial Intelligence Authority (“SDAIA”), aims to achieve many principles in accordance with the Saudi Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443 H, and amended by Royal Decree No. (M/148) dated 5/9/1444 H, and its Executive Regulations.

The protection of personal data is our top priority, and we seek to process it in a lawful, secure and transparent manner, in accordance with the regulations in force in the Kingdom of Saudi Arabia.

Please read this Data Protection Policy carefully, including the key terms contained therein, and if you have any queries or feedback, please contact us at DataProtection@daikin-ksa.com.

Definitions

Regulator means any government entity or independent public legal entity that assumes regulatory or supervisory functions and responsibilities for a particular sector in the Kingdom of Saudi Arabia based on a statutory document.

Office means National Data Management office .

Daikin Saudi Arabia is subject to the provisions of the Saudi Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H, and its Executive Bylaws and any subsequent relevant legislation.

1) Data Controller's Obligations ("Liability")

As part of our commitment to uphold robust standards of data protection, DKSA undertakes a range of processing activities essential to the operation and continuous improvement of our applications and related services. These activities are designed to ensure that personal data is handled responsibly, transparently, and in strict accordance with the prevailing legal and regulatory frameworks in the Kingdom of Saudi Arabia. Our data processing practices encompass the collection, use, storage, and sharing of personal information, each governed by clearly articulated policies and reinforced by comprehensive safeguards. The following outlines the main obligations and procedures that guide our approach to data processing and protection:

1.1 Preparing and implementing policies and procedures related to the protection of personal data, and the first official of the entity – or his delegate – shall be responsible for approving and approving them.

1.2 Establishing a Data Governance Unit or that is responsible of developing, documenting and monitoring the implementation of the policies and procedures approved by the senior management in the entity, provided that the tasks and responsibilities of the Unit include setting the appropriate standards to determine the levels of sensitivity of personal data.

1.3 Assess the risks and potential impacts of personal data processing activities and present the results of the assessment to the Entity's senior official – or his delegate – to determine the level of risk acceptance and acknowledgement.

1.4 Review and update contracts, service level agreements, and operating agreements in accordance with the privacy policies and procedures approved by the entity's senior management.

1.5 Prepare and document the necessary procedures to manage and address privacy violations and define the tasks and responsibilities related to the competent work team, and the cases in which the regulator and the office are notified according to the administrative hierarchy – based on the measurement of the severity of the impact.

1.6 Preparing awareness programs to promote a culture of privacy and raise awareness in accordance with the privacy policies and procedures approved by the entity's senior management

1.7 Notify the data subject in an appropriate manner at the time of data collection of the purpose, legal basis/actual need, means and methods used to collect, process and share personal data as well as security measures to ensure the protection of privacy in accordance with the applicable laws, regulations and policies in the Kingdom.

1.8 Notify the data subject of other sources that are used if additional data is collected indirectly (from third parties).

1.9 Provide the data subject with the available choices regarding the processing of personal data and the mechanism used to exercise them ( e.g., communication preferences, its frequency,, Opt-in or Opt-out).

1.10 Obtaining the consent of the data subject to the processing of personal data after determining the type of consent (express or implied) based on the nature of the data and the methods of collecting it.

1.11 Ensure that the purpose of data collection is compliant with applicable laws, regulations and policies in the Kingdom and is directly related to the entity's activity.

1.12 Ensure that the content of the data is limited to the minimum data necessary to achieve the purpose for which it was collected.

1.13 Restriction of data collection on pre-prepared content as stated in provision (1.12) must be transparent ( e.g., direct, clear, secure, and free from deception or deception).

1.14 Ensure that the data is used only for the purpose for which it was collected.

1.15 Prepare and document data retention policy and procedures in accordance with the specified purposes and relevant regulations and legislation.

1.16 Storing and processing personal data within the geographical boundaries of the Kingdom to ensure the preservation of the national digital sovereignty of such data, and may not be processed outside the Kingdom without obtaining written approval from the regulator, after coordination between the regulator and the office.

1.17 Prepare and document a data retention policy and procedures to destroy data in a secure manner that prevents its loss, misuse, or unauthorized access , including operational, archived, and backup data , as issued by the National Cybersecurity Authority.

