As part of SAICO’s commitment to protecting your personal data, this Notice explains the nature of the data we collect about you, the lawful bases for its processing, and the mechanisms of its use. Since we determine the purposes and means of processing this data, SAICO is considered the (Data Controller) under the Saudi Arabian Personal Data Protection Law (PDPL). We are committed to ensuring that every processing activity is based on a legitimate lawful basis, complies with regulatory controls, and operates under the supervision of the competent authorities.
In the event of any material changes to this Notice, we will notify you through appropriate means and publish the updated version on our platforms, and such amendments will apply in accordance with the statutory requirements in force.
The Saudi Arabian Cooperative Insurance Company (SAICO) is a leading provider of comprehensive and innovative insurance solutions in the Kingdom of Saudi Arabia. In the course of providing our services and insurance coverages, we collect and process our customers’ data in accordance with regulatory requirements.
You can contact us for any inquiries or requests through the following official channels:
- Legal Name: The Saudi Arabian Cooperative Insurance Company (SAICO)
- Commercial Registration (CR): 1010237214
- Mailing Address: P.O. Box 58073, Riyadh 11594, Kingdom of Saudi Arabia
- Telephone: +966 11 874 9666
- Toll-Free Unified Number: 8001242002
This Notice aims to provide you with full clarity, free from complex linguistic jargon, to efficiently explain how we collect your personal data, how we use it, with whom we may share it, and to clarify the rights guaranteed to you under the Personal Data Protection Law (PDPL) and how to exercise them.
Personal Data: Any information that identifies you or could reasonably lead to your identification, directly or indirectly. By nature, it includes your name, national ID number, national address, contact details, financial information, and others.
Sensitive Data: A more private category of data that requires a higher level of protection under the law. It includes data revealing racial or ethnic origin, religious, intellectual, or political beliefs, security and criminal data, biometric and genetic data, health data, and any other data classified by law as sensitive.
We limit the collection of your personal data to what is actually required by the nature of the insurance service and the requirements of the laws and regulations issued by the legislative and regulatory authorities in the Kingdom, such as the Insurance Authority.
The categories of data we may process include—but are not limited to— the following:
- Personal and Contact Data: (such as name, national ID number, Iqama number, passport details, date and place of birth, gender, nationality, marital status, phone number, email address, national and postal address).
- Financial Data: (such as bank account details, IBAN number, payment information, financial solvency according to the nature of the product).
- Insurance and Claims Data: (such as insurance policy numbers, coverage details, claims history, beneficiary information).
- Health and Medical Data: (such as medical reports, health history, treatment and diagnosis records).
- Vehicle Data: (such as license plate details, chassis number, driving license and ownership data).
- Professional Data: (such as employer name, job title).
- Job Applicants’ Data: (such as name, contact details, date of birth, in addition to academic qualifications, professional experience, and all data contained in the CV uploaded via our website).
- Technical and Digital Data: (such as IP address, device identifiers, cookies).
- Anti-Fraud Records: (such as information and data related to identity verification and investigations of fraud cases).
It is worth noting that some of this data is an essential condition for activating or continuing to provide the service, and failure to provide it may prevent us from serving you as required.
We collect and process your personal data for specific and legitimate purposes consistent with the nature of our business, including:
- Providing and Developing Insurance Services: (such as risk assessment, issuing insurance policies, managing and settling claims, and improving the quality of our services and your digital experience with us).
- Operational Communication and Follow-up: (such as sending notifications and updates regarding the status of contracts and claims, policy renewal reminders, and responding to your inquiry).
- Responsible Marketing: (such as informing you about new insurance offers and products that may interest you, based on your prior consent, which you can withdraw at any time).
- Compliance with Laws and Regulations: (such as fulfilling our legal, regulatory, and reporting obligations to the legislative and judicial authorities in the Kingdom, such as the Insurance Authority).
- Cybersecurity Protection and Fraud Prevention: (such as detecting and preventing fraud attempts or misuse of our systems to protect the interests of the Company and its customers).
- Actuarial Studies: (such as analyzing data and identifying risk factors to provide fair and equitable pricing commensurate with the size of the covered risks).
- Evaluation and Recruitment: (such as studying job applications submitted via our website, evaluating applicants’ qualifications, and communicating with them to complete hiring procedures).
We pledge not to process your personal data for any purposes that conflict with the purposes mentioned above, unless the processing is based on a legitimate lawful basis in accordance with the Personal Data Protection Law.
We are committed to relying on a legitimate lawful basis to process your personal data, in accordance with the principles and provisions of the Personal Data Protection Law (PDPL) and applicable regulations. We may rely on the following lawful bases:
- Consent: When obtaining your explicit consent in cases required by law.
- Contractual Necessity: If the processing is necessary to conclude a contract or execute its terms.
- Statutory/Legal Obligation: If the processing is required to comply with laws and regulatory guidelines, including the requirements of the Insurance Authority.
- Legitimate Interests: If the processing is necessary to achieve our legitimate interests (such as improving services, protecting systems, and preventing fraud), provided it does not prejudice your rights.
- Vital Interest: If the processing is necessary to protect your vital interest, where contacting you is impossible or difficult.
Your data reaches us through multiple channels, outlined as follows:
- First, directly from you: When filling out registration forms, submitting insurance applications, filing claims, communicating with customer care staff, or using our website and smart application.
- Second, from parties related to the insurance contract: Such as employers in group insurance policies, medical facilities and centers for claims management purposes, damage evaluation and traffic accident inspection entities, and any relevant authorized third party.
