Dear Customer,

Your privacy and the security of your financial and personal data are our responsibility. This policy aims to inform you of the nature of the information we collect from you or from other sources after obtaining your written or electronic consent. We confirm that the privacy policy adopted by Al Rajhi Bank – Jordan Branches (“ARBJ”) includes a commitment to protecting all your financial and personal data by applying all necessary security standards to maintain the confidentiality of this information, and to fully comply with the Jordanian Personal Data Protection Law No. (24) of 2023, the Central Bank of Jordan’s instructions regarding the processing of personal data, as well as the internal regulations of Al Rajhi Bank.

Our privacy policy aims to clarify how personal data is collected, used, shared with others, stored, disclosed, and processed when you use any of the bank’s services, including the website, applications, electronic banking services, and in-person services provided by our branches.

How We Obtain Your Data

Al Rajhi Bank collects your data based on legal grounds related to your personal data, whether directly or indirectly, as an individual customer, a company representative, or a beneficiary of banking services. Data may be obtained directly from you when visiting our branches, using the bank’s electronic services or website, or indirectly from any other entity that facilitates the collection of such data. Examples include, but are not limited to:

1. Identification information: Name, national ID number, email address, phone number, ID card number, or passport information.
2. Financial and banking information: Accounts, transactions, credit information, loans, financial evaluations, payment cards, tax status, and other relevant necessary data.
3. Technical information: Login data, IP address, cookies, website and electronic service usage data, and your geographic location.
4. Sensitive data: Health information, fingerprints, CCTV recordings from visits to our branches or headquarters, information related to social life or religion, and any other sensitive data.
5. Legal information: Any information required by law that identifies the customer.

Legal Basis for Processing Personal Data

The bank processes personal data based on specific legal grounds and in accordance with the principles outlined in the Personal Data Protection Law and its executive regulations. Processing must be lawful, transparent, consistent with the purposes for which the data was collected and carried out using legitimate means. Data must be accurate and up to date, and must not, after the purpose is fulfilled, allow the identification of the person concerned or cause harm or infringe upon their rights. Processing must also ensure confidentiality and integrity of the data.

Personal data processing is based on one of the following grounds:

1. Execution of contracts or providing agreed-upon products and services.
2. Compliance with legal obligations in Jordan or abroad.
3. The legitimate interests of the bank without infringing on your fundamental rights.
4. Your explicit consent when processing involves sensitive data or for direct marketing purposes.

Purposes of Data Processing

We always ensure that personal data is processed for a specific purpose and that only the data relevant to achieving that purpose is processed. To provide the best banking services to our customers, and for regulatory oversight by the Central Bank of Jordan within the applicable legal framework, personal data is used for the following purposes:

1. Processing applications for banking products and services, including risk and credit assessments.
2. Providing banking services, including electronic services, and completing transactions and instructions.
3. Managing customer relationships and improving service quality, including profiling.
4. Conducting marketing research and surveys to improve products and services.
5. Direct marketing of products and services, with the option for customers to decline.
6. Compliance with laws and regulations, preventing financial crimes, combating money laundering and terrorism financing.
7. Legal purposes, such as defending the bank’s rights or taking legal action.
8. Ensuring security and protecting bank assets and equipment such as ATMs through surveillance cameras.

Data Sharing, Exchange, and Access

In accordance with laws and regulations, the bank or its service providers (contracted under agreements ensuring customer rights in accordance with the Jordanian Personal Data Protection Law No. 24 of 2023 and the instructions of the Central Bank of Jordan) may share or transfer your data, within legal limits, with the following entities:

1. All Al Rajhi Bank – Jordan branches, the main administration in Jordan, and the headquarters in Saudi Arabia.
2. Any person authorized, delegated, or legally representing the customer or guaranteeing their financial obligations to the bank.
3. Relevant bank employees according to job responsibilities.
4. Legal departments, law firms, legal advisors, compliance, risk, and accounting staff.
5. Information technology staff.
6. Insurance companies and real estate appraisal companies.
7. Personal data protection officers, information security, and cybersecurity staff.
8. External service providers of the bank, its customers, or its employees—trusted under approved agreements and in compliance with the Jordanian Personal Data Protection Law No. 24 of 2023 and the Central Bank’s instructions.

