Abdul Latif Jameel Enterprises is committed to respecting your privacy and protecting your personal data.
You can access our full Privacy Policy below to help you to understand how we use your personal data. In it, we explain the types of personal data we collect, how we collect and process it, what we may process it for and who we may share it with.
Any personal data processed in connection with this Privacy Notice is controlled by Abdul Latif Jameel Commercial Development Company Limited, a limited company registered in the Kingdom of Saudi Arabia under commercial registration number 4030249232, with its registered office at 5th floor, Private office Building, PO BOX 6612, Amir Sultan Road, Rawdah District, Jeddah 23431, Kingdom of Saudi Arabia (“ALJ Enterprises”, “Company”, “we”, “our” or “us”), which is considered the “data controller” of your personal data under the Personal Data Protection Law and its Implementing Regulations.
To contact our Data Protection Officer, please send a request using the contact details specified at the end of this Privacy Policy. For questions, requests or complaints relating to this Privacy Notice or our processing of your personal data, you may contact us using the contact details provided at the end of this Privacy Notice.
ALJ Enterprises is the diversified investment arm of Abdul Latif Jameel in Saudi Arabia. Its activities include diversified investments, business development and portfolio-related activities across sectors including automotive aftermarket, logistics and supply chain, health and wellness, real estate development, energy and water, technology and environmental services.
Personal data means any data, regardless of its source or form, that may lead to identifying you specifically, or that may directly or indirectly make it possible to identify you. This may include your name, contact details, identification details, addresses, online identifiers, records, images, or any other data of a personal nature.
Sensitive personal data means personal data revealing racial or ethnic origin, religious, intellectual or political belief, data relating to security or criminal convictions and offences, biometric or genetic data for the purpose of identifying a person, health data, and data indicating that one or both of an individual’s parents are unknown.
This Privacy Notice applies to personal data that ALJ Enterprises collects, uses, discloses, stores or otherwise processes in connection with our website, communications, investment activities, business relationships and related business operations. This includes when you:
The ALJ Enterprises corporate website is primarily intended to provide general information about ALJ Enterprises, its businesses, investments and portfolio activities. This website does not, by itself, generally collect Personal Data directly.
However, ALJ Enterprises may collect limited Personal Data directly from individuals who visit its offices, premises or facilities. Such information may be collected for visitor management, identity verification, access control, security, health and safety, and related administrative purposes.
ALJ Enterprises operates and supports several businesses, platforms, applications, websites and offline channels as mentioned in Section 2-2. . Those businesses may collect Personal Data directly from you when you interact with them, such as when you visit their website or engage with them for any business / services.
While the ALJ Enterprises corporate website may not directly collect Personal Data through forms or registrations, it may indirectly process such data via its subsidiaries, affiliates, portfolio companies, service providers, suppliers, business partners, customers, or other authorized parties.
| Source of Indirect Collection | Data Category- | Purpose |
| Subsidiaries, affiliates, or business units | Name, contact details, customer or partner reference details, transaction or service-related records | To provide group-level administrative, operational, business, governance, reporting or portfolio support. |
| Business partners, suppliers, contractors or service providers | Business contact details, representative details, contract records, invoices, payment or bank details, correspondence | To manage contracts, procurement, payments, due diligence, vendor relationships and business operations. |
| Recruitment platforms, agencies or referrals | Candidate name, contact details, CV, qualifications, employment history, interview records and other recruitment-related information | To assess candidates, manage recruitment processes and support hiring or onboarding activities |
| IT systems, hosting providers or security tools
|
IP address, device information, browser details, cookies, access logs, login activity, system activity and technical identifiers
|
To operate, maintain and secure websites, applications, platforms and IT systems; monitor performance; prevent misuse; troubleshoot issues; and support cybersecurity and audit activities.
|
Where Personal Data is collected indirectly, the relevant ALJ Enterprises business, platform, affiliate or third party may provide the primary privacy notice at the point where the data is originally collected.
We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the purpose we collected and need to use your personal data.
Where applicable, we may process your personal data where it is necessary to perform a contract with you, manage a business relationship, provide a requested service, or take steps at your request before entering into a contract. This may include processing personal data to:
We may process your personal data where it is necessary for our legitimate interests, whilst ensuring that such processing does not adversely affect your interests, rights, and freedoms. This may involve:
We may process or disclose personal data where this is necessary to comply with legal obligations applicable to ALJ Enterprises. This may include processing or disclosure to:
We may process your personal data where it is necessary to protect your vital interests or the vital interests of another person. This basis would only be relied upon in limited circumstances, such as where processing is necessary to protect life, health, or physical safety.
We rely on your consent where you have freely given a clear indication that you agree to the processing of your personal data for a specific purpose.