- Third, automatic technical interaction with our platforms: Where our systems automatically record some technical data such as IP address, browser type, operating system, and cookies for operational and security purposes to ensure platform safety.
The type of data and sources of collection vary according to the type of insurance product (motor, medical, life, property, general accidents, etc.) and in proportion to the nature and requirements of each coverage. We commit to informing and notifying the data subject upon collecting their personal data in cases mandated by the law.
We do not share your personal data except when it is necessary to provide the service, required by law, or involves a legitimate interest. This sharing is limited to specific entities, including:
- Regulatory and Government Authorities: Government and regulatory bodies, courts, and competent public entities in accordance with applicable laws and obligations.
- Medical Service Providers: Approved hospitals, clinics, and pharmacies for the purposes of managing, processing, and settling medical claims.
- Insurance Sector Partners: Reinsurance companies, and authorized brokers and agents in the ordinary course of business.
- Contractors and Service Providers: Companies that provide us with information technology services, cloud hosting, and professional or administrative services.
We at SAICO commit to maintaining the confidentiality of your data, and we confirm that we do not trade it or make it available to any third party outside the purposes specified in this Notice. Furthermore, SAICO ensures that all entities and third parties with whom data is shared are strictly bound to maintain its confidentiality and security, use it solely for the specified purposes, and comply with the provisions of the Personal Data Protection Law (PDPL).
The need may arise to transfer your personal data for processing outside the Kingdom. In such a case, we will comply with the requirements of the applicable law and its implementing regulations, or any other directives issued from time to time regarding cross-border data transfers, in addition to the requirements of other relevant laws and regulations.
We may use automated means and artificial intelligence technologies to process and analyze your personal data to support our operational processes, develop our services, and manage risks. This includes, but is not limited to: debt management, improving collection processes, fraud detection, or any other purposes compatible with the nature of our business and in accordance with applicable laws.
We confirm that these processes are subject to human oversight and review to ensure their accuracy and fairness. We do not make decisions that materially affect you based solely on automated processing without human intervention, except within the limits permitted by laws and regulations.
We may use your personal data to inform you about our offers, marketing, and awareness content via email or text messages, within the limits of what you authorize. The decision to continue receiving these messages always remains in your hands; you can unsubscribe and withdraw your consent at any time and free of charge via the unsubscription link attached to the messages, or by contacting us directly at the dedicated privacy email: privacy@saico.com.sa
We retain your data only for the period necessary to achieve the purposes for which it was collected, or for the duration imposed by relevant laws and regulations, such as regulatory requirements or judicial orders. Once this period expires, we ensure that your data is safely destroyed or anonymized in a manner that does not allow re-identification.
The security of your personal data is a top priority for us. To ensure its protection from loss, misuse, or unauthorized access, modification, and disclosure, we commit to implementing an integrated system of technical, organizational, and physical measures in accordance with applicable regulations.
Our security measures include, but are not limited to:
- Security Systems and Solutions: Continuously maintaining and developing our defensive and monitoring systems to ensure a secure technical environment.
- Governance of Privileges: Restricting access to your personal data exclusively to individuals whose nature of work requires such access.
- Strict Commitment to Confidentiality: Binding all our employees and contracted third parties to strict legal agreements to maintain data confidentiality.
These technical and organizational security measures are periodically reviewed and evaluated to ensure their continuous adequacy and effectiveness against evolving cyber risks.
If you are under eighteen years of age, or do not enjoy full legal capacity, the exercise of all rights related to your personal data shall be through your legal guardian or custodian. Their consent shall be legally recognized in every case where the regulations require obtaining consent for data processing.
The Personal Data Protection Law guarantees you a set of rights that you can exercise, which are:
- Right to be Informed: You have the right to know the lawful basis for collecting your data and the details regarding how it is processed.
- Right of Access: You have the right to access your personal data and request a copy of it in a clear and readable format.
- Right to Rectification: You have the right to request the correction, completion, or updating of your personal data if it is inaccurate, incomplete, or outdated.
- Right to Destruction: You have the right to request the deletion of your data that is no longer necessary, taking into account statutory requirements and retention periods.
- Right to Withdraw Consent: If the processing relies on your consent, you have the right to withdraw this consent at any time. The withdrawal of consent will not affect any processing carried out based on another lawful basis.
To exercise any of these rights, you can contact us via email at privacy@saico.com.sa, and we will respond to your request within thirty (30) days. This period may be extended for a similar duration in complex cases, with prior notification of the reasons.
If you believe that we have failed to comply with the provisions of the Personal Data Protection Law, or if you have any reservations about how we handle your data, we welcome your complaint and will handle it with the utmost seriousness.
Start by raising your complaint to our Data Protection Officer via email at privacy@saico.com.sa. If you do not receive a response within thirty (30) days, or if you are not satisfied with the handling of the complaint, you may escalate and file a complaint with the competent authority, which is the Saudi Data and Artificial Intelligence Authority (SDAIA), through the following channels:
- Website: sdaia.gov.sa
- National Data Governance Platform: dgp.sdaia.gov.sa
- Address: Kingdom of Saudi Arabia, Riyadh.
If you have any questions or comments regarding the processing of your personal data, we are pleased to have you contact our Data Protection Officer (DPO) directly through the designated email: privacy@saico.com.sa
This Notice may be updated from time to time, and any updates will be published on our website with the effective date. In the event of material changes, we will notify you through appropriate channels. Your continued use of our services constitutes acceptance of the new updates.