1.18 Include the terms of retention and disposal policies in contracts if these tasks are outsourced to other processors.

1.19 Identify and provide the means by which the data subject can access his personal data in order to review and update it.

1.20 Verifying the identity of individuals before granting them access to their personal data in accordance with the controls approved by the National Cyber Security Authority and the competent authorities.

1.21 It is prohibited to share personal data with third parties except for the purposes specified after the consent of the data subject and in accordance with the laws, regulations and policies, provided that the third parties are provided with the privacy policies and procedures followed and incorporated into contracts and agreements.

1.22 Notify the data subjects and obtain their consent in the event that the data is shared with other parties for use for purposes other than the specified purposes.

1.23 Obtaining the approval of the office, after coordinating with the regulatory authority , before sharing personal data with other entities outside the Kingdom.

1.24 Prepare, document and apply the necessary procedures to ensure the accuracy, completeness, up-to-date and relevance of personal data to the purpose for which it was collected.

1.25 The administrative controls and technical measures adopted in the Authority's information security policies are used to ensure the protection of personal data, including but not limited to:

1.25.1 Granting access to data according to the tasks and responsibilities of employees in a way that prevents overlapping jurisdiction and avoids dispersion of responsibilities.

1.25.2 Implement administrative procedures and technical measures that document the stages of data processing and provide the possibility of identifying the user responsible for each of these stages (usage logs).

1.25.3 Employees who undertake data processing must sign an undertaking to preserve and not disclose data except in accordance with policies, procedures, regulations and legislation.

1.25.4 Selecting the personnel who undertake the data processing operations who are honest and responsible and in accordance with the nature and sensitivity of the data and the access policy approved by the entity.

1.25.5 Using appropriate security measures – such as encryption, isolating the development and testing environment from the operating environment – to secure and protect personal data in proportion to its nature, sensitivity and the media used to transmit and store it in accordance with the regulations issued by the National Cybersecurity Authority and the competent authorities.

1.26 Monitoring compliance with policies and privacy procedures periodically and presenting them to the Entity's Chief Officer – or his delegate – as well as identifying and documenting corrective actions to be taken in case of non-compliance and notifying the regulator and the Office according to the regulatory sequence.

2) Personal Data Controller

Please note that any personal data provided by you, whether through paper forms or through the website or applications designated for this purpose, will be used for the purposes specified in this policy by DKSA , based, AlSahafa District , AlSahafa Centre, 1st Floor, Office 12, Riyadh registered in the Kingdom of Saudi Arabia as the Data Controller.

Daikin Saudi Arabia's subsidiaries in the Kingdom are data controllers in relation to the processing of personal data collected through forms, via the website or through applications as independent legal entities.

3) Shared Controllers

It is possible that in the future, Daikin Saudi Arabia will jointly operate with its parent company, Daikin Europe N.V. (“DENV”) or any of its subsidiaries of the Daikin Europe Group (DENV-G) to determine the purposes and means of processing personal data as joint data controllers, under a written agreement, and (Daikin Saudi Arabia ) guarantees the provision of the minimum data protection in accordance with the Saudi Data Protection Law and the relevant regulations.

In such cases, the relevant data subjects are informed in advance of the nature of the joint data processing.

4) Processors

Daikin Saudi Arabia, as a data processor, may seek the assistance of its parent company or one of its subsidiaries inside or outside the Kingdom in connection with any processing of personal data (whether electronic or traditional), provided that there are written agreements for data processing in accordance with the provisions of the Law and its supplementary regulations.

Daikin Saudi Arabia may also act as a data processor on behalf of the parent company, under clear instructions stipulated in the processing agreements, and in accordance with the provisions of the Law and its supplementary regulations.

5) Personal data collected and the specific purposes for which it is collected

Daikin Saudi Arabia processes personal data throughout its full lifecycle — from collection to storage, use, and lawful transfer — strictly within the limits necessary for legitimate business purposes and in accordance with applicable Saudi data protection laws and their supplementary regulations.

