KOMPLY TERMS OF USE

Effective Date: 25 August 2026

Last Updated: 24 August 2026

Version: 1.3

SERVICE PROVIDER DISCLOSURE

(Disclosed under the Saudi E-Commerce Law, Royal Decree No. M/126 dated 07/11/1440H, and its Implementing Regulations.)

1. INTRODUCTION AND ACCEPTANCE

1.1 These Terms of Use (the "Terms") govern access to and use of the Komply web application and related services (the "Services"), operated by Altamuh Aljariy Company ("Komply", "we", "us").

1.2 By creating an account or using the Services, you confirm that you have read, understood and agree to be bound by these Terms and by the Komply Privacy Policy at www.komplyapp.com/privacy, which forms part of these Terms.

1.3 If you do not agree, you must not use the Services.

1.4 Acceptance by electronic means is valid and binding under the Electronic Transactions Law, Royal Decree No. M/18 dated 08/03/1428H.

1.5 If you accept these Terms on behalf of a business, you represent that you are authorised to bind that business, and "you" means that business.

2. DEFINITIONS

"Account": the registered account through which you access the Services.

"Business": a business record you create in the Services, together with its profile and tracker data.

"Business Data": everything you enter or upload: business details, questionnaire answers, tracker state, uploaded documents, and feedback.

"Obligations Dataset": the library of regulatory obligations maintained by Komply within the Services.

"PDPL": the Personal Data Protection Law, Royal Decree No. M/19 dated 09/02/1443H, amended by Royal Decree No. M/148 dated 05/09/1444H, with its Implementing Regulations and the Regulations on Personal Data Transfer outside the Kingdom.

"Subscription": a paid plan as described in Section 11.

3. WHO THE SERVICES ARE FOR

3.1 The Services are intended for business use by owners, managers and their advisers. They are not designed for personal or household use.

3.2 You must be at least eighteen (18) years of age and have legal capacity to contract under the laws of the Kingdom.

3.3 Where a user nevertheless qualifies as a consumer under the E-Commerce Law, nothing in these Terms limits any mandatory right granted to that user by Saudi consumer protection law, and any mandatory right prevails over a conflicting provision here.

4. ACCOUNTS AND SECURITY

4.1 Registration requires an email address, a password, and a display name. You must provide accurate information and keep it current.

4.2 You are responsible for keeping your password confidential and for activity under your Account.

4.3 You must not share credentials or transfer your Account.

4.4 Notify us at info@komplyapp.com immediately if you believe your Account has been accessed without authorisation.

4.5 We may suspend or reset credentials we reasonably believe to be compromised.

5. THE SERVICES

5.1 Komply is a compliance-tracking tool for businesses in the Kingdom. The Services allow you to:

(a) create one or more Business records and complete a profiling questionnaire (legal structure, sector, revenue band, employee count, foreign ownership, physical premises, and whether the business processes personal data);

(b) receive a checklist of regulatory obligations matched to that profile from the Obligations Dataset;

(c) track obligations as done or hidden, record dates, and add your own custom obligations;

(d) upload and store supporting documents against obligations;

(e) receive scheduled deadline reminders by email;

(f) flag an obligation as inaccurate and submit feedback.

5.2 We grant you a limited, revocable, non-exclusive, non-transferable licence to use the Services for your own business purposes for as long as your Account is active and within your plan's limits.

5.3 We may add, change or remove features. Where a change materially degrades a core feature of a paid Subscription, we will give reasonable notice and, at your election, refund fees for the unused remainder of the paid period.

6. NO LEGAL ADVICE AND NO GUARANTEE OF COMPLIANCE

6.1 This Section is fundamental to the bargain between us. Please read it carefully.

6.2 Komply is a software provider. It is not a law firm, not a licensed advocate under the Code of Law Practice (Royal Decree No. M/38 dated 28/07/1422H), not a licensed accounting or audit firm, and not a conformity assessment body.

6.3 The Obligations Dataset, checklists, reminders and other content are provided for general informational and organisational purposes only. They are not legal, regulatory, tax, accounting or professional advice and must not be relied on as a substitute for advice from a qualified professional.

6.4 No lawyer-client or advisory relationship arises from your use of the Services.

6.5 Regulatory requirements in the Kingdom change frequently. While we take reasonable care in maintaining the Obligations Dataset, we do not warrant that it is current, complete, accurate, or applicable to your business. The matching produced by the questionnaire is an automated approximation based on the answers you give; it may omit obligations that apply to you and may list obligations that do not.

