KOMPLY PRIVACY POLICY

Effective Date: 25 August 2026

Last Updated: 24 August 2026

Version: 1.9

1. INTRODUCTION

1.1 Altamuh Aljariy Company ("Komply", "we", "us") operates the Komply compliance-tracking service. We handle personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, Royal Decree No. M/19 dated 09/02/1443H as amended by Royal Decree No. M/148 dated 05/09/1444H (the "PDPL"), its Implementing Regulations, the Regulations on Personal Data Transfer outside the Kingdom, and guidance issued by the Saudi Data & Artificial Intelligence Authority ("SDAIA").

1.2 This Policy explains what personal data we collect, why, on what legal basis, who we share it with, where it is stored, how long we keep it, and what rights you have.

1.3 "Personal data" means any data, whatever its source or form, that may lead to identifying an individual specifically, or make identifying them possible directly or indirectly.

1.4 This Policy forms part of the Komply Terms of Use.

2. WHO WE ARE

3. CONTROLLER AND PROCESSOR

3.1 Where we are the controller. We decide the purposes and means of processing, and this Policy applies directly, for:

• your account data (email, password, display name);
• your business profile and questionnaire answers;
• your tracker activity and feedback;
• correspondence you send us;
• technical data generated when you use the Services.

3.2 Where we are a processor. Documents you upload, such as commercial registrations, licences and certificates, may contain personal data about individuals other than you, such as owners, managers or signatories. For that data you are the controller and we are the processor, acting on your instructions. You are responsible for having a lawful basis to upload it and for any notices or consents required. Our obligations are set out in Section 8 of the Terms of Use at www.komplyapp.com/terms.

3.3 If an individual contacts us about data we hold only as a processor, we will refer them to you and assist you in responding.

4. WHAT WE COLLECT

4.1 Data you give us

We do not collect national ID or Iqama numbers as structured data. Documents you choose to upload may contain them.

We do not collect or store payment card details. Card data is handled directly by Moyasar.

4.2 Data generated automatically

4.3 Cookies

We do not use cookies. Your login session is kept using your browser's local storage, which is necessary for the Services to function and is cleared when you sign out. Because we set no analytics, advertising or tracking cookies, no consent banner is shown.

We use Umami, self-hosted on our own server in Riyadh, to understand which pages and features are used. It is cookieless, collects no personal data, and the data never leaves the Kingdom or reaches a third party.

If any third-party analytics or error-monitoring tool is added, this Section and Section 6 will be updated and consent obtained where required before it is enabled.

5. IF YOU DO NOT PROVIDE DATA

Account data, business data and questionnaire answers are required, because the Services cannot generate a compliance checklist without them.

Your role is required too, but for a different reason, and we would rather say so than leave it sitting under the sentence above. It has no effect on your checklist at all. We ask because a business owner, an accountant, a lawyer and a compliance officer need different things from the same list, and we cannot build well for people we cannot see. Because it is not needed to deliver the Services, Prefer not to say is one of the answers. It is a complete answer, and nothing follows from choosing it.

Uploading documents and submitting feedback are optional.

6. WHY WE PROCESS IT, AND ON WHAT BASIS

6.1 Legitimate interest. Where we rely on legitimate interest, we satisfy ourselves that the processing is necessary and does not prejudice your rights. We do not rely on legitimate interest for sensitive personal data.

6.2 We do not send marketing emails. Emails we send are authentication messages, deadline reminders, replies to your enquiries, and service notices such as changes to these documents. If we introduce marketing in future, we will obtain your consent first and give you a free way to opt out in every message, as the PDPL requires.

6.3 We will not use your data for a purpose inconsistent with the one it was collected for. If a new purpose arises, we will update this Policy and obtain consent where required.

6.4 Withdrawing consent. Where we rely on consent, you may withdraw it at any time at no cost by writing to info@komplyapp.com. Withdrawal does not affect processing already carried out, or processing resting on another basis.

7. SENSITIVE PERSONAL DATA

7.1 Sensitive personal data under the PDPL includes data revealing racial or ethnic origin, religious, intellectual or political belief, security or criminal-conviction data, biometric or genetic data identifying a person, health data, and data indicating that one or both parents are unknown.

7.2 We do not ask for sensitive personal data and the Services are not designed to hold it. Do not upload it.

7.3 If you upload a document containing sensitive personal data, you are responsible for the explicit consent or other lawful basis required under the PDPL.