Personal data may be collected directly from data subjects, whether through paper forms or electronically via website or applications, in the context of multiple activities including, but not limited to: browsing the website, using applications, filling out paper or electronic forms, reporting cases of non-compliance, communicating with Daikin Saudi Arabia, submit job applications, provide feedback (such as regarding forms, products, applications, websites, or customer service), or respond to surveys and other activities. Such personal data is subsequently:

Recorded and organized in secure systems for administrative, human resources, compliance, and customer service purposes;
Stored in accordance with applicable retention requirements;
Used and otherwise processed to respond to inquiries, evaluate job applications, provide services, improve products, ensure regulatory compliance, and manage customer relationships.

Where necessary, personal data may also be transferred to the parent company (DENV-G) or to subsidiaries, subject to appropriate written agreements and in compliance with Saudi data protection law and its implementing regulations.

6) Collection of Personal Data

The collection of personal data is either voluntary or mandatory, provided that in cases where data collection is mandatory, this must be explicitly clarified. In that case, if the data subject refuses to provide his data, Daikin Saudi Arabia will be unable to implement or follow up on the requested service or procedure. For example, if the data subject wishes to fill out a registration form, DKSA may need some personal information to process the registration application. If this mandatory information is not provided, Daikin KSA will not be able to accept or follow up on the application. In such cases, the data subject may has the right to choose whether to:

provide the requested data,
withdraw consent where applicable,
request access, rectification, or erasure of their data,
restrict or object to its processing, and
exercise opt-in/opt-out choices in line with the applicable law and Daikin KSA’s policies.

a) Consent

According to the Law, Daikin Saudi Arabia may collect or disclose personal data based on the consent of the data subject, whether it is (express/implied) consent, including written or verbal consents or using electronic methods, and it may also collect personal data without the need to obtain the consent of the data subject in the following cases:

When the processing benefits the data subject and it is impossible or difficult to contact the data subject.
Where the processing is under another law or in execution of a previous agreement to which the personal data subject is a party.
When the processing is necessary to achieve a legitimate interest unless it prejudices the rights of the personal data subject or conflicts with his or her interests and such data is not sensitive.

b) Personal data we collect from the user or from third parties

The user may be asked to provide us with various types of personal data, including: name, last name, date and place of birth, surname, address, telephone number, email, language, country, nationality, national ID or residence number, driver's license number, passport number, employer, job title, customer number, personal links to social media accounts, bank card details, preferences, interests, opinions or comments, depending on the specific purpose of each processing and to the extent necessary.

In some cases, the user may also be asked to provide us with sensitive personal data, which is (any personal statement related to an individual's racial origin, ethnicity, religious, intellectual or political belief, security and criminal data, biometric data that identifies him, genetic data, health data, and data that indicates that the individual is of unknown parentage or one of them). This data is processed in accordance with the system, based on:

The express consent of the data subject; or
the existence of a legal obligation or interest related to the rights of the data subject or the processor in the context of the Labour and Social Insurance Law; or
for the purpose of protecting a vital interest of the data subject; or
for legal purposes such as defending legal claims, or
the existence of a substantial public interest that requires treatment.

Daikin KSA may also use personal data made available to it by third parties, such as service providers, or data available from public sources such as data available on websites or blogs, or published in profiles on social media platforms, as long as this does not violate the law. In the course of mergers, acquisitions or restructurings, we may receive personal data collected from third parties within the Daikin Group.The collection of personal data is limited to the minimum amount of data that enables Daikin Saudi Arabia to achieve the purposes specified in (2.2)

c) Data collection of incomplete or incapacitated persons

DKSA does not collect or process any personal data belonging to individuals under the age of 18, nor does it make any commercial offers to them or attempt to communicate with them, unless the approval of the Sharia law is obtained, in accordance with the Personal Data Protection Law in the Kingdom, especially Article (13) of this Law.

d) Additional processing of personal data

Daikin KSA may carry out additional processing of personal data only in the following two cases:

If the purposes of the additional processing are compatible with the original purpose for which the data were collected,
If independent consent is provided for further processing for a new purpose that is not compatible with the original purpose of data collection.

