Privacy Policy

Al-Ahli Club Company (شركة نادي الأهلي), a company duly registered in the Kingdom of Saudi Arabia under Unified Commercial Registration Number 7000750385, with VAT registration number 311713130100003, having its registered office at Prince Mohammed bin Abdulaziz Branch Street, Al-Rehab District, Building No. 3681, P.O. 23345, Jeddah, Kingdom of Saudi Arabia (hereinafter "Al-Ahli," "the Company," "we," "us," or "our"), is committed to safeguarding the privacy of every visitor, customer, member, and subscriber (hereinafter "User" or "you") of its official website and online store operated on the Salla e-commerce platform (the "Platform").

This Privacy Policy (the "Policy") describes how we collect, use, disclose, store, transfer, and protect Personal Data, and the rights afforded to you, in full compliance with:

• The Personal Data Protection Law (PDPL) issued by Royal Decree No. (M/19) dated 9/2/1443H and its subsequent amendments;
• The Implementing Regulations of the PDPL issued by the Saudi Data and Artificial Intelligence Authority ("SDAIA");
• The Essential Cybersecurity Controls (ECC) issued by the National Cybersecurity Authority ("NCA");
• The Anti-Cyber Crime Law and all other applicable laws of the Kingdom of Saudi Arabia.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required under the applicable laws and regulations of the Kingdom of Saudi Arabia, such consent shall be obtained separately before the relevant Processing activity takes place.

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" means any data, of any form, that may lead, directly or indirectly, to the identification of an individual.
• "Sensitive Personal Data" means any Personal Data revealing racial or ethnic origin, religious, intellectual or political beliefs, criminal or security data, biometric or genetic data, health data, or data concerning credit information.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, organization, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Subject" means the natural person to whom the Personal Data relates.
• "Controller" means Al-Ahli Club Company, which determines the purposes and means of Processing.
• "Processor" means any third party that Processes Personal Data on behalf of the Controller.
• "Data Protection Officer" or "DPO" means the person designated by the Controller to be responsible for compliance with the PDPL.

In accordance with Article 12 of the PDPL, the data Controller is:

We may collect and Process the following categories of Personal Data:

4.1 Identification & Contact Data: full name, national identification or Iqama number (where legally required), email address, mobile number, billing and shipping address, and date of birth.

4.2 Transactional & Financial Data: order history, products purchased, transaction values, payment method used (with no retention of full card numbers — all payments are processed exclusively through PCI-DSS certified gateways), and invoice details required for compliance with the E-Invoicing Regulations of the Zakat, Tax and Customs Authority (ZATCA).

4.3 Technical Data: device type, operating system, browser type and version, IP address, unique device identifiers, geolocation data (where lawfully permitted), and session logs.

4.4 Usage Data: pages visited, session duration, navigation paths, click streams, referral sources, wish-list activity, and behavioural analytics.

4.5 Marketing & Communications Data: marketing preferences, opt-in status, communication history, and survey responses.

4.6 Minors' Data: We do not knowingly collect or Process Personal Data relating to minors as defined under the applicable laws and regulations of the Kingdom of Saudi Arabia without the verifiable consent of a parent or legal guardian where required by law. If we become aware that such Personal Data has been collected without the required consent, we shall take appropriate steps to delete or otherwise Process such data in accordance with applicable law.

Pursuant to Articles 5 and 6 of the PDPL, we Process Personal Data exclusively on one or more of the following lawful bases:

1. The explicit, informed, freely given, and documented consent of the Data Subject;
2. The performance of a contract to which the Data Subject is a party, or pre-contractual steps taken at the Data Subject's request;
3. Compliance with a legal or regulatory obligation imposed upon the Company;
4. Protection of the vital interests of the Data Subject;
5. Where Processing is based on a lawful interest permitted under the Personal Data Protection Law (PDPL) and its Implementing Regulations, provided that such Processing does not prejudice the rights or interests of the Data Subject;
6. Where Processing is necessary for scientific, research, or statistical purposes, in accordance with the PDPL.

Consent shall not be a precondition for the provision of any service or benefit unless such Processing is intrinsically necessary for that service. Consent may be withdrawn by the Data Subject at any time, without affecting the lawfulness of Processing carried out prior to such withdrawal.

We Process Personal Data exclusively for the following specified, explicit, and legitimate purposes:

1. To fulfil orders, process payments, manage deliveries, returns, exchanges, and refunds;
2. To issue compliant tax invoices in accordance with ZATCA's E-Invoicing Regulations;
3. To create and manage User accounts and verify identity;
4. To personalize the User experience and recommend relevant products;
5. To send transactional communications (order confirmations, shipping updates, refunds);
6. To send marketing communications about Al-Ahli's products, events, and offers — only with the User's prior explicit consent;
7. To respond to inquiries, complaints, and provide customer support;
8. To conduct analytics, surveys, and customer-satisfaction research in an aggregated or pseudonymized form;
9. To detect, prevent, and address fraud, abuse, security incidents, and unlawful activity;
10. To comply with applicable laws, regulations, court orders, or binding instructions of competent Saudi authorities;
11. To exercise or defend legal claims.

