Privacy Policy

This Privacy Policy explains how Oluo Real Estate Company (hereinafter referred to as ‘Oluo’, ‘we’, ‘us’, or ‘our’) collects, uses, processes, or discloses personal or sensitive data from you. At Oluo Real Estate, we value your trust and are committed to managing, using, and protecting your personal data responsibly and securely.

About the Company:

Oluo Real Estate Company was established in 2020 in the Kingdom of Saudi Arabia to become a fully integrated entity in the real estate development market, based on trust, innovation, and quality.

If you have any questions or inquiries regarding how we use your personal data, or if you wish to exercise any of the rights described in this policy, you may contact us via the following email: info@ioluo.com.

What This Policy Does Not Cover:

This Privacy Policy does not apply to job applicants, students, interns, our employees, or non-employee workers, as their personal data is subject to separate privacy notices and policies provided within the context of employment or applications.

Employees and non-employees should refer to the Human Resources department or review the ‘Oluo Employee Privacy Notice’. Job applicants, including paid interns, should refer to the ‘Oluo Candidate Privacy Notice’.

Definitions:

‘Applicable Laws’: Refers to privacy and data protection laws applicable in your local jurisdiction.

‘Oluo Locations or Branches’: Includes our sales offices and properties that we manage or lease.

‘External Stakeholders’: Includes former, current, and potential clients (including tenants and property owners, whether individuals or companies), suppliers of goods or services including agents, government or public officials, and any other parties interacting with Oluo in the course of business.

‘Personal Data’: Means any information, regardless of source or form, that can directly or indirectly identify a specific individual, including name, ID number, addresses, contact numbers, license numbers, bank account or credit card numbers, photos and videos related to an individual, and any personal information, including sensitive data as defined under applicable laws.

‘Personal Data Protection Law (PDPL)’: Refers to the personal data protection law in force in the Kingdom of Saudi Arabia.

‘Sensitive Data’: Means any information relating to racial or ethnic origin, religious, philosophical, or political beliefs, security information, criminal convictions or offenses, biometric or genetic data used to identify a person, health data, or information indicating that one or both parents are unknown.

What Personal Data Do We Collect?

We may collect, store, and use multiple categories of personal data, as outlined below, for purposes related to our business activities. This data is usually obtained directly from you or through the organization you work for. Some data, such as sensitive data, may be collected indirectly, e.g., through CCTV recordings.

Data Collected from External Stakeholders or When You Contact or Visit Us:

When you contact us or visit our sites, or if you are an external stakeholder, we may collect, use, process, and disclose the following personal data, whether obtained directly from you or other sources. The type of data collected depends on your relationship with Oluo, whether you are a client, agent, property owner, tenant, supplier, etc.

Categories of Personal Data We Collect:

Identification Data: Includes full name, employer and its address, job title, gender, date of birth, residential address (including landlord or tenant address), credit history, marital status, previous addresses, and contact information. (Mandatory)

Financial or Transaction Data: Includes, without limitation, articles of incorporation, official powers of attorney, information about properties for sale or rent, title deed data, credit report from Saudi Credit Bureau (SIMAH), proof of funds, and any banking or financial data necessary to facilitate payments. (Mandatory)

Audio or Visual Data: Includes voice, electronic, or video recordings, including CCTV footage or photos. Collected when visiting Oluo sites or participating in live events. (Mandatory for security, safety, and crime prevention; event recordings may be used for marketing with consent)

Employment and Salary Data: Includes salary certificate or proof of income. (Mandatory)

Sensitive Data: Includes health data, or racial or ethnic origin, whether collected directly or inferred indirectly (e.g., religious clothing visible in CCTV). (Mandatory when legally required)

Government Identifiers: Includes national ID, residency number, or passport (for non-citizens), for identity verification. (Mandatory)

Voluntary Information: Information provided voluntarily and not required by us.

Personal Data of Children:

Although our services are not directed at children, we may collect and process some personal data of children in limited cases, such as visiting offices with parents or guardians. We follow procedures to ensure privacy and protect children under 18 years, including notifying parents, limiting collection to necessary data, and allowing access, correction, or deletion requests.