7) Purposes for collecting personal data

Once the data is collected, it is used for the following purposes:

a) General Administration and Customer Service Management

Daikin Saudi Arabia is committed to the proper and regular execution of concluded contracts, and to fulfill all relevant regulatory obligations. Accordingly, the company needs some personal data provided by the data subjects, whether through paper forms, through the website or applications. In accordance with the Saudi Personal Data Protection Law, the consent of the data subject is not required if the processing is necessary for the purpose of:

Execution of a contract in which the data subject is a party, or the fulfillment of a statutory obligation of the Company.

In relation to customer relationship management and the provision of services to consumers, Daikin KSA uses personal data (e.g., name, country, nationality, email address, customer number, credit card information) to:

Assess the feasibility of selling products or services before concluding a contract;
Processing written orders from customers, purchase orders related to products and services, and cash-back requests
Identify and communicate with customers to offer discount offers,
Inform customers of consumer rights and ancillary services associated with the product or service purchased;
Informing customers about promotional campaigns and marketing events organized by Daikin Saudi Arabia, and sending relevant invitations,
Manage the procedures for customers to enter Daikin Saudi Arabia's premises , or access the website or its affiliated applications;
Organizing and implementing technical interventions and after-sales services for customers and installation technicians,
Inform customers of periodic maintenance appointments.

b) Purpose of Product Distribution

Daikin Saudi Arabia uses personal data for the purposes of product distribution, in order to perform a contract to which the data subject is a party, or to fulfill legal obligations, in particular in order to:

Enabling branches and subsidiaries within the Kingdom of Saudi Arabia to distribute products and provide services through authorized agents, local business partners, or through the company's website and applications;
Facilitate deliveries made through local distributors of products, parts and services, including the inclusion of personal data in delivery documents accompanying shipments, in a manner that does not conflict with the system;
Improving sales and service processes by providing customized and relevant offers to customers,
Develop and accelerate the distribution of products and services.
Follow-up of technical data related to the installation of devices and the implementation of projects.
Organize and deliver professional training programs for customers, installation technicians, and employees

c) Supplier Management

Daikin KSA uses personal data to keep records of suppliers and service providers, and to record and manage purchase orders, operating expenses, and invoices provided by suppliers or service providers, based on the performance of a contract or the fulfillment of a legal obligation, in accordance with the provisions of the Personal Data Protection Law in force in the Kingdom of Saudi Arabia.

d) Direct Marketing

Daikin KSA is able to provide you with personalized information and provide you with the right business solutions for you as a leading manufacturer and supplier of HVAC equipment, for example, Daikin KSA can inform you of services, offers and suggestions related to your purchase process through the use of your transaction details, which is known as "direct marketing".

Daikin KSA also uses the collected personal data, publicly available personal data (such as information available online, obtained through search results, or available on social media), or personal data obtained from third parties (such as Internet service providers), for the purposes of direct marketing and attracting new customers.

Daikin Saudi Arabia also conducts direct marketing activities to organize internal events, trips, presentations, and meetings for employees and customers.

Daikin Saudi Arabia does direct marketing through a variety of mediums including but not limited to mobile text messages, surveys, email, its website, online advertising, app base marketing, and events.

Daikin Saudi Arabia also conducts direct marketing activities based on its legitimate interest in achieving commercial objectives.

Daikin Saudi Arabia may carry out direct marketing activities based on the explicit consent of the data subject. If you do not wish to receive highly customized offers, you must not provide consent to direct marketing upon request, in addition to this, the personal data subject has the right to withdraw the consent to direct marketing, in which case the marketing materials will be discontinued.

Daikin KSA ensures that direct marketing information is presented in a clear and appropriate manner, using the means specified by the recipient to minimize the inconvenience produced.

e) Improving the quality of products and services

Daikin Saudi Arabia uses personal data collected through (forms, job applications, questionnaires, inquiries, comments, or feedback) submitted to Daikin or to other companies within Daikin Group, to:

Improving its products and services
Conducting additional surveys
Develop analytical, evaluative, marketing or other models
Setting up statistics

This is based on its legitimate interest in carrying out such business or based on the consent of the data subjects. Daikin Saudi Arabia also uses your transaction details to develop global models and conduct analytics.

Example: Daikin KSA may need to process the number of people who have purchased a particular Daikin product or applied for a particular service. In this context, Daikin Saudi Arabia is obliged to collect, to the extent possible, personal data anonymously or semi-anonymously to ensure that such data is not easily identifiable or completely de-identifiable.