Personal Data shall not be further Processed in any manner incompatible with the purposes set forth above.

We retain Personal Data only for the period necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law. Indicative retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data shall be securely destroyed or irreversibly anonymized.

We implement technical, organizational, and administrative safeguards commensurate with the risks of Processing, in accordance with the NCA's Essential Cybersecurity Controls (ECC-1:2018) and SDAIA's binding guidance. These measures include, without limitation:

• End-to-end encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256);
• Role-based access controls and the principle of least privilege;
• Multi-factor authentication for all administrative access;
• 24/7 security monitoring, intrusion-detection systems, and vulnerability management;
• Periodic penetration testing and security audits;
• Mandatory training of all personnel handling Personal Data;
• Application of the principles of data minimization and purpose limitation.

We use cookies and similar tracking technologies in accordance with the following classification:

You may manage your cookie preferences at any time through the Cookie Preference Center available on the Platform, or through your browser settings. Disabling certain categories of cookies may limit the functionality of the Platform.

We do not sell, lease, or trade your Personal Data. We may disclose Personal Data only in the following circumstances and only to the extent strictly necessary:

10.1 Authorized Processors: payment service providers (Mada, Visa, MasterCard, Apple Pay, Tamara and other approved providers), shipping and logistics carriers, IT and cloud hosting providers, the Salla platform, and customer-support tools. All Processors are bound by written agreements imposing confidentiality and security obligations no less stringent than those set forth herein.

10.2 Legal & Regulatory Disclosures: where required by a judicial order, an administrative directive, or any binding request from competent Saudi authorities (including SDAIA, NCA, ZATCA, the Ministry of Commerce, and the Public Prosecution).

10.3 Corporate Transactions: in the event of a merger, acquisition, restructuring, or sale of assets, subject to prior notification to Data Subjects where required.

10.4 With Your Consent: any other disclosure shall be made only with your explicit and documented consent.

Pursuant to Articles 29 and 31 of the PDPL, any transfer of Personal Data outside the Kingdom of Saudi Arabia shall be carried out only where one or more of the following conditions is met:

1. The recipient jurisdiction provides an adequate level of protection as determined by SDAIA;
2. Appropriate safeguards are in place, such as binding contractual clauses approved by SDAIA;
3. The transfer serves a public interest, public health, or public safety purpose;
4. The transfer is required for the performance of an international agreement to which the Kingdom is a party;
5. The transfer is necessary for the performance of an obligation of the Data Subject.

We shall not transfer Personal Data outside the Kingdom in any case that would prejudice national security or vital interests of the Kingdom.

In accordance with Article 4 of the PDPL, you are entitled to exercise the following rights, free of charge and subject to the limitations set forth in applicable law:

1. Right to be Informed — to know the legal basis, purposes, and recipients of Processing;
2. Right of Access — to obtain confirmation of Processing and a copy of the Personal Data held about you;
3. Right to Rectification — to request the correction of inaccurate, incomplete, or outdated Personal Data;
4. Right to Erasure ("Right to be Forgotten") — to request the deletion of your Personal Data, where there is no overriding legal obligation requiring its retention;
5. Right to Restrict Processing — to request the suspension of Processing in specific circumstances;
6. Right to Object — where permitted under applicable law, you may object to certain Processing activities carried out by the Company, subject to the conditions and limitations prescribed by the PDPL and its Implementing Regulations;
7. Right to Data Portability — to receive your Personal Data in a structured, commonly used, and machine-readable format, and to request its transmission to another Controller;
8. Right to Withdraw Consent — at any time, where Processing is based on consent;
9. Right to Lodge a Complaint — to lodge a complaint directly with SDAIA at sdaia.gov.sa.

Requests may be submitted to the contact details set forth in Section 15 below. We shall respond within thirty (30) days of receipt, in accordance with the PDPL.

In the event of a Personal Data breach that is likely to cause harm to the Data Subject or their data, we shall:

1. Notify SDAIA within seventy-two (72) hours of becoming aware of the breach, in accordance with Article 20 of the PDPL Implementing Regulations;
2. Notify the affected Data Subject(s) without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
3. Document all breaches, the facts surrounding them, their effects, and the remedial actions taken.

We reserve the right to amend this Policy at any time to reflect changes in applicable law, regulatory guidance, or our business practices. Material amendments shall be communicated to Users at least thirty (30) days prior to taking effect, via email or a prominent notice on the Platform. The "Last Updated" date at the top of this Policy shall be revised accordingly. Continued use of the Platform following any such amendment shall constitute acceptance thereof.

For any inquiries, requests, or complaints relating to this Policy or the Processing of your Personal Data, please contact our Data Protection Officer:

This Policy shall be governed by and construed in accordance with the laws and regulations of the Kingdom of Saudi Arabia. Any dispute arising out of or in connection with this Policy shall fall within the exclusive jurisdiction of the competent Saudi courts.