Legal Basis for Processing Your Personal Data:

We may process your data for several legal bases: contract execution, consent, compliance with legal obligations, protection of vital interests, or legitimate interests such as service improvement, identity verification, complaint handling, and operational analysis.

How We Collect Your Personal Data:

We collect data directly from you through our website, forms such as ‘Register Your Interest’, or via email/phone. We may also obtain data from third parties or indirectly through cookies and tracking technologies.

How We Share Your Personal Data:

We may share personal data with internal or external parties as outlined below:

Transfer of Your Personal Data Outside Your Country of Residence:

We may process or transfer your personal data to other countries, including countries where our agents or third-party service providers operate, as outlined above. By doing so, you acknowledge and understand that your data may be transferred outside your country of residence.

If such transfer is subject to appropriate international transfer safeguards according to applicable laws, for example, when sharing your personal data with a third party when necessary, the contract with them will include appropriate contractual clauses (including standard contractual clauses if the recipient is in a country that does not provide an adequate level of protection), or other contractual obligations that require technical, organizational, and security measures to protect your personal data.

For more information about international data transfer mechanisms, please contact us via email: info@ioluo.com.

Storage of Your Personal Data and Retention Period:

We retain your personal data only for as long as necessary to achieve the purposes for which it was collected, or as required by law, including regulatory or judicial obligations.

Your data is stored by the service providers mentioned above and according to our approved data retention policy.

Note: If you unsubscribe from our marketing communications, we will retain your email address on the “Do Not Contact” list to ensure that no future marketing communications are sent.

For other purposes, we retain your personal data for up to six (6) years after the end of our relationship with you, or for the period required by applicable regulations, whichever is longer.

Your Rights Regarding Your Personal Data:

As a data subject, you have several rights under the Personal Data Protection Law. These rights vary depending on the purpose of data collection and processing and include:

• Right to be Informed: You have the right to clear and transparent information about how your personal data is collected, the legal basis for its processing, how it is stored or destroyed, and the entities to which it may be disclosed.
• Right of Access: You can request to access the personal data we hold about you by contacting us using the methods below.
• Right to Obtain a Copy: You have the right to request a copy of your personal data in a clear and readable format, and, where possible, it will be provided through a secure and encrypted electronic medium.
• Right to Rectification: If your data is inaccurate or incomplete, you can request correction; we will review and update it within 30 days and inform you of the processing outcome via email.
• Right to Erasure: You may request deletion of your personal data in certain cases, while we may retain it if legal or business requirements demand, in accordance with applicable laws.
• Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time, unless there is another legal basis for processing without consent; you may exercise this right by contacting us via the methods below.
• Note: These rights are not absolute and are subject to limitations determined by local laws or regulations. We will inform you of any exceptions applied when responding to your request.
• If you wish to exercise any of the rights mentioned above, please contact us using the communication channels provided below.

Security of Your Personal Data:

We are committed to implementing advanced technical, physical, and organizational measures, as required by applicable laws, to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Use of Cookies and Similar Technologies:

We may use cookies and similar technologies to collect and store information when you visit our website. You can control your cookie preferences and manage them at any time through your browser settings. Currently, our website uses only strictly necessary cookies to ensure proper operation.

Contact Information and Complaints:

If you have any questions or inquiries regarding our use of your personal data, or if you wish to exercise any of your rights stated in this Privacy Policy, please contact us via email: info@ioluo.com

If you wish to file a complaint regarding how Aluo processes your personal data, please give us the opportunity to address the matter first by sending an email to the above address; if you are not satisfied with the response, or if we do not respond within 30 days, you may submit a complaint to the competent authority: Saudi Data & Artificial Intelligence Authority (SDAIA).

Updates to the Privacy Policy and Other Information:

We may make updates to this policy from time to time; therefore, we advise reviewing it periodically to stay informed of any changes.

Latest version of this policy was updated in September 2025.

To view the Personal Data Protection Law, you can visit the following link: Click Here.