The processing of personal data for statistical purposes is justified in particular by Daikin KSA's desire to make strategic decisions that contribute to improving its performance in the market and providing you with better products and services.

Personal data can also be used to evaluate, streamline and improve Daikin KSA's internal processes by improving campaigns, procedures, and sales through both online and offline channels, including the website, applications, or others.

Example: If you don't complete a specific action or purchase, we may contact you to find out why and if we can help you. In this case, we only provide technical and administrative support related to that process.

f) Recruitment and selection

Daikin KSA collects personal data about applicants for job vacancies, international training programs, or student training, such as name, email, phone number, biographical information, and social media account links, for the purposes of attracting talent. This processing is based on the fact that applicants voluntarily take steps to enter into a contract with Daikin KSA.

The personal data provided by applicants (by filling out forms or registering and creating a personal account on the website or through the applications) is also used for the purposes of processing job applications, communicating with applicants for activities related to human resources management, managing recruitment procedures such as inviting applicants for interviews and written tests, and preparing employment contracts.

The personal data of applicants who are not employed after the end of the selection process will be deleted one year from the date of their notification of non-acceptance, unless the applicant expressly requests that his/her data be deleted immediately after receiving the notification.

g) Human Resources and Payroll Management

Daikin Saudi Arabia uses personal data in the context of the performance of the employment contract for the purpose of managing personnel affairs, in particular to:

Manage and maintain records of employment contracts and payroll,
Pay salaries,
Keeping records of staff attendance, commuting, and training activities;
Communicating with health insurance companies,
Provide employees with insurance policies, company property, and performance-related benefits.

h) Accounting and Financial Records.

Daikin Saudi Arabia uses personal data in the context of the execution of the employment contract for the purpose of preparing accounting and financial records, and with the aim of:

Keeping transaction records,
Invoice sales and services provided;
Filling out tax returns and related forms to meet tax obligations;
Set up statistics based on transaction records (for example, see how many transactions have been made and their location);
Comply with applicable legislation and regulations at the national and international levels.

i) Legal claims and disputes.

Daikin Saudi Arabia or its representatives in judicial disputes before any judicial authority inside or outside the Kingdom may use personal data as evidence, for the purpose of establishing its rights, or to exercise/protect its rights, including, but not limited to, the Company's right to defend itself against acts of unfair competition, or its right to demand payment of unpaid invoices.

j) Combating fraud and crime.

Daikin Saudi Arabia may also use personal data to prevent, disclose or investigate cyber crimes and risks, based on a legitimate interest or at the request of a competent public authority.

k) Institutional and administrative work.

Daikin Saudi Arabia transfers or uses personal data collected jointly with DENV or other DENV-G companies, or its business partners, only when required and for the purpose of preparing periodic reports related to business results, business aspects, business plans, and corporate strategies. This processing is based on Daikin Saudi Arabia's legitimate interest in conducting its business activity.

Daikin Saudi Arabia also processes the personal data of its customers within the Kingdom of Saudi Arabia, including data lawfully collected by another Daikin Group company, unless there is a legal impediment to this (e.g. a commitment to confidentiality or a legal provision related to data protection).

Daikin Saudi Arabia is committed to taking all appropriate measures to protect personal data in relation to internal communications between the Group's companies, in accordance with the provisions of the Saudi Personal Data Protection Law.

l) Personal data obtained by Daikin Saudi Arabia through the website and/or applications:

When you visit the website or use the applications, Daikin KSA collects certain personal data for the following purposes:

1. Make the website or apps easier to use

Daikin KSA adapts the website or applications to suit your needs, by automatically collecting certain personal data, such as IP address, browser type, or through login information such as search queries and Wi-Fi geolocation, based on either the consent of the data subject or the company's legitimate interest and right to use cookies.

Daikin KSA also uses different types of cookies, such as: necessary cookies, functional cookies, social plug-in tracking cookies, third-party advertising, or first-party analytics.

Please refer to Daikin KSA's "Cookies Notice" for more information on what cookies are, their types, and what they are used for , click here.