Al Rajhi Bank – Jordan prohibits the publishing, distribution, disclosure, or sharing of customer data with third parties except where legally permitted or with prior consent from the concerned individual, while adhering to security and privacy standards. All data transferred or processed abroad—including at the headquarters in Saudi Arabia—will remain subject to adequate protection guarantees as required by the laws and regulations of both Jordan and Saudi Arabia.

Data Retention and Deletion

1. We retain your personal data as necessary to provide our services optimally and in compliance with legal and regulatory obligations. Data is stored for the period required to fulfill its purpose or in response to regulatory, judicial, or supervisory requests.
2. After the legal retention period ends or when the data is no longer needed, it is deleted, archived, or securely destroyed in accordance with applicable procedures.
3. Data will be deleted if:

1. It is processed for a purpose other than that for which it was collected or approved.

2. The concerned individual withdraws their prior consent, unless other legislation requires otherwise.

3. It is processed contrary to the Personal Data Protection Law and its regulations.

4. Deletion is required by a legal or contractual obligation.

Customer Rights

In accordance with the Jordanian Personal Data Protection Law No. 24 of 2023, the Central Bank’s instructions, and the bank’s internal regulations, you have the right to:

1. Right of access: Request confirmation of whether your personal data is being processed, obtain a copy, and access your data stored by the bank.
2. Right to rectification: Request correction or updating of inaccurate personal data.
3. Right to erasure: Request deletion of personal data when no longer needed or upon withdrawing consent, subject to compliance with laws and Central Bank instructions.
4. Right to be informed about processing.
5. Right to restrict processing when challenging accuracy or objecting to processing.
6. Right to data portability: Obtain an electronically readable copy of your personal data and transfer it to another party.
7. Right to object: Object to the processing of data for direct marketing or processing based on the bank’s interests.
8. Right to object to automated decision-making: Object to decisions made solely through automated processing, except where permitted by law.
9. Right to be notified of personal data breaches: You must be notified within 48 hours of detecting any breach and provided with necessary precautions.

Requests cannot be fulfilled if they conflict with applicable laws, regulatory requirements, or the security and integrity of the bank.

Security and Data Protection

Al Rajhi Bank – Jordan is committed to handling personal data with strict confidentiality and protecting your information using strong security measures. The bank implements technical and organizational measures, including advanced information security systems for protecting data during transmission and storage, strong encryption mechanisms, prevention of unauthorized access, strict internal controls based on the principle of least privilege, ongoing monitoring, risk analysis, written data management policies, and continuous staff training on privacy protection. Regular audits are conducted to ensure regulatory compliance and proper data handling.

Security measures include:

1. Strict technical and administrative measures to protect personal data from unauthorized access, leakage, alteration, or destruction, ensuring encryption and ongoing security monitoring to reduce risks in line with the highest privacy standards.
2. Ensuring that external service providers inside or outside Jordan comply with required security standards under the Jordanian Personal Data Protection Law No. 24 of 2023 and the Central Bank’s instructions, with technical and organizational assessments conducted before contracting.
3. Customers will be notified within 24 hours of any material personal data breach.

Use of Social Media

1. The bank may operate electronic channels on social media platforms to communicate with customers while prohibiting the sharing of sensitive or excessive data through these platforms.
2. The bank is responsible only for personal data collected directly from customers through these channels.

Policy Updates

1. This policy may be amended from time to time in accordance with laws or instructions issued by the Central Bank of Jordan or for customer benefit.
2. Customers will be notified of any material changes through available electronic channels, and continued use of the website constitutes implicit acceptance of these changes and their implications.

For any inquiries, complaints, or requests related to personal data, please contact the Data Protection Officers at Al Rajhi Bank – Jordan via email at: PDM@alrajhibank.com.jo, or by kindly visiting the nearest branch.