7.4 We do not use any personal data for profiling, advertising or awareness campaigns.

8. WHO WE SHARE IT WITH

We do not sell, rent or trade personal data. We share it only as set out below.

8.1 We require providers to process personal data only as needed to deliver their service to us.

8.2 An updated list of providers is available on request from info@komplyapp.com.

8.3 Moyasar is a separate controller, not our processor. When you enter card details, you give them directly to Moyasar. We never receive or store the card number. Moyasar decides how it processes that information and is accountable for it in its own right. Moyasar's privacy policy applies to it and is available at moyasar.com/en/resources/privacy-policy. We hold only what Moyasar returns to us: the card brand, the last four digits, the expiry date, and identifiers linking a payment to your Account. You may ask us to delete a saved card at any time; we delete it at Moyasar first and then remove it from our records, and your paid period is unaffected.

8.4 Our former payment provider. Until 23 August 2026, payments were processed by Tap Payments. If you paid through it, your card details were handled by Tap as an independent controller and its own policy applies, available at www.tap.company/en-sa/privacy. We keep records of those payments within our accounting records for the period set out in the retention table.

8.4 Single account access. The Services are accessed through a single Account, with no facility currently to invite additional users to a Business.

9. WHERE YOUR DATA IS STORED

9.1 Your account data, business profile, questionnaire answers, tracker data and uploaded documents are stored on infrastructure located in Riyadh, Kingdom of Saudi Arabia, on Oracle Cloud Infrastructure in the `me-riyadh-1` region. Authentication and reminder emails are sent from the same region.

9.2 Limited processing does take place outside the Kingdom, and we set it out plainly rather than claim otherwise:

(a) Cloudflare delivers the static frontend of the website. It holds no account data, but your IP address and connection metadata pass through its network outside the Kingdom.

(b) Google Workspace hosts our correspondence mailbox. If you email us, the content of that email, including any personal data in it, is stored and processed by Google outside the Kingdom.

(c) Moyasar processes payment card information and operates under the control and supervision of the Saudi Central Bank. Its published privacy policy states that it does not transfer personal data outside the Kingdom of Saudi Arabia. Because Moyasar collects that data directly from you as an independent controller, and it never passes through our systems, the arrangements for it are governed by its own policy and its regulator rather than by us.

9.3 Where personal data is transferred outside the Kingdom, we rely on the grounds permitted by Article 29 of the PDPL, limit the transfer to the minimum necessary, and satisfy ourselves that the transfer does not prejudice national security or the vital interests of the Kingdom.

9.4 Please do not send sensitive or confidential personal data to us by email. Use the Services themselves, which are hosted in the Kingdom.

10. HOW LONG WE KEEP IT

10.1 We will destroy personal data once it is no longer necessary for the purpose it was collected for, unless retention is required by law or is necessary to establish or defend a legal claim.

10.2 Deletion is permanent. Once an account is deleted under the inactivity process, the data cannot be recovered.

11. SECURITY

11.1 We describe below the measures actually in place. We do not claim certifications or controls we do not hold.

In place:

• Encryption in transit using TLS, terminated at our reverse proxy;
• Encryption at rest as provided by default by Oracle Cloud block volume encryption;
• Passwords stored hashed, never in readable form;
• Row level security enforced in the database, so one Account cannot read another Account's Businesses and cannot write anything into a Business it does not belong to. Administrators are a declared exception, described in Section 11.3. This is tested rather than asserted: before each version of this Policy is published, we run an automated test that signs in as separate real accounts and attempts those cross account reads and writes against the live system, and it fails if any of them succeeds;
• Uploaded files stored in a private area, not publicly reachable by direct link, and restricted to the Account that owns the relevant Business. Administrators are granted no access to that area, and none to the separate private area holding data export archives, both of which are deliberate. The same test confirms that an administrator account cannot download one of your documents, obtain a link to one, or list what is stored. See Section 11.3;
• File type and size restrictions on upload;
• Daily encrypted backups to Object Storage with 30-day retention, and a tested restore procedure.

Not yet in place, and being worked on:

• A documented incident response plan;
• A personal data breach register;
• Periodic access reviews;
• Independent penetration testing.

11.2 No system is completely secure. You are responsible for keeping your password confidential and for securing your own devices and email account.