2. Monitor the interests and preferences of data subjects

Daikin KSA may regularly and systematically monitor personal data of website or application users, using automated decision-making technologies/profiling technologies and cookies, through its website or applications, based on the explicit consent of the data subject or based on its legitimate interest.

This aims to analyze or assess certain usage-related aspects , such as website performance, user preferences, interests, behaviour, location, or timing of access, in order to improve services and user experience.

Further information on the use of cookies and related technologies is available in Daikin KSA's " Cookie Policy" for additional information click here.

8) Data Disclosure

DKSA may need the services, consultancy or support of third parties to carry out the above processing purposes, including: application maintenance and bug fixing, application procurement, data hosting, legal advice, application development, human resources services, supply services, ISP services, or the preparation of statistics, among others.

In this context, DKSA may transfer or disclose the collected personal data to any natural or legal person, including subcontractors and business partners who are third parties to Daikin Saudi Arabia or DENV-G.

Each time personal data is transferred or disclosed to a third party, DKSA ensures that it has entered into a data processing agreement with that party, in accordance with the provisions of the Saudi Personal Data Protection Law and its Implementing Regulations, and obliges it to comply with the relevant legal principles and provisions, and to adhere to appropriate protection and security standards, except in cases where the third party has a legitimate interest in accordance with the law.

9) Transfer of Personal Data to Countries Outside the Kingdom

DKSA may transfer and share the collected personal data with DENV-the DENV-G companies and business partners located outside the territory of the Kingdom of Saudi Arabia or one of them, in order to carry out the purposes described above.

Please note that DKSA has prepared standard contractual clauses and appropriate guarantees for the transfer of personal data between DKSA and its parent company, and in the event that personal data is transferred to countries that do not apply a level of protection equivalent to what is applicable in the Kingdom, DKSA is committed to the following:

Ensure an appropriate level of protection by taking appropriate contractual, regulatory and technical safeguards, in compliance with the provisions of the Saudi Personal Data Protection Law and its supplementary regulations;
Manage the transfers of personal data on one of the following statutory bases:

⁘ The existence of a decision issued by the competent authority ( SDAIA) authorizing the transfer of data to a specific country or entity;

⁘ Existence of approved model agreements or contracts that include obligations to maintain confidentiality and security;

⁘ Applying a code of conduct or compliance certificates approved by the competent authority.

In the event that the data transfer is not possible based on the above-mentioned bases, the transfer of personal data may be carried out based on the explicit consent of the data subject or on the basis of special exceptions as determined by the provisions of Article (29) of the Saudi Personal Data Protection Law.

10) Storage Standards

Daikin Saudi Arabia does not retain personal data indefinitely, as it processes personal data to the extent necessary and to the extent necessary to achieve the specified purposes. The processing of personal data is limited to the purposes specified above for which the data subject has given implicit or express consent and retains it for as long as is necessary to achieve the specified purposes or as required by the applicable laws, regulations and policies of the Kingdom.

Daikin Saudi Arabia is committed to destroying personal data when the purpose of processing it is no longer valid and this is done in a secure manner that prevents leakage, loss, embezzlement, misuse or unauthorized access, unless its retention is required under the provisions of the Saudi Personal Data Protection Law, or any laws or executive regulations issued by the competent regulatory authorities such as the Saudi Data and Artificial Intelligence Authority (SDAIA).

Daikin Saudi Arabia also destroys personal data after the purpose of collecting it has expired without delay. However, it may retain such data after the end of the purpose of collecting it if everything that leads to the identification of its owner is specifically removed in accordance with the controls set out in the regulations in the Kingdom.

Daikin Saudi Arabia retains personal data even after the purpose of its collection has expired in the following two cases:

If there is a statutory retention period , and personal data must be kept for a specified period, in which case it shall be destroyed after the expiry of this period or the expiry of the purpose of collecting it, whichever is longer.
If the personal data are closely related to a case before a judicial body and its retention is required for that purpose, in which case it shall be destroyed after the completion of the space procedures for the case.

11) Rights of the Personal Data Subject

If you have any queries regarding the protection of your personal data or about the exercise of any of your rights set out in the Personal Data Protection Law, you may contact us at any time through our official means, such as email, telephone or by filling out the form available on the "Contact Us" page on our website or apps.

