Jamjoom Fashion — Website Privacy Policy (Refined Legal Draft, KSA PDPL-Compliant Edition)
Last Updated: 12 November 2025
1. Introduction
This Privacy Policy (“Policy”) explains how Jamjoom Fashion Trading Company, a Saudi joint stock company (“Jamjoom Fashion”, “we”, “us”, or “our”), collects, processes, discloses, and safeguards personal data when individuals visit or interact with our corporate website, sub-sites, investor relations pages, career portal, and other online experiences (collectively, the “Site”).
This Policy is established in compliance with the Personal Data Protection Law (“PDPL”) of the Kingdom of Saudi Arabia and its Implementing Regulations.
2. Scope
This Policy applies to the Site only. It does not govern the processing of personal data collected through our brand e-stores (including Nayomi and Mihyar), which are subject to their respective Terms of Sale and privacy notices.
If there is any inconsistency between the Arabic and English versions of this Policy, the Arabic version shall prevail.
3. Data Controller and Contact Information
Controller: Jamjoom Fashion Trading Company (Saudi Joint Stock Company)
Address: 2532 Asma bint Umais Rd., 6705, Ash Shati District, Jeddah 23513, Kingdom of Saudi Arabia
Email (general enquiries): info@jamjoomfashion.com
Email (privacy matters): privacy@jamjoomfashion.com
4. Categories of Personal Data Collected
We may collect and process the following categories of personal data when you use the Site:
• Identifiers and contact details (e.g., name, email address, phone number, company, nationality, role)
• Investor Relations (IR) data (e.g., webcast registrations, questions submitted to IR, newsletter preferences)
• Careers and recruitment data (e.g., CV/resume, education, work experience, right-to-work status)
• Device and usage data (e.g., IP address, browser type, device type, language, referring URLs, and cookies)
• Location data (derived from IP address for approximate geolocation)
• Preferences and communication records (e.g., marketing opt-ins, messages sent to us)
• Social media engagement data (if you interact with our official accounts)
We do not intentionally collect sensitive personal data unless explicitly required or voluntarily provided for specific purposes (e.g., recruitment or accessibility requests).
5. Sources of Personal Data
We collect personal data from the following sources:
• Directly from you (e.g., forms, emails, registrations, job applications)
• Automatically (e.g., through cookies, analytics, and web beacons)
• From third parties (e.g., recruitment platforms, analytics providers, IR service platforms, or public databases)
6. Purposes and Legal Bases for Processing
We process personal data for lawful, specific, and explicit purposes in accordance with the PDPL. Depending on the context, processing is based on one or more of the following legal grounds: consent, contractual necessity, compliance with legal obligations, legitimate interests (balanced against individual rights), or protection of vital interests.
The main purposes include:
• Operating and securing the Site, preventing misuse or fraud (legal bases: legitimate interest; legal obligation)
• Responding to enquiries and providing customer support (legal bases: contract; legitimate interest)
• Investor Relations communications and regulatory compliance (legal bases: legal obligation; legitimate interest; consent where applicable)
• Careers and recruitment management (legal bases: contractual necessity; legitimate interest; legal obligation)
• Marketing and newsletters (legal bases: consent; legitimate interest for service communications)
• Analytics and service improvement (legal bases: consent; legitimate interest where allowed)
• Legal compliance and governance (legal bases: legal obligation; legitimate interest)
7. Cookies and Similar Technologies
We use cookies and similar technologies to enhance your browsing experience, analyze site performance, and personalize content where consented.
Cookie types include:
• Strictly necessary cookies (essential for website functionality and security)
• Performance and analytics cookies (e.g., tracking navigation and usage metrics)
• Functional cookies (e.g., remembering preferences)
• Advertising or targeting cookies (subject to consent)
Users can manage their cookie preferences via the cookie banner or browser settings. Detailed information is provided in our Cookie Notice.
8. Disclosure of Personal Data
We share personal data only when necessary, subject to confidentiality and data protection safeguards, with the following:
• Service providers and processors (hosting, analytics, recruitment, email delivery, and security vendors)
• Professional advisors (legal, compliance, and audit)
• Group companies and affiliates providing shared services
• Public authorities, regulators, or law enforcement where legally required
• Counterparties to business reorganizations or acquisitions (under confidentiality obligations)
We do not sell personal data under any circumstances.
9. International Data Transfers
Where data is transferred outside the Kingdom of Saudi Arabia, we ensure compliance with PDPL requirements through approved transfer mechanisms, including adequacy decisions, contractual clauses, and risk assessments.
We implement technical and organizational safeguards to protect data during cross-border transfers. Details are available upon request.
10. Data Retention
We retain personal data only as long as necessary for the purposes described in this Policy and in compliance with statutory, accounting, and reporting obligations.
Examples include:
• Enquiry and contact data – up to 2 years
• Candidate data – up to 12 months (unless extended by consent for talent pool retention)
Data no longer needed is securely deleted or anonymized.
11. Data Subject Rights
Under the PDPL, individuals have the following rights (subject to legal limitations):
• Access and obtain a copy of personal data
• Request correction or updating of inaccurate or incomplete data
• Request deletion of data no longer required
• Object to or restrict certain processing activities
• Withdraw consent (where processing is based on consent)
• Request portability of provided data (where technically feasible)
• File a complaint with the competent authority (Saudi Data & AI Authority – SDAIA)
Requests may be submitted to privacy@jamjoomfashion.com or to our postal address. We respond within the timeframe required by the PDPL.
12. Children’s Data
Our Site is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.
13. Security of Personal Data
We apply technical and organizational measures to protect personal data from unauthorized access, alteration, or loss.
Despite these measures, no system is completely secure. Users should exercise caution when transmitting personal data online.
14. Third-Party Sites and Services
Our Site may contain links or plugins to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. Users are encouraged to review their privacy notices before providing data.
15. Automated Processing and Profiling
We do not perform automated decision-making or profiling that produces legal or similarly significant effects. Should such processing be introduced, we will provide notice in accordance with the PDPL and explain the logic and consequences involved.
16. Policy Updates
We may amend this Policy periodically. Material updates will be communicated via a notice on our Site and reflected in the “Last Updated” date above.
17. Contact Information
For any privacy-related questions, concerns, or data subject requests, please contact:
Email: privacy@jamjoomfashion.com
Postal: Jamjoom Fashion Trading Company, 2532 Asma bint Umais Rd., 6705, Ash Shati District, Jeddah 23513, Kingdom of Saudi Arabia