Privacy Policy

REGA Website Privacy Policy Guide

REGA places the data of its website's users and visitors at the top of its priorities. Our goal is to provide high-quality services to all beneficiaries while maintaining the highest level of privacy. This privacy policy has been prepared to help you understand the nature of the data we collect. It is important that you are aware of how REGA uses your personal data and your rights, in accordance with the relevant laws and regulations in the Kingdom, This policy and the information outlined below are part of the Terms and Conditions for using REGA website.

Using REGA website constitutes your agreement to this privacy policy. You agree that the data and information you enter may be processed or shared with other entities for legitimate purposes based on a legal foundation or a justified operational need aimed at achieving a public interest, while taking care not to harm the activities of those entities or the privacy of individuals. By agreeing, you authorize REGA to obtain your data from governmental, non-governmental, and non-profit sectors.  

This policy applies to all users and visitors (referred to below as the "user" or "personal data subject") who have the authority to access or use REGA website.

1. Data Collected and Purpose of Collection

The personal data collected by the REGA website is to process and save user data to ensure a seamless experience when using the website and its services and products. We maintain the highest level of privacy and security, allowing access to this data only by the user themselves. This includes:

Personal Data Collected (including but not limited to):

Information you provide us when you register on REGA's website or create your personal profile. This includes your personal data such as, but not limited to,

 your name, national ID number, address, contact numbers, email, deeds, records, bank account numbers, credit cards, and other data.

•  Personal Account Data: Such as the password used to log in to the beneficiary's page.
•  Contact information and usage-related updates.
•  Other entered information which includes requirements for requesting services, reports, complaints, and surveys.
• Device data that helps improve the user experience, such as: Device language and system type.
• Cookie data, such as data collected through website logs, technologies, cookies, or similar technologies.
• Your IP address and details of the web browser version you used.
• Files: Permission to access device files and upload documents and images is requested from the user to benefit from the services provided by REGA's website. Examples include the "Data Quality Improvement" initiative, which allows users to correct their data with participating entities and upload files that prove the correctness of the data, or the "Reporting" service and report documentation, among others. 
• Location Data (GPS): This is used if the user allows location access to benefit from services, such as, determining the location of the property where a service is to be performed.

2. Methods of Data Collection

Necessary user data is collected to provide the required services from the following sources, including but not limited to:

• Directly from the user when a service is requested, such as registering on the website or requesting a service like filing a report, which allows the user to track their submitted requests.
• From partner entities that produce data and services to offer services through the website and enrich the user experience.
• With the consent of the data subject, who can withdraw consent at any time unless there is another legal basis, in accordance with clause (7) of this Policy.
• To achieve legitimate interests or objectives, where REGA's website collects services that enable the user to benefit from them.

3. Use of Personal Data

The personal data collected, whether directly or indirectly, is used for purposes including, but not limited to:

Providing the service to the user as requested, such as the registration process on the website or applying for one of the website's services, without compromising the privacy of the user's data or sharing it with any other party without the user's permission and consent.

4. Storage and Destruction of Personal Data

Personal data is stored within the Kingdom. REGA ensures that the data is secured in compliance with the policies and legal regulations set by the National Cybersecurity Authority (NCA) and the Saudi Data and AI Authority (SDAIA).

5. Rights of the Personal Data Subject

• Right to Be Informed: Personal data subject has the right to know the methods of data collection, the legal basis for its collection and processing, how it is processed, stored, and destroyed, and with whom it will be shared. The data subject can view all details through this policy or by contacting us using the information provided in clause (9).
• Right to Access Personal Data: Personal data subject has the right to request a copy of their personal data. This can be done by emailing the address provided in clause (9) of this Policy. A copy will be provided free of charge within fourteen business days by communicating with REGA's email.
• Right to Correct Personal Data:  Personal data subject has the right to request the correction of their personal data that they believe is inaccurate, incorrect, or incomplete. This can be done by emailing the address provided in clause (9). The data will be reviewed and updated within seven business days—concerning data collected through REGA's website. As for data under the control of a partner entity, the data subject will be informed of the entity that owns the data and can request to have their data corrected with them.
• Right to Request Personal Data Destruction: Personal data subject has the right to request the destruction of their personal data collected through REGA's website under certain circumstances (unless there is a legal provision specifying a certain retention period or contractual requirements). As for data under the control of a partner entity, the data subject can contact the entity and request its destruction.
• Right to Withdraw Consent: Personal data subject has the right to withdraw their consent to the processing of their personal data at any time and can request this from REGA, represented by the Data Management Office, via email at:PDR@rega.gov.sa