Once your personal data has been processed, you, as a Data Subject, have the right to exercise all rights in accordance with the provisions of the Saudi Personal Data Protection Law and its supplementary regulations, including:

a) The Right to Knowledge:

This includes notifying you of the legal basis or actual need to collect your personal data, and the purpose for which your data is collected, and not subsequently processing your data in a manner inconsistent with the purpose for which you have provided your implied or express consent.

b) The right to withdraw your consent to the processing of your personal data at any time unless there are legitimate purposes that require the contrary.

If you have previously given your consent to the processing of your personal data, you have the right to withdraw this consent at any time, and this will result in the cessation of processing only in relation to that consent, without affecting the lawfulness of the processing that took place prior to the withdrawal of consent.

c) The right to access your personal data with Daikin Saudi Arabia

This is in order to review them, request their correction, completion, or update, and request the destruction of what is no longer needed , and obtain a copy of them in a clear format.

You have the right to request access to your personal data that is processed by Daikin Saudi Arabia, as well as to know the following:

Purpose of processing,
Types of personal data processed;
Entities to whom personal data has been disclosed;
the retention period or criteria used to determine it;
Data Subject Rights,
the existence and impact of automated decisions (including profiling/profiles);
any additional information available about the processing of your personal data;

The data you provide to us in the form will only be used for the purpose of verifying your identity and processing your request.

d) You have the right to correct, complete, erase or restrict the processing of personal data

If some of the data we hold is incorrect, out of date, or incomplete, you have the right to request that it be corrected or completed at any time.
You can also request the destruction of your personal data, and we will work to implement the request unless there are legal impediments or legitimate interests that prevent the destruction in accordance with the laws in force in the Kingdom.

e) You have the right to request that the processing of your data be restricted, in certain cases, such as an objection to the accuracy of the data, or the existence of unlawful processing without the desire to be destroyed.

f) The right to object to automated processing or decisions

If you do not agree with how Daikin KSA processes some of your personal data, you have the right to file an objection, and we will review the objection and take appropriate action, unless there are legal reasons or legitimate interests that prevent this, such as anti-fraud or compliance with a legal obligation.

You can also object to the use of your data in automated decision-making processes (including profiles) that may have legal effects on your rights.

g) The right to lodge a complaint with the competent authority

If you are not satisfied with Daikin Saudi Arabia's handling of your personal data, or your rights are not adequately addressed, you have the right to lodge a complaint with the competent authority in the Kingdom, the Saudi Data and Artificial Intelligence Authority (SADIA), as the regulator overseeing the implementation of the Personal Data Protection Law.

12) Security measures to protect personal data

Daikin Saudi Arabia shall implement appropriate technical and organizational measures to maintain the confidentiality, integrity and security of personal data, and to prevent accidental or unlawful destruction, loss, modification, disclosure or unauthorized access to the personal data that is processed, transferred or stored, in line with the requirements of the Personal Data Protection Law and its Executive Regulations and in accordance with the provisions of the National Cybersecurity Authority and the competent authorities.

13) Data Protection Impact Assessment:

Daikin KSA is committed to conducting a data protection impact assessment before implementing any new data processing activity using new technologies or systems in accordance with Article (22) of the Personal Data Protection Law, and Daikin KSA takes all appropriate measures to address any privacy risks in advance.

14) Future updates to the Personal Data Protection Policy

Daikin KSA continuously strives to improve the level of protection of personal data. Hence, this Personal Data Protection Policy may be amended or updated in line with changes in local and international laws and regulations.

Daikin KSA will notify you of any material changes to this Policy through appropriate means, whether through the Website, Applications or through official notices.

You can always view the most current version of the Personal Data Protection Policy on our official website, or through the "Data Protection Policy" section within each application.

15) Data Protection Officer

In case of any inquiries or complaints, please contact the Data Protection Officer at Daikin KSA:

Name: Amira Abdullah Bawazir

Email : DataProtection@daikin-ksa.com

Address: (AlSahafa Dist., AlSahafa Centre, 1st Floor, Office 12, Riyadh, KSA)