6.6 Use of the Services does not guarantee, certify or establish compliance with any law or with the requirements of any authority, including SDAIA, the National Cybersecurity Authority, the Ministry of Commerce, ZATCA, the Saudi Central Bank, the Capital Market Authority, or the Communications, Space & Technology Commission. Responsibility for your compliance rests solely with you.

6.7 You are responsible for verifying every obligation, deadline and requirement independently before acting on it.

7. YOUR DATA AND YOUR RESPONSIBILITIES

7.1 Ownership. As between us, you retain all rights in your Business Data. We claim no ownership.

7.2 Licence to us. You grant us a non-exclusive, royalty-free licence to host, store, transmit and process Business Data solely to operate, secure and support the Services and to comply with law. It ends when the data is deleted, subject to the backup cycle described in the Privacy Policy.

7.3 Accuracy. You are responsible for the accuracy and legality of your Business Data. The checklist you receive is only as good as the questionnaire answers you provide.

7.4 Prohibited data. Do not upload classified or restricted government information, payment card data, sensitive personal data as defined in the PDPL, or data whose storage by us would breach applicable law.

7.5 Keep your own copies. Komply is a tracking tool, not a system of record or a statutory archive. You remain responsible for retaining original documents and records as required by law.

7.6 Aggregated data. We may produce aggregated, anonymised statistics from use of the Services, provided they cannot identify you or any individual. Anonymised data falls outside the PDPL.

8. PROCESSING OF PERSONAL DATA ON YOUR BEHALF

8.1 Documents you upload, such as commercial registrations, licences and certificates, may contain personal data about individuals other than you, such as owners, managers or signatories. In respect of that data you are the data controller and we are the data processor under the PDPL. This Section sets out the terms of that processing and applies in addition to the Privacy Policy.

8.2 Instructions. We process personal data contained in your Business Data only to provide, secure and support the Services, in accordance with the instructions you give through your use of the Services, and as required by applicable law. If we believe an instruction breaches the PDPL, we will tell you.

8.3 Purpose limitation. We will not use that personal data for our own purposes, will not sell or disclose it except as permitted by these Terms or required by law, and will not use it to train any model.

8.4 Confidentiality and staff access. Personnel authorised to process personal data are bound by confidentiality obligations. Our staff can view your Account and Business records where necessary to provide support, and every such view is recorded in an access log together with the reason for it. Our staff cannot open the documents you upload; the administration tools deliberately provide no means to do so.

8.5 Security. We apply the technical and organisational measures described in Section 11 of the Privacy Policy.

8.6 Sub-processors. We use Oracle Cloud Infrastructure (Riyadh) for hosting and email delivery. We will give you reasonable notice before adding a new sub-processor that will process personal data contained in your Business Data.

8.7 Location. Personal data contained in your Business Data is hosted in the Kingdom of Saudi Arabia and is not transferred outside it.

8.8 Assistance. We will assist you, so far as reasonably practicable, in responding to requests from data subjects and in meeting your obligations on security, breach notification and impact assessments. If an individual contacts us directly about data we hold only as your processor, we will refer them to you.

8.9 Breach. We will notify you without undue delay after becoming aware of a personal data breach affecting your Business Data, with the information reasonably available to us.

8.10 Deletion. On termination, or on your instruction, we delete the personal data in accordance with the retention periods in the Privacy Policy.

8.11 Your warranties. You warrant that you have a lawful basis under the PDPL for uploading each document containing personal data, that you have given any required privacy notices, and that you have obtained any required consents.

9. ACCESS TO YOUR ACCOUNT

9.1 The Services are accessed through a single Account. There is currently no facility to invite additional users to a Business.

9.2 You are responsible for keeping your credentials confidential and for everything done through your Account. If you share your credentials with anyone, you remain responsible for their actions.

9.3 Access is enforced at the database level so that an Account can only reach its own Businesses and their data.

9.4 If we introduce multi user access in future, we will update these Terms and notify you before it applies to your Account.

10. THE OBLIGATIONS DATASET

10.1 The Obligations Dataset is compiled by Komply from publicly available regulatory sources. Each entry records the issuing authority and a source reference where available.

10.2 We update the Dataset periodically. We do not commit to any update frequency, and there may be a delay between a regulatory change and its reflection in the Services.

10.3 If you believe an entry is wrong, please flag it in the Services. We review flags but do not commit to a response time.

10.4 The Dataset is our content and is licensed to you under Section 16, not transferred.

11. SUBSCRIPTIONS, FEES AND TAX

11.1 Plans. The following plans are offered:

All prices are in Saudi Riyals.

