Privacy Policy and Personal Data Protection photohom.net

Establishment Date: November 1, 2025

Introduction:

Photohom is committed to protecting the privacy of your personal data and processing it in accordance with the provisions of the Personal Data Protection Law (PDPL) and its implementing regulations in the Kingdom of Saudi Arabia, and in compliance with Royal Decree No. (M/19) dated 09/02/1443 AH.

This policy explains how we collect and process your personal information, including data related to you.

First - Data Processing Terms

We collect and process your personal data with your explicit consent or when necessary for a legitimate purpose, or to fulfill a non-conformity obligation.

Second - Types of Personal Data We Collect

We are committed to collecting the data necessary for the specified purposes. We may collect the following:

1) Personal Information: Your name, email address, and phone number.

2) Data and Technology: Your primary web address, browser data, pages visited, time, and recent unique identifiers, for the purpose of statistical analysis of user experience.

3) Cookies: Cookies are used to improve website functionality. You have the option to disable cookies through your browser settings.

Third - Harvesting and Data Collection

Your data is used exclusively for the purposes for which it was collected, including:

1) Providing and maintaining the services available on the website.

2) Communicating with you comprehensively regarding your inquiries or support requests.

3) Publishing newsletters or updates (with the option to unsubscribe at any time).

Analyzing website performance and user experience.

Fourth - How Data is Stored, Secured, and Protected

1) Storage: Your personal data is stored in a secure and reliable environment within the Kingdom of Saudi Arabia, in accordance with national cybersecurity regulations.

2) Security: We apply partial administrative, organizational and technical measures to completely protect your data from unauthorized access, alteration or disclosure. 3) Destruction: Personal data is destroyed securely (e.g., through secure digital deletion) immediately after the purpose for which it was collected and the legally defined retention period has ended, unless otherwise required by law.

Fifth - Data Disclosure and Sharing

1) We do not sell or disclose your personal data to third parties except in the following cases:

2) Service Providers: With third parties who provide services on our behalf (e.g., hosting or analytics services), and who are bound by strict confidentiality agreements and data protection controls with us.

3) Regulatory and Legal Requirements: To comply with a court order or applicable regulation in the Kingdom of Saudi Arabia.

4) With Your Consent: After obtaining your explicit and prior consent.

Sixth - Your Rights as a Data Subject

Under the Saudi Personal Data Protection Law, you have the following rights:

1) The Right to Know: To be informed of the legal basis and purpose for which your data is collected.

2) The Right to Access: To request access to your personal data that we hold and to receive a copy of it in a clear and legible format.

3) Right to Correction and Update: You have the right to request that your personal data be corrected, completed, or updated if it is inaccurate or incomplete.

4) Right to Destruction: You have the right to request that your personal data be destroyed when it is no longer needed to fulfill the purpose for which it was collected.

5) Right to Withdraw Consent: You have the right to withdraw your consent to processing at any time, without this affecting the lawfulness of the processing that took place prior to the withdrawal.

Seventh - How to Exercise Your Rights or File a Complaint

To exercise any of the rights mentioned above, or if you have any concerns about how we handle your data, please contact us using the contact information below.

If we are unable to resolve your complaint, you have the right to file a complaint with the competent authority overseeing the Personal Data Protection System in the Kingdom, which is the Saudi Data & Artificial Intelligence Authority (SDAIA), within 90 days of the incident.