Article (1): Introduction

Article (2): Data to be Collected and Purpose of Collection

1. Name
2. Mobile number
3. Email address
4. Age
5. Gender

Second: Purpose of Collecting Personal Data:

Name and email are used to complete registration; mobile number is used to ensure delivery of donation messages and impact reports. Age and gender are optional data the donor may add to improve user experience.

Article (3): Methods of Data Collection

1. Directly: donor data provided by the data subject are collected through direct registration on the website/app.
2. Indirectly: Ehsan does not collect any personal data indirectly and does not rely on any other sources for donor data.

Article (4): Use of Personal Data

We use the personal data collected directly as follows:

Personal data are used to fulfill account-creation requirements (name, email, and mobile number) to complete registration; to sign in by entering the mobile number; or via “Keep me informed” after completing a donation by entering the mobile number. Data is stored in Ehsan’s databases in encrypted records and linked to sending SMS messages to donors targeted by donation opportunities to improve beneficiary experience—such as notifying donors about request status in specific programs (campaigns, Adhahi, Gift) and sharing impact reports for certain opportunities—until deleted in accordance with the National Information Center’s data destruction procedures.

Article (5): Storage and Destruction of Personal Data

Article (6): Legal Basis for Collecting and Processing Personal Data

The consent of the data subject, which may be withdrawn at any time unless another legal basis applies. To do so, contact the email specified in Article Nine.

Article (7): Rights of the Data Subject

Right to be Informed: the data subject has the right to know how we collect data, the legal basis for collection and processing, how it is processed, stored, and destroyed, and with whom it will be shared. All details are available in this Privacy Policy, or by contacting us via the details in Article Nine.

Right of Access to Personal Data: the data subject has the right to be enabled to access their personal data directly.

Right to Obtain Personal Data: the data subject may request a copy of their personal data via the email specified in Article Nine. It will be provided—free of charge—within [seven business days] via email.

Right to Rectification of Personal Data: the data subject may request correction of personal data they deem inaccurate, incorrect, or incomplete via the email specified in Article Nine; it will be reviewed and updated within [seven business days], and the data subject will be notified by email.

Right to to Erasure of Personal Data: the data subject may request destruction of their personal data under certain circumstances, except for data linked to the organization’s core donation operations.

Right to Withdraw Consent to Data Processing: the data subject may withdraw consent to process personal data at any time, unless there are legitimate purposes requiring otherwise.

Article (8): Sharing/Exchange of Personal Data

There is no sharing or exchange of personal data collected through Ehsan Platform with other entities.

Article (9): Exercising Data Subject Rights

The data subject may request access/rectification/destruction of their data by contacting: EData@nic.gov.sa

Article (10): Personal Data Protection Officer

Name: Data Management Office at the Saudi Data & AI Authority (SDAIA).

Email: Dmo@sdaia.gov.sa

Article (11): Complaints and Inquiries

For complaints or inquiries related to the Privacy Policy or handling of personal data, contact Ehsan platform management via the available channels at the following number (contact number 8001247000). If there is no response within seven business days, submit the complaint or inquiry to SDAIA’s Data Management Office (Dmo@sdaia.gov.sa). If the issue is not resolved or there is no response within seven business days, escalate to the National Data Management Office at: (pr@ndmo.gov.sa).

Article (12): Updates to the Privacy Policy

The last update to the Privacy Policy was made on (23/01/2025).

Ehsan Platform Management reserves the right to add or amend any provisions of the Privacy Policy and will notify the data subject. The site management may terminate the data subject’s account if they do not accept any change to the Privacy Policy.

Arabic shall be the authoritative language for applying the terms and conditions; in case of any discrepancy in interpreting any text in another language, the Arabic text shall prevail.