Privacy Notice

The Small and Medium Enterprises General Authority "Monsha’at" recognizes the importance of your privacy and data protection, and places the confidentiality of the data of its users and visitors at the top of its priorities. Therefore, we are committed to preserving the confidentiality and privacy of sensitive data and protecting the rights of all users. We have prepared this notice specifically to clarify the following:

Consent to the Privacy Notice

Your consent to the Privacy Notice means your agreement to the privacy controls and conditions that apply to all services, programs and initiatives provided by "Monsha’at" on its official website or affiliated official websites, including any ongoing modifications according to the needs and nature of the work.

The Privacy Notice was last updated on 24/7/2022.

What data will be collected and how?

The data collected, stored, and used includes both personal data (such as name, ID number, and mobile number) and transaction data and enterprise data. Transaction data refers to data that describes any event that occurs during communication with "Monsha’at", for example: the time of entry to the website and the pages you visited.

This data is collected as soon as you fill out any form, provide us with any information, send it through the browser, or contact us by phone, email, social media, or submit it through the "Monsha’at" website or its affiliated official websites.

Additionally, all data received from other entities that serve enterprises and entrepreneurs will be collected and used, including:

• Ministry of Commerce
• Ministry of Human Resources and Social Development
• Ministry of Municipal and Rural Affairs and Housing
• Ministry of Investment
• Ministry of Finance
• Small and Medium Enterprises Bank
• Zakat, Tax and Customs Authority
• General Organization for Social Insurance
• Human Resources Development Fund
• "Sabl"
• Saudi Exports
• Bayan for Credit Information
• Chambers of Commerce
• Saudi Business Center
• Business Accelerators and Incubators
• Startup Company Studios
• Other government and private entities that support or provide services to enterprises or entrepreneurs.

"Monsha’at" is committed to the key principles and general rules for the protection of personal data with regard to your personal data, as well as the key principles and general rules for data sharing related to your personal data, your enterprise, and your transactions.

1. Protection of Your Enterprise's Data and Transactions

• Your enterprise's data will be shared with "Monsha’at" employees who need to access, use, and process it in order to study, understand, and develop the small and medium enterprise sector. Your enterprise's data will also be shared with government entities for legitimate purposes based on legal or practical necessity, aimed at achieving a public interest without causing any harm to national interests, the activities of entities, individuals' privacy, or environmental safety - except for data and entities exempted by royal orders.

• Your data will be classified according to its type and sensitivity into one of the four classifications under the National Data Classification Policy: public, restricted, confidential, and highly confidential. Accordingly, data protection controls will be applied to ensure its confidentiality and privacy. For example, revenue data will be classified at a higher level of confidentiality than employee headcount.

• The following data related to your enterprise will be published as open data to support and facilitate entrepreneurs, investors, and researchers' access to your enterprise, in addition to enhancing the transparency concept for the end-user:

•     Enterprise name
•     Commercial registration
•     Registration status
•     Commercial entity
•     Registration issuance date
•     Registration expiration date
•     Enterprise size according to the Unified Monsha’at Classification
•     Enterprise phone number
•     Enterprise activity
•     Enterprise address
•     Region
•     City
•     P.O. Box
•     Postal code
•     Website

• Your other data not mentioned above (such as: number of employees, revenue amount) will not be shared with non-governmental entities and the general public, except as statistical and aggregated data without referring to the specific data of your enterprise (such as: number of Saudi employees in the retail sector in Riyadh).

2. Protecting Your Personal Data

• Personal data is stored and processed securely within the geographical boundaries of the Kingdom to ensure the preservation of the national digital sovereignty of this data, and all servers containing your personal data will be protected according to the controls issued by the National Cybersecurity Authority.

• Your information will only be accessible to "Monsha'at" employees who need to access and use it, and before using or processing this data, the need for it and its compliance with the purpose for which the data was collected will be assessed.

• When needed, your personal data will be shared with government entities for the purposes outlined in the paragraph "Why We Collect and Use Your Personal Data" - with the exception of entities exempted by royal orders. If "Monsha'at" or any government entity wishes to use your personal data for purposes other than those mentioned, your prior consent will be obtained.

