Privacy Policy

Privacy Notice

This Privacy Notice explains what Personal Data we collect from suppliers, customers, business partners, employees, contractors, site visitors, intermediaries, employment seekers and other individuals who interact with us, how and why we collect and use it, the legal bases we rely on, how long we keep it, when we share or transfer it, and the rights you have in relation to your Personal Data.

About Hov Global

This Privacy Notice is issued by Hov Global CJSC (“Hov Global”) and applies to Hov Global and its direct and indirect subsidiaries that determine the purposes and means of the processing described in this Privacy Notice. The registered address for Hov Global is Business Gate, Gate 5, Airport Road, Building 7555, 1st Floor, Qurtobah District, 13244 Riyadh, Saudi Arabia, and additional local contact details are provided below.

Hov Global is the controller of all Personal Data and Sensitive Personal Data that it collects where it determines the purposes and means of processing. Where Hov Global processes Personal Data on behalf of another controller, it will do so in accordance with that controller’s documented instructions and the applicable data processing agreement.

Hov Global understands that your privacy is important. Therefore, we respect and protect your right to privacy and will process your Personal Data in accordance with the provisions of the Saudi Arabian Personal Data Protection Law and its Implementing Regulations (“PDPL”), the European Union (EU) General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), and any other privacy laws that apply to the relevant processing activity.

This Privacy Notice explains how we may collect, use, disclose, transfer, retain and protect your Personal Data, and how you may exercise your rights.

What kind of Personal Data does Hov Global collect?

Personal Data means any information relating to an identified or identifiable natural person, including any information defined as Personal Data under the PDPL or the GDPR. Depending on your relationship with Hov Global, we may collect and process the following categories of Personal Data:

• name, address, email address, telephone number and other contact information;
• date and place of birth;
• nationality;
• national identification, residency, social insurance or similar government-issued numbers;
• gender;
• employment details;
• bank account, payment and billing information;
• copies of identity documents, such as passports, national ID cards, driver’s licenses, residence permits or employee identification documents, where required by applicable law or for verification purposes;
• source of wealth;
• proof-of-address documents, utility bills, bank statements and similar verification documents;
• tax residency;
• details of shareholdings and other assets which are legally or beneficially owned by the data subject; and
• details of people and organizations which may be connected to the data subject (family or otherwise).

We collect only the Personal Data that is relevant, proportionate and reasonably necessary for the purposes described in this Privacy Notice, for purposes explained to you at the time of collection, or for purposes otherwise permitted by applicable law.

In some instances, we may also be required to collect and process Sensitive Personal Data or special-category Personal Data where permitted by law and necessary for employment, health and safety, access control, benefits, travel, immigration, compliance or other specific purposes explained to you. This may include:

• health and medical data, including periodic screenings and drug and alcohol testing where required or permitted for site access, occupational health or safety purposes;
• racial or ethnic origin data, where required or permitted for legal reporting or diversity monitoring purposes;
• family status, marital status and dependents’ information, where required for employment, benefits, travel or immigration administration;
• religious affiliation or similar information, where required for visas, immigration or other legal requirements;
• trade union membership or similar association data, where required or permitted by applicable law.

How does Hov Global collect Personal Data?

Hov Global obtains and processes Personal Data in different ways.

Personal Data provided to Hov Global directly

Hov Global collects Personal Data directly from prospective and existing suppliers, customers, business partners, employees, contractors, site visitors, intermediaries and employment seekers when they communicate with us, apply for a role, visit our premises, use our systems, receive or provide services, or when we need the information to meet legal, contractual, security or compliance requirements.

Personal Data obtained from third parties

Hov Global may also collect and process Personal Data from third parties and publicly accessible sources, where permitted by applicable law, such as:

• internet sources, professional networks and social networks, for purposes such as recruitment verification, customer due diligence and ownership-structure verification;
• screening databases, sanctions lists, commercial registers and company registries, for supplier, customer and business-partner due diligence;
• third parties that hold relevant information about your relationship with them or with a sanctioned or restricted party;
• tax, social insurance, immigration, labor, municipal or other government authorities, where necessary for payroll, benefits, employment, immigration, site access or legal compliance;
• occupational health providers, medical providers and other contracted third parties, where necessary to meet site access, occupational health or safety standards; and
• third party contracting companies, recruitment agencies and service providers, for workforce planning, resource management and recruitment administration.

How does Hov Global use Personal Data?