11.3 Administrator access to your Account. A small number of our administrators can open your Account record, to support you, to look into a problem, or to answer a billing question. What they see is your display name, email address, the Businesses on your Account, your subscription, the obligations recorded against those Businesses, your record of accepting these documents, the file names and dates of the documents you have uploaded, though never the documents themselves, and the role you told us you have. Before the record opens, the administrator must choose a reason from a fixed list and, where the reason is anything other than the listed ones, write it out. That reason, their identity and the time are written to an access log that they cannot edit or delete. Administrators cannot open the documents you upload, and cannot open a data export archive; those two areas grant them no access at all. We would rather tell you this plainly than let you assume no one can ever see your Account.

12. PERSONAL DATA BREACH

12.1 If a personal data breach occurs, we will notify SDAIA within seventy-two (72) hours of becoming aware of it, as the PDPL Implementing Regulations require.

12.2 We will notify affected individuals without undue delay where a breach may cause serious harm to them or their data, describing what happened, the likely consequences, and what we and they can do.

12.3 Where a breach affects data we hold as a processor for you, we will notify you without undue delay so you can meet your own obligations.

12.4 A documented incident response process is in development. Until it is complete, breach handling is managed directly by the Company's management at info@komplyapp.com.

13. YOUR RIGHTS

Subject to the conditions and exceptions in the PDPL:

13.1 How to exercise them. Email info@komplyapp.com, describing the right you want to exercise. Account deletion is also available directly in your Account settings and removes your data from the live database and file storage immediately. You can separately delete a single Business, together with its documents, without closing your Account. In both cases we keep one deletion record, and Section 10 sets out exactly what it contains and why.

13.2 Export. You can export your own data from your Account settings, without asking us. We prepare an archive containing your account and Business records, the role you told us you have, your questionnaire answers, your tracker data, the compliance acknowledgments recorded against your Businesses, your feedback, your record of accepting these documents, and copies of the documents you have uploaded. It is ready to download for 7 days, after which it is deleted automatically and you can request another. One export may be requested every 24 hours. If you would rather we produced a copy for you, write to info@komplyapp.com.

13.3 Verification. We will verify your identity before acting, and may ask for reasonable information for that purpose only.

13.4 Timing. We will respond within thirty (30) days of a valid request, extendable by a further thirty (30) days for complex or repeated requests, with notice to you within the first period.

13.5 Limits. We may decline or restrict a request where the PDPL permits, for example where it conflicts with a legal or judicial obligation, harms another person's rights, prejudices an investigation, or where the request is manifestly unfounded or excessive. We will explain why and tell you about your right to complain.

13.6 Exercising your rights is free.

14. CHILDREN

14.1 The Services are for business use and are not directed to anyone under eighteen (18).

14.2 We do not knowingly collect data about a child or a person lacking legal capacity without a guardian's consent. If you believe we have, contact info@komplyapp.com and we will investigate and delete it where appropriate.

15. COMPLAINTS

15.1 Please raise concerns with us first at info@komplyapp.com.

15.2 You may also complain at any time to the Saudi Data & Artificial Intelligence Authority (SDAIA) at https://sdaia.gov.sa, through its official channels for personal data protection complaints.

15.3 For consumer or e-commerce matters, you may contact the Ministry of Commerce through its official channels.

16. AUTOMATED PROCESSING

16.1 The Services match obligations to your business using a rules-based engine applied to your questionnaire answers. This determines which items appear on your checklist.

16.2 This is not a decision producing legal effects about you. It is a suggestion for your review, and it may be incomplete or wrong. See the Terms of Use.

16.3 The Services do not use artificial intelligence, and we do not use your data to train any model.

17. CHANGES TO THIS POLICY

17.1 We may update this Policy to reflect changes in law or in our practices, including when analytics, error monitoring, billing or new features are introduced.

17.2 The updated Policy will be published with a new Effective Date. For material changes we will give at least thirty (30) days' notice by email or in-product notice.

17.3 Where a change requires your consent under the PDPL, we will obtain it before the change takes effect.

18. CONTACT

info@komplyapp.com

Altamuh Aljariy Company

19. LANGUAGE

This Policy is issued in Arabic and English. In the event of any discrepancy or difference in interpretation, the Arabic version prevails and is the version relied upon before the courts and authorities of the Kingdom of Saudi Arabia.

© 2026 Altamuh Aljariy Company. All rights reserved.