Article One: Introduction

Hafr Al-Batin Municipality is a government entity with legal personality and financial and administrative independence, established pursuant to Council of Ministers Resolution No. 425 dated 08/08/1439 AH, in accordance with the Municipalities and Villages Law. The Municipality is responsible for delivering municipal services to the residents of Hafr Al-Batin Governorate and its affiliated municipalities and villages. It is committed to continuously enhancing these services and improving quality of life in alignment with Saudi Vision 2030 and the Sustainable Development Goals.

The data generated, received, or processed by the Municipality constitute national assets that contribute to enhancing institutional performance and productivity, facilitating the delivery of public services, supporting effective operations, enabling strategic decision-making, anticipating future needs, and promoting accountability and transparency. As the digital ecosystem continues to evolve rapidly and data becomes increasingly accessible and shareable, safeguarding data has become more critical than ever, while ensuring that its value is maximized in decision-making and the development of plans and strategies for municipal services. To this end, the Municipality establishes policies and regulatory frameworks governing data management in accordance with the National Digital Strategy and national data governance requirements.

In line with the role of the National Data Management Office, as the authority responsible for regulating data management within Hafr Al-Batin Municipality, and pursuant to the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443 AH, as amended by Royal Decree No. (M/148) dated 05/09/1444 AH, together with its Implementing Regulations issued on 29/02/1445 AH, this Privacy Policy has been developed to implement the provisions of the Personal Data Protection Law and its Implementing Regulations. The Policy ensures the Right to Information stipulated in Articles Four (4) and Thirteen (13) of the Law and supports compliance with Article Twelve (12), which requires data controllers to adopt and make available a privacy policy that specifies the purpose of collecting personal data, the categories of personal data collected, the methods of collection, storage, processing, destruction, the rights of data subjects, and the procedures for exercising those rights.

Article Two: Personal Data Collected and the Purpose of Collection

First: Personal Data Collected

The Municipality is committed to collecting and processing only the minimum personal data necessary to perform its statutory functions and deliver its services. Through its website and electronic services, the Municipality may collect the following categories of personal data:

• Identity Information: Full name, date of birth, National ID number, or Iqama number.
• Contact Information: Telephone number and email address.
• Account Information: Password used to access the beneficiary's account.
• Cookies and Technical Data: Information collected through website logs and cookies, including the Internet Protocol (IP) address used to connect your device to the Internet.

Second: Purpose of Collecting Personal Data

Personal data is collected for the purpose of processing service requests, responding to inquiries, receiving suggestions, and handling complaints submitted by users.

Article Three: Methods and Purposes of Collecting Personal Data

Hafr Al-Batin Municipality collects personal data through the following methods:

1. Direct Collection: Through electronic forms available on the Municipality's website or mobile applications.
2. Indirect Collection: Through cookies and data integration with government entities, where required to process requests related to the data subject, in accordance with applicable laws and regulations.

Personal data is processed on the legal basis of fulfilling the Municipality's statutory obligations and responsibilities for the following purposes:

• Verifying users' identities and contact information.
• Enabling the Municipality to perform its statutory duties and provide services in accordance with applicable laws and regulations.
• Understanding users' needs and improving services, including receiving and processing inquiries, requests, and complaints.
• Enhancing service quality, improving the user experience, and ensuring the continuity of service delivery.

Article Four: Processing of Personal Data

Personal data collected directly or indirectly shall be processed solely for the purposes set out in this Privacy Policy and to enable the Municipality to carry out its statutory responsibilities. Such data shall only be processed by authorized personnel acting within the scope of their official duties and in accordance with the Municipality's approved policies and procedures.

Article Five: Sharing of Personal Data

The Municipality adheres to the Data Sharing Policies and Controls issued by the relevant regulatory authorities. Personal data shall not be disclosed to any external party except in the circumstances permitted under the Personal Data Protection Law and its Implementing Regulations, whether based on the data subject's prior consent or as otherwise authorized by applicable laws and regulations.

Article Six: Storage and Destruction of Personal Data

Personal data shall be securely stored either at the headquarters of Hafr Al-Batin Municipality or on approved servers located within the Kingdom of Saudi Arabia, in accordance with recognized security standards and best practices. These measures include access control management, data classification and encryption, and periodic security assessments.

Personal data shall be retained only for the period necessary to fulfill the Municipality's legal and regulatory obligations or the purposes for which the data was collected. Upon the expiry of the applicable retention period, personal data shall be securely destroyed in a manner that prevents unauthorized access or recovery, in accordance with Article Eighteen (18) of the Personal Data Protection Law.

Article Seven: Rights of Personal Data Subjects

Under the Personal Data Protection Law, data subjects are entitled to the following rights, subject to the purpose for which their personal data has been collected and processed:

Right to Information

Data subjects have the right to be informed of the methods of collecting their personal data, the legal basis for its collection and processing, the purposes of processing, the methods of storage and destruction, and the entities to which the data may be disclosed. Full details are available in this Privacy Policy or by contacting the Municipality through the contact information provided below.

Right of Access to Personal Data

Subject to Articles Nine (9) and Sixteen (16) of the Personal Data Protection Law, data subjects have the right to access their personal data held by the Municipality, provided that:

• Exercising this right does not adversely affect the rights of others, including intellectual property rights or trade secrets.
• Access is provided upon request by the data subject or through any automated mechanism made available by the Municipality.

The Municipality shall ensure that access to personal data does not result in the disclosure of personal information relating to another individual.

Right to Obtain Personal Data

Data subjects have the right to obtain a copy of their personal data held by the Municipality in a clear and readable format, where technically feasible.

Right to Rectification

Data subjects have the right to request the correction of inaccurate, incorrect, or incomplete personal data. Requests shall be reviewed and, where appropriate, completed within thirty (30) business days, and the data subject shall be notified accordingly.

Right to Erasure

Data subjects may request the erasure of their personal data in circumstances permitted by law, subject to applicable legal requirements and limitations.

Right to Withdraw Consent

Where processing is based on consent, data subjects may withdraw their consent at any time unless another legal basis requires continued processing. Except where otherwise provided by law, no fees shall be charged for exercising these rights. Requests submitted to exercise any of the above rights shall be processed within thirty (30) business days from the date a complete request is received.

For further information regarding the processing of your personal data or the exercise of your rights, please contact the Municipality's Data Management Office using the contact details provided below.

Article Eight: External Links

The Municipality's website and electronic services may contain links to third-party websites. Where users choose to access such websites, they are advised to review the privacy policies applicable to those websites. Hafr Al-Batin Municipality shall not be responsible for the collection, processing, or protection of personal data by third-party websites.

Article Nine: Personal Data Protection Officer

Office: National Data Management Office, Hafr Al-Batin Municipality

Email: ______________________

Article Ten: Updates to the Privacy Policy

1. The Municipality is committed to periodically updating this Privacy Policy by publishing the latest version on its official website. Updates may be made without prior notice. The most recent update to this Policy was issued on 09 February 2025.
2. Continued use of the Municipality's website and electronic services following the publication of any amendments constitutes acceptance of the updated Privacy Policy. Users are encouraged to review this Policy periodically to remain informed of the latest version.

Article Eleven: Complaints and Inquiries

For any complaint, objection, or request relating to the processing of personal data, please contact the National Data Management Office at Hafr Al-Batin Municipality via:

Email: DMO.HafarAlBatin@momah.gov.sa

Article Twelve: Related References

Relevant Legislation

• Personal Data Protection Law.
• Implementing Regulations of the Personal Data Protection Law.