Dear Value Customer,

Your privacy and the security of your financial and personal data are our responsibility. This policy aims to inform you about the nature of the information we collect—either directly from you or from another source—after obtaining your written or electronic consent.

We assure you that the privacy policy adopted by Al Rajhi Bank – Jordan Branches (“ARBJ”) is committed to protecting all your financial and personal data by following and implementing all necessary security standards to maintain the confidentiality of this information. The Bank fully complies with the Jordanian Personal Data Protection Law No. (24) of 2023, the Central Bank of Jordan’s regulations on personal data processing, and Al Rajhi Bank’s internal regulations.

Our privacy policy aims to clarify how personal data is collected, used, shared with others, stored, disclosed, and processed when you use any of the Bank’s services—including our website, mobile applications, electronic banking services, and in-branch services.

How Your Data is Collected

Al Rajhi Bank collects your data on a legal basis, either directly or indirectly, as an individual customer, a company representative, or a beneficiary of banking services. Data may be collected directly from you—when you visit our branches, access the Bank’s websites, or use our electronic services—or indirectly from other entities authorized to collect such data. Examples include, but are not limited to:

1. Identification Information: Name, national ID number, email, phone number, identity card or passport details.
2. Financial and Banking Information: Accounts, transactions, credit information, loans, financial evaluations, financial cards, tax status, and other related data.
3. Technical Information: Login details, IP address, cookies, website and e-service usage data, and geographic location.
4. Sensitive Data: Health information, fingerprints, data related to social life or religion, and any other sensitive information.
5. Legal Information: Any information required by law that identifies the customer.

Legal Basis for Processing Personal Data

The Bank processes personal data according to specific legal grounds and the principles set out in the Personal Data Protection Law and its executive regulations. Processing is based on one of the following reasons:

1. To perform contracts or provide agreed-upon products and services.
2. To comply with legal obligations in Jordan or abroad.
3. For the Bank’s legitimate interests, provided this does not harm your fundamental rights.
4. With your explicit consent—especially when processing sensitive data or for direct marketing purposes.

Purposes of Data Processing

We always ensure that personal data is processed for a specific purpose and that only relevant data is processed to achieve this purpose. To provide our customers with the best banking services and to comply with the supervisory requirements of the Central Bank of Jordan, personal data may be used for the following purposes:

1. Processing applications for banking products and services, including risk and credit assessments.
2. Providing banking services, including e-services, completing transactions, and executing instructions.
3. Managing customer relationships and improving service quality.
4. Conducting marketing research and surveys to enhance products and services.
5. Direct marketing of products and services, while allowing customers to opt out of such use.
6. Compliance with laws and regulations, prevention of financial crimes, and combating money laundering and terrorism financing.
7. Legal purposes, such as defending the Bank’s rights or pursuing legal proceedings.
8. Security purposes, including protecting the Bank’s assets and ATMs using surveillance cameras.

Data Sharing, Exchange, and Access

In accordance with laws and regulations, the Bank—or its contracted service providers (under agreements that protect customers’ rights as per the Jordanian Personal Data Protection Law No. (24) of 2023 and Central Bank of Jordan’s regulations)—may share and transfer your data, within reliable safeguards, to the following entities:

1. The Bank’s branches inside and outside Jordan, and any subsidiaries or affiliated companies.
2. Any person authorized, appointed, legally representing you, or guaranteeing your financial obligations to the Bank.
3. Relevant Bank employees based on their job roles.
4. Employees of legal departments, law firms, legal advisors, compliance, risk, and accounting departments.
5. Information technology staff.
6. Insurance companies and real estate appraisal firms.
7. Data protection officers, information security, and cybersecurity staff.
8. Trusted external service providers, under approved agreements that ensure data protection in accordance with the Jordanian Personal Data Protection Law No. (24) of 2023 and Central Bank of Jordan’s instructions.

Data transferred or processed abroad—including at the head office in Saudi Arabia—is protected under adequate safeguards in line with Jordanian law and Saudi regulatory requirements.

Data Retention and Deletion

1. Your personal data is retained to provide services effectively and in compliance with legal, regulatory, and professional obligations. It is kept only as long as necessary to fulfill the purpose for which it was collected or in response to requests from supervisory, judicial, or regulatory authorities.
2. After the legal retention period ends or when the data is no longer needed, it is deleted, archived, or securely destroyed according to approved procedures.

Customer Rights

Under the Jordanian Personal Data Protection Law No. (24) of 2023, the Central Bank of Jordan’s regulations, and the Bank’s internal policies, you have the right to:

1. Right of Access: Request confirmation of whether your personal data is being processed, obtain a copy, and access your stored data.
2. Right of Correction: Request correction, updating, or modification of inaccurate personal data.
3. Right of Erasure: Request deletion of personal data when no longer needed or upon withdrawal of consent—while still complying with applicable laws and regulations.
4. Right to be Informed: Be notified of any data processing activities.
5. Right to Restrict Processing: When disputing the accuracy of data or objecting to its processing.
6. Right to Data Portability: Obtain a machine-readable copy of your data and transfer it to another entity.
7. Right to Object: Object to data processing for direct marketing or processing based on the Bank’s legitimate interests.
8. Right to Object to Automated Decisions: Object to decisions made solely by automated processing, unless permitted by law.
9. Right to Notification of Data Breach: You must be informed within 48 hours of any detected personal data breach and provided with measures to mitigate potential risks.

Please note that your rights may not be fulfilled if doing so conflicts with applicable legislation, regulatory requirements, or the Bank’s security and safety obligations.

Data Security and Protection

Al Rajhi Bank – Jordan is committed to handling personal data with complete confidentiality and protecting your information using robust security measures, including:

1. Implementing strict technical and administrative procedures to protect personal data from unauthorized access, disclosure, alteration, or destruction—ensuring encryption, continuous monitoring, and risk mitigation according to the highest privacy and data protection standards.
2. When using external service providers, the Bank ensures they follow the same security standards under agreements compliant with the Jordanian Personal Data Protection Law No. (24) of 2023 and the Central Bank of Jordan’s regulations.
3. Customers will be notified within 48 hours of any significant personal data breach.

Use of Social Media

1. The Bank may operate electronic channels on social media platforms to communicate with customers; however, sharing sensitive or excessive data through these platforms is prohibited.
2. The Bank is responsible only for personal data collected directly from customers through these channels.

Policy Updates

1. This policy may be amended from time to time in accordance with applicable laws, Central Bank of Jordan’s instructions, or customer interest.
2. Customers will be notified of any significant changes through electronic channels, and continued use of the Bank’s website constitutes implicit acceptance of such changes.

Contact Information

For any inquiries or requests related to personal data, please contact the Data Protection Officer at Al Rajhi Bank – Jordan Branches via email: PDM@alrajhibank.com.jo