• When sharing your personal data with any government entity, the purpose will be defined, assessed, and then a non-disclosure agreement will be signed to ensure the existence of records on how your personal data is processed and used, to ensure that it is used for the same purpose that was agreed upon. Secure technologies that ensure the safe transfer of your data to the other government entity will be used.

• No such data will be exchanged, traded, published, or sold to any party other than government entities without your prior consent, and access to the information will only be allowed for qualified individuals who are responsible for providing government services.

• Why We Collect and Use Your Personal Data (Purposes)

Your personal data is collected, used, and processed for organizational, improvement, and development purposes, as follows:

• Fulfilling the data required for applying to the services, programs, and initiatives offered by "Monsha'at" on its official website and affiliated official websites.
• Conducting surveys, interviews, and gathering opinions.
• Sending invitations to participate in workshops, courses, and conferences.
• Marketing investment opportunities or services, programs, and initiatives that support enterprises.
• Resolving and addressing any inquiries or complaints you may have and improving the user experience across all communication channels of government entities.
• Fulfilling regulatory or legal requirements.
• Analyzing data and issuing internal reports that serve the necessary work requirements, such as statistical reports.
• Serving, understanding, studying, and developing the small and medium enterprises sector.

• Your Rights Regarding the Processing of Your Personal Data

Under the Personal Data Protection Policy issued by the Data Management Office at the Authority, you have the following rights, which are primarily based on the purpose of collecting, using, and processing personal data:

First: The Right to Know: The data subject has the right to know how we collect their data, the legal basis for collecting and processing it, how it is processed, stored, and destroyed, and with whom it will be shared. You can access all the details through this policy or by contacting us using the contact information provided in the "Contact Us" section.

Second: The Right to Access Personal Data: The data subject has the right to request a copy of their personal data through the email address provided in the "Contact Us" section, and it will be provided to them free of charge within seven working days via email.

Third: The Right to Request Their Data in a Clear and Readable Format

Fourth: The Right to Erase Personal Data: The data subject has the right to request the erasure of their personal data in certain circumstances, unless there is a legal provision specifying a certain retention period or contractual requirements.

Fifth: The Right to Rectify Data: The data subject has the right to request the correction of their personal data that they believe to be inaccurate, incorrect, or incomplete, by contacting us via the email address provided in the "Contact Us" section. The data will be reviewed and updated within seven working days, and the data subject will be notified of this via email.

For more details on the processing of your personal data and how to exercise your rights, you can refer to the Personal Data Protection Policy issued by the National Data Management Office.

Secure Transfer of Information

We guarantee that the Monsha’at website has the highest security measures to protect the information you provide. The website encrypts sensitive information (such as health data) or data that must be kept confidential in accordance with legal requirements.

Data Storage and Destruction

The data will be stored within the Kingdom of Saudi Arabia on servers of the Small and Medium Enterprises General Authority, and it will be securely destroyed in a manner that prevents access to it after the purpose of its collection has been fulfilled. Monsha’at may retain such data after the purpose of its collection has been fulfilled if all means of identifying the data owner have been removed.

Exercise of Data Subject Rights

The data subject has the right to request access, correction, or destruction of their data by contacting us through the means of communication provided in the "Contact Us" section.

Changes to the Privacy Notice

The Authority reserves the right to modify the Privacy Notice from time to time without prior notice. Your use of the website after these modifications will be considered acceptance of them. Therefore, you should periodically review the Privacy Notice to ensure you are aware of the latest version.

General Provisions

• The Authority is committed to the provisions of the National Data Governance Policy regarding data sharing and protection of personal data issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).
• The laws of the Kingdom of Saudi Arabia alone shall be the applicable laws in all matters related to disputes that may arise from the use of this website.
• The courts of the Kingdom of Saudi Arabia shall have exclusive jurisdiction to hear and adjudicate such disputes.
•  

Contact Us

If you have any questions regarding the Privacy Notice, need assistance, or wish to file a complaint, please contact us through:

Phone: 8003018888

Email: Info@monshaat.gov.sa

Expected Response Time:

Social Media Platforms: 24 hours

Call Center: Saturday to Thursday, 8:00 AM to 10:00 PM

Personal Data Protection Regulations

National data governance policy

Fundamental principles of personal data protection

Fundamental principles of data sharing

Personal Data Protection Policy