Draft that needs a lawyer's review. Not final; it will change before launch.
The controller
Ons Haven Company, a single-person limited liability company, Unified No. 7055470079, Riyadh. Privacy contact: privacy@onsauctions.sa.
What we collect
- Identity from Nafath: name, and your ID number stored only as a one-way fingerprint.
- Your phone or email if you give them.
- Your IBAN, the account holder's name and the bank's IBAN certificate.
- Your deposits, SADAD bills, transfer receipts and refunds.
- Your registrations, bids (with time and channel) and the auction minutes.
- Technical logs: IP address and device data for security.
Why we use it
- To run auctions and check who may bid (contract, and the auction regulation's requirement to sign in with Nafath).
- To collect and refund entry amounts and keep financial records (legal obligation).
- To file auctions with the Real Estate General Authority as the regulation requires.
- To prevent fraud and money laundering, and to protect the platform (legitimate interest and legal obligation).
Where it is kept
Your data is stored inside Saudi Arabia, and we do not transfer it abroad. The map background loads from an open map provider; it receives only what any browser sends to load images, never your account data.
How long we keep it
- Auction records (registrations, bids, minutes): 5 years from the auction's end (auction regulation, art. 3).
- Payment records (deposits, IBANs, refunds): 10 years (anti-money-laundering record keeping).
- Other data: while your account is active, then deleted or anonymised.
Your rights
- To be told how your data is processed (this page).
- To access a copy of your data.
- To correct it.
- To ask for deletion of whatever the law does not require us to keep.
- To complain to us (complaints), and to the Saudi Data and AI Authority (SDAIA), which supervises the PDPL.
Security
Encrypted connections, identity fingerprints instead of ID numbers, access only for staff who need it, append-only audit and ledger records, and encrypted backups.