11.2 VAT. As at the Effective Date the Company is not registered for Value Added Tax, no VAT is charged on the prices above, and we do not issue tax invoices. If the Company becomes VAT-registered, VAT will be added at the statutory rate then in force and we will notify you before it applies.

11.3 Billing. Payments are processed by Moyasar, which operates under the control and supervision of the Saudi Central Bank. We do not receive or store your full card number. Moyasar acts as an independent data controller with regard to your payment instrument information, and its processing of that information is governed by Moyasar's own privacy policy at moyasar.com/en/resources/privacy-policy. Your use of a card is additionally subject to Moyasar's own terms. Until 23 August 2026 payments were processed by Tap Payments, and payments made through it remain subject to the terms of that period.

11.4 Renewal. Paid Subscriptions renew automatically at the end of each paid period at the then-current price, unless cancelled. You may cancel at any time from your Account settings; access continues to the end of the paid period and the Subscription does not renew.

11.5 Price changes. We may change prices on at least thirty (30) days' notice by email. Changes apply from your next renewal. If you do not accept a change, cancel before the renewal date.

11.6 Failed payment. We may retry the charge, suspend access, or terminate the Subscription where payment is more than fifteen (15) days overdue. No interest or other riba-based charge is applied to late payment.

12. FREE TRIAL

12.1 We offer a seven (7) day free trial. No payment card is required.

12.2 At the end of the trial, access ends automatically. Nothing is charged, the trial does not convert into a paid Subscription, and there is nothing to cancel.

12.3 To continue using the Services after the trial, subscribe to a paid plan.

12.4 We may limit eligibility to one trial per business or person, and may withdraw or change the trial at any time.

12.5 If you do not subscribe, we may delete data associated with a lapsed trial after thirty (30) days.

13. CANCELLATION AND REFUNDS

13.1 Cancellation. You may cancel at any time from your Account settings. Access continues to the end of the period you have paid for, and the Subscription does not renew. Cancellation is not required for a free trial, which simply ends.

13.2 Monthly and annual plans are non-refundable. Fees already paid for a current period are not refunded on cancellation, and part-periods are not refunded. This applies where you cancel. It does not apply where we terminate your Subscription for convenience, which is dealt with in Sections 13.8 and 20.4.

13.3 Always corrected, regardless of Section 13.2. We will always return money where you have been charged incorrectly, including:

(a) duplicate charges;

(b) charges taken after you cancelled;

(c) charges taken in error.

These are billing corrections rather than refunds, and Section 13.2 does not limit them.

13.4 Closure of your business. If your business ceases to operate, cancelling stops future renewals. The remainder of a paid period is not refunded.

13.5 How to request. Email info@komplyapp.com. We acknowledge within three (3) business days. Approved amounts are returned to the original payment method within fourteen (14) days.

13.6 Delay in performance. Under the E-Commerce Law, where we fail to commence performance within fifteen (15) days of the contract date, or by another agreed date, you may terminate and recover amounts paid, unless the delay results from force majeure.

13.7 Statutory withdrawal right. The E-Commerce Law gives a consumer seven (7) days to terminate a service contract, provided the service has not been used or benefited from, and expressly excludes software and digital content accessed or downloaded over the internet. Once you have accessed the Services, that right does not apply.

13.8 Where we terminate. No refund is due where we terminate for your material breach. Where we terminate for convenience under Section 20.4, we refund the unused remainder of the paid period pro-rata.

13.9 Nothing in this Section limits any mandatory right you may have under Saudi consumer protection law.

14. ACCEPTABLE USE

14.1 Use the Services lawfully and in accordance with the laws of the Kingdom, including the Anti-Cyber Crime Law (Royal Decree No. M/17 dated 08/03/1428H), the PDPL, and the Copyright Law (Royal Decree No. M/41 dated 02/07/1424H).

14.2 You must not:

(a) copy, extract, republish or resell the Obligations Dataset, in whole or in substantial part;

(b) use the Services to build, train or benchmark a competing product;

(c) reverse engineer, decompile or attempt to derive the source code, except where mandatory law prohibits this restriction;

(d) resell, sublicense or provide the Services to third parties without a written agreement with us;

(e) circumvent access controls, usage limits or plan restrictions;

(f) scrape or use automated means to extract data from the Services;

(g) upload malware or any code intended to disrupt or gain unauthorised access;

(h) conduct penetration testing or vulnerability scanning without our prior written permission;

(i) upload content that is unlawful in the Kingdom, offends public order or Islamic values, or infringes the rights of others;

(j) upload personal data without a lawful basis; or

(k) interfere with the integrity, performance or availability of the Services.

14.3 We may investigate suspected violations, remove content, suspend access, and report matters to authorities where legally required.

