Introduction
This Privacy Notice outlines how SELA (“we,” “us,” or “our”) collects, uses, discloses, and protects your personal data when you visit or interact with our digital platforms, Boulevard District, Boulevard World, The Venue, Kingdom Arena Websites (collectively referred to as “the Platforms”). Your privacy is important to us, and we are committed to safeguarding your personal information.

Information We Collect: 

Personal data is all and any kind of data that, directly or indirectly, can be used to identify a natural person.

Without affecting the foregoing, we collect personal data from you: 
   i) Personal data you give us directly when you use our services. 
   ii)  Personal data collected automatically through cookies and tracking technologies, server logs, analytics to enhance customer experience.
   iii) Personal data collected through other sources If you engage with a third-party that integrates with the Services and transfers your personal data to us (where applicable).

Purpose of Data Processing
Your personal data may be processed for the following purposes:

•  Contact and Inquiry Information Personal Data: Contact information (name, email address, phone number), information submitted through inquiry or contact forms, and event or activity interest data. Purpose of Processing: Respond to inquiries and provide customer support, communicate with users regarding their requests, events, or services, facilitate marketing communications where users have provided consent (opt-in), and enable the website to operate as the primary information and engagement platform for Boulevard World, Boulevard City, ANB Arena, and Kingdom Arena.
• Technical and Online Identifiers Personal Data: Online identifiers (IP address, device type). Purpose of Processing: Ensure platform security, fraud prevention, and operational integrity, maintain website performance, stability, and availability, and diagnose technical issues and support system administration.
• Usage and Interaction Data Personal Data: Interaction analytics (pages visited, clicks, session behavior). Purpose of Processing: Improve website functionality and usability, analyze visitor behavior to optimize content and navigation, and support tenant promotion and performance insights through aggregated and anonymized analytics.
• Marketing and Engagement Data (Opt-In) Personal Data: Contact details and expressed interests related to events or activities. Purpose of Processing: Send marketing communications, updates, and promotional materials where consent has been provided, and inform users about events, activities, and offerings across Boulevard destinations.

Third-Party Data Sharing and Cross- Border Personal Data Transfer
We may share Personal Data with third party providers so they can provide you with certain services through the App. Achieving this may require sharing Personal Data with external third party providers, as required for one of the purposes set out in Section [1] and [2]. We will require these third party providers to take steps to ensure that your Personal Data is kept secure and used in accordance with this Privacy Notice. However, we shall not be liable for any unauthorised use of your Personal Data by a third-party provider. We may share your data with:

• Third-Party Service Providers: Including CRM systems (e.g., Zoho), analytics providers (e.g., Google Analytics)
• Legal Authorities: When required to comply with a legal obligation or to protect our rights.

We may also subcontract processing to, or share your personal data with, third parties located in countries other than your home country. Personal data collected within the KSA may be transferred to and processed by third parties located in a country outside of KSA. We will in such case ensure that the transfer of your personal data is carried out in conformity with applicable law and that all appropriate contractual, technical, and organisational measures are in place such as the Standard Contractual Clauses approved by the SDAIA (or any amendment or replacement thereof).

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Your Consent: For processing your data where required by law.
• Contractual Necessity: To fulfill our obligations when you interact with our services.
• Legitimate Interests: For operational purposes, including improving services and ensuring security.
• Legal Obligation: lawful basis for processing personal data where an organization is required by law or regulation to collect, use, or disclose personal data.

Children’s data or Individual lacking legal capacity 

We understand the importance of taking extra precautions to protect the privacy and safety of children using SELA products and services. 
SELA websites are designed and intended for use by adults. Where one of our websites is intended for use by a younger audience, we will obtain consent from the person with parental responsibility before we collect personal data where it is required by applicable laws and regulations 
If you are a child under the age where parental consent is required under KSA Personal Data Protection Law, you should review the terms of this Privacy Notice with your parent or guardian to make sure you understand and accept them. If we discover that we have collected personal data from a child without consent from a parent or guardian where such consent should have been obtained, we will delete that personal data as soon as practical.

Data Storage

Personal data is stored securely on Microsoft Azure data centers located in UAE North, adhering to strict security guidelines. Your Personal Data will be stored on the servers available to SELA or to the persons in charge located in Kingdom of Saudi Arabia. Should it become necessary for technical and/or operational reasons to use subjects located outside the Kingdom of Saudi Arabia, or should it become necessary to transfer some of the collected Personal Data to technical systems and services managed in the cloud and located outside the Kingdom of Saudi Arabia, the processing will be regulated in compliance with the provisions of the Applicable Laws regarding data transfers.

Data Retention

Your personal data will be retained only for as long as necessary to fulfill the purposes outlined in this Privacy Notice or as required by law except in case of extraordinary necessity of SELA to keep the Personal Data further in order to defend its rights, also in relation to disputes existing at the time of the request or upon indication of public authorities or as otherwise permitted by the Applicable Laws. The above shall be retained until the withdrawal of the relevant consent or until you expressly request the deletion of such Personal Data, which shall be deleted or anonymized in accordance with our internal policies, part of which is requesting third party providers to provide destruction confirmation, which confirms that Personal Data has been securely and permanently destroyed in accordance with agreed standards.

User Rights

Under applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL), you have the following rights:

• Right to be Informed: You can request information about the legal basis and the purpose of the collection of your Personal Data
• Right to Access: You can request access to the personal data we hold about you.
• Right to Correction: You can request correction of any inaccurate or incomplete data.
• Right to Obtain: You can request your information held by us in a readable and clear format, in accordance with the controls and procedures specified by the Regulations.
• Right to Destruction : You can request the deletion of your personal data when no longer necessary for the purpose for which it was collected or lapse of the period except case under consideration before a judicial or regulatory authority. 
• Right to Withdraw Consent: You can withdraw your consent for us to process your data.
• Right to Object: You can object to the processing of your data under specific circumstances.

To exercise these rights, please contact us at DPO@sela.sa.

Complaints

If you believe your rights have been violated or if you have concerns about our data processing practices, you have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA) by emailing Suggestions@sdaia.gov.sa.

Changes to this Notice

We may update this Privacy Notice from time to time. Any changes will be effective immediately upon posting the revised notice on our Platforms, and your continued use of the Platforms will signify your acceptance of such changes.