We may rely on consent:
You have the right to withdraw your consent at any time for ALJ Enterprises to process your personal information. You can exercise this right by contacting ALJ Enterprises DPO at (aljedpo@alj.com)
We will retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Your information will be retained for a period of 10 years to ensure effective support, operational continuity, and compliance across all business functions. This period also enables us to handle or respond to any complaints, queries, or concerns relating to your account or application, including meeting any applicable statutory requirements.
If you stop interacting with us we will remove or anonymize your information after the passing of the statutory requirements. Once the applicable retention period expires, or where we no longer need your personal data for the purposes for which it was collected, we will securely delete it or, where appropriate, anonymize it.
If you wish to know more about our retention policy and retention periods that apply to your personal data, please send a request using the contact details specified at the end of this Privacy Policy.
Personal data may be disclosed to service providers that help us manage, maintain, and secure our databases and IT infrastructures.
We also share your personal data with any Affiliate companies, for purposes including but not limited to facilitating business operations services and marketing (where you have provided your consent to do so).
(Note: Affiliate refers to any individual, corporation, partnership, limited liability company, or other legal entity that directly or indirectly controls, is controlled by, or is under common control with a party to an agreement. For the purposes of this definition, “control” means the ownership of at least fifty percent (50%) of the voting equity, membership, or other ownership interests of such entity, or the ability to otherwise direct its management and policies, whether through ownership, contract, or other means. This also includes any other entity that falls under shared ownership, shares any partial management, or has the same ultimate ownership as a party to the agreement between entities.)
We do not share your personal data with any external entities for purposes referred to under this Privacy Policy. We do not sell personal data to third parties, and we only allow our third parties, sister and affiliate companies to send you marketing information where we have your consent to do so.
When we share your personal data with the entities mentioned above, it may imply transfers of your personal data outside KSA, namely to Ireland for database support services
We seek to ensure such transfers satisfy the conditions set out under the applicable privacy laws. We have in particular limited the transfer to the minimum personal data needed and implemented sufficient guarantees for preserving the confidentiality of the personal data transferred so that the standards of the protection of your personal data are not less than the standards set forth in the applicable privacy laws.
Under the applicable privacy laws, you have certain rights in relation to your personal data. Responses to exercise your rights will be provided within 30 days (or such other period under applicable law). You can exercise your rights by contacting via email at (aljedpo@alj.com). If your request is particularly complicated we may extend the deadline for responding by a further 30 days (or such other period permitted under applicable law), but we will let you know if this is the case. We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. Further explanation of those rights and the exceptions to them are set out below.
Details of how to exercise your rights are set out in the section below “How can you exercise your legal rights and change how we use your data”.
Your rights include the following:
In any case, you also have the right to lodge a complaint with the competent data protection authority in accordance with applicable law if you consider that the processing of your personal data carried out by us infringes the applicable privacy laws.
In order to exercise any of your rights mentioned above, or if you have any questions or complaints about our use of your personal data, please send a request using the contact details specified at the end of this Privacy Policy. We may ask for some additional information to confirm your identity, which will only be used to process your request.
In your request, please try to make clear which right(s) you would like to enforce and provide any details which may help us answer to your request. Where you fully or partially lack legal capacity (for example you are a child under 18) your legal guardian may be required by applicable law to exercise your rights on your behalf.
To protect against the loss, misuse and alteration of the information under our control, we have in place appropriate physical, electronic and managerial procedures. For example, our servers are accessible only by authorized personnel and your information is shared with respective personnel on need to know basis to complete the transaction and to provide the services requested by you. We also employ data encryption, anonymization, and coding methods to ensure that your personal data remains secure during storage and transmission. The level of security measures applied is adjusted based on the sensitivity and volume of the personal data we collect. We take reasonable steps to safeguard your personal data; however, no method of transmission over the Internet is completely secure.
To make sure your access to our services is secure, you should not share your log in details with anyone else. When you finish using our services, you should log out if others may be able to access your computer or device. This is especially important if you are using a publicly accessible computer. Be aware that there is an Internet fraud practice known as ‘phishing’ which is the illegal gathering of personal data by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a cloned or illegal copy website.
If we change this Privacy Policy, we will let you know about the changes by publishing the updated version on our website. If such change to the Privacy Policy requires your consent, you will have a choice to consent as to whether or not we may use your personal data in this different manner.
We are committed to protecting and respecting your privacy and will continue to do so in any future changes we make to this Privacy Policy
The Privacy Policy was last updated on – June 2026.
If you want to exercise any of your rights, or if you have any questions about this policy or our use of your personal data, please contact the Data Protection Officer.
The Data Protection Officer for ALJ Enterprises can be contacted via email at ( aljedpo@alj.com )
If you are not satisfied with how we handle your complaint, or if we fail to respond within 30 days, you have the right to file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).
Email – Info@sdaia.gov.sa.