15. FILE UPLOADS

15.1 Uploads are limited to PDF, JPEG and PNG files of up to 10 MB each. We may change these limits.

15.2 Uploaded files are stored in a private bucket accessible only to the Account that owns the relevant Business.

15.3 We do not review the content of uploaded files. You are responsible for what you upload.

15.4 Deleting a document, an obligation or a Business removes the associated stored files.

16. INTELLECTUAL PROPERTY

16.1 The Services, including the software, interface, design and the Obligations Dataset, are owned by the Company or its licensors and protected under the Copyright Law and applicable treaties.

16.2 "Komply" is a trading name used by the Company. It is not a registered trademark, and nothing here should be read as a claim to registered rights.

16.3 All rights not expressly granted are reserved.

17. FEEDBACK

If you send us suggestions or feedback, you grant us a perpetual, irrevocable, royalty-free right to use it without obligation or compensation. Do not send us third-party confidential information.

18. THIRD-PARTY SERVICES

18.1 The Services rely on third-party providers, including Oracle Cloud Infrastructure (hosting and email delivery), Cloudflare (frontend delivery), Google Workspace (our correspondence), and Moyasar (payments).

18.2 We do not control these providers and are not liable for their acts, omissions, outages or changes to their services.

19. AVAILABILITY AND SUPPORT

19.1 We aim to keep the Services available but do not commit to any uptime level, service level agreement or support response time. No SLA applies unless separately agreed in writing.

19.2 We may perform maintenance, and will try to give notice and schedule it outside standard business hours in the Kingdom where practicable. Emergency maintenance may occur without notice.

19.3 Support is provided by email at info@komplyapp.com, in Arabic and English, on a reasonable-efforts basis.

19.4 Deadline reminders are sent by email as a convenience. We do not guarantee that a reminder will be sent, delivered or received, and you must not rely on them as your only means of tracking a deadline.

20. SUSPENSION AND TERMINATION

20.1 We may suspend access immediately where required by law or an authority, where we reasonably suspect fraud, a security threat or unlawful use, where your use threatens the Services or other users, or where payment is more than fifteen (15) days overdue.

20.2 You may terminate by cancelling and closing your Account.

20.3 We may terminate on written notice if you materially breach these Terms and do not remedy it within fifteen (15) days, or if the breach cannot be remedied.

20.4 We may terminate a free Account or trial at any time, and a paid Subscription on thirty (30) days' notice. Where we terminate a paid Subscription for convenience under this Section, we refund the unused remainder of the paid period pro-rata. This is the only circumstance in which a Subscription fee is refunded, and it applies because the termination is ours and not yours; it does not affect Section 13.2.

20.5 On termination, access ceases and outstanding fees fall due. Deletion of data is governed by the Privacy Policy.

20.6 Sections 6, 7.1, 7.5, 7.6, 8.3, 8.10, 14, 16, 17, 20.5, 21, 22, 23, 24, 29, 30, 31 and 32 survive termination.

21. CONFIDENTIALITY

21.1 Each party will keep the other's non-public information confidential, use it only for the purposes of these Terms, protect it with at least reasonable care, and disclose it only to personnel and advisers bound by equivalent duties.

21.2 This does not apply to information that is public without breach, already lawfully known, independently developed, or lawfully received from a third party.

21.3 Disclosure required by law, court order or a competent authority is permitted, with prompt notice to the other party where legally allowed.

21.4 These obligations continue for three (3) years after termination, and indefinitely for personal data.

22. DISCLAIMER OF WARRANTIES

22.1 To the maximum extent permitted by the laws of the Kingdom, the Services are provided "as is" and "as available", without warranties of any kind, express, implied or statutory.

22.2 We do not warrant that the Services will be uninterrupted, secure or error-free, that defects will be corrected, that the Obligations Dataset is accurate or complete, or that the Services will meet your requirements.

22.3 Nothing here excludes liability for fraud, wilful misconduct, gross negligence, or any liability that cannot be excluded under mandatory Saudi law.

23. LIMITATION OF LIABILITY

23.1 Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill, business opportunity or data.

23.2 Subject to Section 23.4, our total aggregate liability will not exceed the fees you actually paid us in the twelve (12) months before the event giving rise to the claim. Where you use the Services free of charge, our aggregate liability will not exceed SAR 500.

23.3 We are not liable for: (a) any fine, penalty or enforcement action imposed on you by any authority; (b) your failure to comply with any legal or regulatory requirement; (c) any obligation, deadline or requirement that the Services omitted, listed incorrectly, or reflected late; (d) a reminder that was not sent, delivered or received; (e) loss of Business Data where you did not keep your own copies; or (f) the acts or omissions of third-party providers.