6. Sharing and Exchanging Personal Data

REGA always strives to maintain the privacy and confidentiality of all personal data collected. REGA does not aim to disclose or share this data unless it complies with the laws and regulations in force in the Kingdom or to achieve the uses REGA has committed to, for example:

• Disclosing personal data to a third party from government, private, or other similar entities for the purpose of the data subject benefiting from REGA's services.
• Government entities to enable data integration and facilitate service delivery. 
• Any third party to verify compliance with the terms and conditions of the services provided through this website.

7. Exercising the Rights of the Personal Data Subject

Personal data subject has the right to request access to, rectification of, or destruction of their data by contacting us at the following email: PDR@rega.gov.sa They are allowed to exercise their rights within 30 days. This period can be extended by an additional 30 days if additional work is required within REGA, provided that the personal data subject is notified of the extension.

8. Personal Data Protection Officer

Name: Data Management Office at REGA.

Email: PDR@rega.gov.sa

9. Complaints and Inquiries

To help protect your personal information, we recommend the following:

• Immediately contact REGA if you believe someone has accessed your personal information or any confidential information you have provided or obtained from REGA.
• Never disclose any confidential information over the phone or internet unless you are certain of the identity of the person or party receiving the information and it is through designated communication channels.
• Use a secure browser when conducting online transactions, close unused applications, and ensure your antivirus software is always active and updated.

If you have any complaints or inquiries related to the Privacy Policy or the handling of personal data, please contact REGA system via email at:PDR@rega.gov.sa. If you do not receive a response within fourteen business days, you can submit your complaint or inquiry to REGA’s Data Management Office at  Dmo@rega.gov.sa, If the issue is not resolved or you do not receive a response within another fourteen business days, you can escalate it to NDMO via email at: pr@ndmo.gov.sa.

10. Personal Data Storage and Protection

 REGA is committed to securely storing your personal data in databases or through cloud computing services in accordance with NCA’s requirements. This website and its employees follow a personal data protection policy. Only authorized employees are allowed to access personal information, and we ensure the confidentiality of this information in accordance with the laws in force in the Kingdom. 

11. How Data Is Destroyed

REGA strives to protect your personal data and ensure its processing meets the highest security standards. After the purpose of collecting or processing personal data has ended, or upon your request to delete your data, or as soon as your personal data becomes unnecessary for the purposes for which it was collected, measures will be taken to destroy your data in a secure manner. We use multiple methods to ensure secure destruction of data, as follows:

• Digital Data: REGA is committed to deleting or destroying digital data from its databases and storage systems. This includes deleting electronic files using permanent deletion technologies.
• Paper-based Data: For data collected in the form of paper documents, it will be destroyed by shredding the documents using approved paper shredders to ensure they cannot be recovered or reused.

12. Sharing of Personal Data

Personal data is shared after the data subject's consent for legal purposes in accordance with the provisions of this policy. REGA makes every effort to protect user data according to best practices.

• The website processes and saves user data and the services it provides when the website is used.
• The privacy and security of this data is respected, and it is not accessed without the personal data subject’s consent.

13. Links to Other Websites

The scope of this Policy is limited to REGA website. Since REGA's website contains links to other websites that we do not own or control, the user bears full responsibility for the data they provide to those websites. The website also implements strict procedures to protect against the loss, misuse, or alteration of information. However, REGA cannot guarantee the confidentiality of your use of these websites and disclaims all responsibility for any harm you may suffer through them. 

14. Privacy Policy Updates

• Privacy Policy Last Updated on 23/07/2025.
• REGA reserves the right to add or change any of the provisions of the Privacy Policy. 
• Arabic is the official language for applying the Terms and Conditions. If a dispute arises in the interpretation of any text in another language, the Arabic text shall prevail.

Relevant Legislation

• Personal Data Protection Law issued by Royal Decree No. (M/19) on 02/09/1443 AH, and its Implementing Regulations.
• National Data Governance and Personal Data Protection Controls and Specifications.