23.4 Nothing here limits liability that cannot be limited under mandatory Saudi law.

23.5 Consistent with the principles of Islamic Sharia applied by Saudi courts, recoverable damages are limited to direct, actual and proven loss. Neither party may claim speculative or contingent damages or loss of opportunity.

23.6 Claims must be brought within twelve (12) months of your becoming aware of the circumstances giving rise to them, to the extent permitted by law.

24. INDEMNIFICATION

24.1 You will indemnify us against direct, actual and proven losses and reasonable legal costs awarded by a competent Saudi court or agreed in settlement, arising from your breach of these Terms or applicable law, your Business Data, or your use of the Services outside what these Terms permit.

24.2 We must promptly notify you of any claim, allow you to control the defence, and cooperate reasonably. No settlement admitting liability may be made without the other party's consent, not to be unreasonably withheld.

25. FORCE MAJEURE

Neither party is liable for failure or delay in performance (other than payment) caused by events beyond its reasonable control, including natural disasters, epidemics, war, civil unrest, government action, changes in law, failure of telecommunications or internet infrastructure, power outages, third-party provider outages, or large-scale cyber-attacks. If the event continues for more than sixty (60) consecutive days, either party may terminate on notice, with a pro-rata refund of the unused remainder of the paid period.

26. SANCTIONS AND LAWFUL USE

26.1 Each party will comply with applicable anti-bribery, anti-money-laundering and sanctions laws.

26.2 You represent that you are not a person subject to sanctions imposed by the Kingdom or the United Nations Security Council, and that you will not make the Services available to such a person.

27. PRIVACY

27.1 Our handling of personal data is described in the Komply Privacy Policy at www.komplyapp.com/privacy.

27.2 Personal data is hosted on infrastructure located in Riyadh, Kingdom of Saudi Arabia. Limited processing takes place outside the Kingdom as described in the Privacy Policy.

27.3 Where we process personal data on your behalf, Section 8 applies.

28. AMENDMENTS

28.1 We may amend these Terms to reflect changes in law, the Services, or our practices.

28.2 For material changes we will give at least thirty (30) days' notice by email or in-product notice, and the updated Terms will carry a new Effective Date.

28.3 Continued use after the Effective Date is acceptance. If you do not accept, stop using the Services and cancel; we will refund the unused remainder of the paid period pro-rata.

28.4 Changes required by law or by an authority may take effect immediately.

29. NOTICES

29.1 You consent to receive notices, invoices and other communications electronically, and agree they satisfy any legal requirement of writing under the Electronic Transactions Law.

29.2 Notices to you go to the email registered on your Account, or by in-product notice, and are deemed received on the day of sending.

29.3 Notices to us go to info@komplyapp.com. Our registered office is in Riyadh, Kingdom of Saudi Arabia. Our full registered national address is held on the commercial register and is available on request for formal legal notices requiring service at a physical address.

29.4 Keep your contact details current.

30. GENERAL

30.1 Assignment. You may not assign these Terms without our written consent. We may assign to an affiliate or in connection with a sale of the business, on notice.

30.2 Severability. An invalid provision is modified to the minimum extent needed, or severed; the rest continues.

30.3 No waiver. Delay in exercising a right does not waive it.

30.4 Entire agreement. These Terms and the Privacy Policy are the entire agreement on the Services and supersede prior discussions.

30.5 Precedence. In conflict: a signed written agreement, then Section 8 (for personal data processed on your behalf), then the rest of these Terms.

30.6 No partnership. Nothing creates a partnership, agency, joint venture or employment relationship.

30.7 Headings are for convenience only.

31. GOVERNING LAW AND DISPUTES

31.1 These Terms are governed by the laws and regulations of the Kingdom of Saudi Arabia, including the principles of Islamic Sharia.

31.2 The parties will first try in good faith to settle any dispute by negotiation within thirty (30) days of written notice.

31.3 Failing that, disputes will be determined by the competent courts of the Kingdom of Saudi Arabia sitting in Riyadh.

31.4 Either party may seek urgent interim or precautionary relief from a competent Saudi court at any time.

32. LANGUAGE

These Terms are issued in Arabic and English. In the event of any discrepancy or difference in interpretation, the Arabic version prevails and is the version relied upon before the courts and authorities of the Kingdom.

33. CONTACT

All enquiries, complaints, refund requests, legal notices and privacy requests: info@komplyapp.com

We acknowledge within three (3) business days.

© 2026 Altamuh Aljariy Company. All rights reserved.