We process Personal Data for purposes such as managing supplier, customer and business-partner relationships; providing, receiving and improving services; recruitment and employment administration; payroll and benefits administration; site access, safety and security; travel and immigration administration; sanctions, anti-bribery, anti-money laundering and other compliance screening; billing and payment; recordkeeping; dispute management; information security; and communications about our services where permitted by law.

Depending on the processing activity and the law that applies, we rely on one or more of the following lawful bases under the PDPL, the GDPR or other applicable privacy laws:

• (a) Consent – where we ask for your consent, including for certain marketing communications, optional media or advertising uses, or certain processing of Sensitive Personal Data where consent is required. Where we rely on consent, you may withdraw your consent at any time by contacting the Privacy Officer using the details below. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
• (b) Contractual necessity – where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• (c) Legal obligation – where processing is necessary for us to comply with legal, financial, employment, tax, regulatory, health and safety, immigration, sanctions, anti-money laundering or similar obligations.
• (d) Vital interests or emergency interests – where processing is necessary to protect someone’s life, health or safety, including by providing relevant medical or emergency information to emergency services.
• (e)Legitimate interests or actual interests – where processing is necessary for our legitimate business interests under the GDPR or our actual interests under the PDPL, provided that the relevant law permits us to rely on that basis and we have considered your interests, rights and freedoms. These interests may include business administration, service improvement, relationship management, fraud prevention, security, compliance, billing, research and analytics, and protecting our rights.
• (f)Public interest or official requirements – where processing is necessary for a purpose recognized under applicable law, including responding to lawful requests from public authorities or meeting public-interest, public-health or statutory requirements.
• (g)For Sensitive Personal Data or special-category Personal Data, we will also rely on an additional condition where required, such as explicit consent, employment and social protection obligations, health and safety obligations, the establishment, exercise or defense of legal claims, substantial public interest, vital interests or another condition permitted by applicable law.
• (h)CCTV and other site-monitoring tools may be used at our premises for safety, security, access control, incident investigation, asset protection and compliance purposes. Notices will be displayed where required, and monitoring will be limited to what is necessary and proportionate for those purposes.

When we process your Personal Data based on legitimate interests, actual interests or consent, we will consider and balance the impact on you and your rights under applicable law. Where the law gives you a right to object, restrict processing or withdraw consent, you may exercise that right using the contact details below.

To whom does Hov Global provide Personal Data?

Hov Global may disclose or transfer Personal Data to Hov Global group companies, including group companies located outside the country in which the Personal Data was collected, where necessary for the purposes described in this Privacy Notice, internal administration, service delivery, compliance, audit, security, legal or regulatory purposes, and where a lawful basis and appropriate transfer safeguards are in place. Personal Data held by Hov Global group companies will be handled in accordance with applicable data protection requirements and the Global Data Protection Policy 66.01.

Except as described in this Privacy Notice, Hov Global will not disclose, transfer or sell your Personal Data to any third party unless you have consented to this, the disclosure is necessary for a lawful purpose described in this Privacy Notice, or the disclosure is otherwise permitted or required by applicable law.

Hov Global may disclose or transfer Personal Data to subcontractors, intermediaries, professional advisers, insurers, auditors, banks, payment providers, IT providers, cloud providers, data processors, debt collection providers, occupational health providers, recruitment providers, payroll providers, travel providers and other service providers where necessary for the purposes described in this Privacy Notice. Where a service provider processes Personal Data on our behalf, we will enter into appropriate contractual arrangements requiring the service provider to process the Personal Data only on our documented instructions, maintain confidentiality, apply appropriate security measures, assist with data-subject rights and delete or return Personal Data when required.

In addition, Hov Global may disclose or transfer Personal Data where necessary to protect our rights or those of our customers, suppliers, employees or other individuals; prevent, detect or investigate fraud, security incidents or unlawful activity; establish, exercise or defend legal claims; or comply with requests or obligations from courts, regulators, law enforcement, tax authorities, labor authorities, immigration authorities, health and safety authorities or other competent public authorities.

Employment Seekers

This section describes how Hov Global handles and protects Personal Data about employment seekers who apply through the Hov Global website, through any Hov Global portal, in response to an advertisement, through a recruitment agency, by referral, or through any other recruitment channel. This section should be read together with the rest of this Privacy Notice.

Hov Global processes the following types of Personal Data of employment seekers:

• Name, address, email address, telephone number and other contact information;
• Date and place of birth;
• Nationality;
• Immigration, right-to-work and residence status;
• Job-related information such as years of experience and work record;
• Educational and training information;
• Skills and competencies;
• name and contact details of referees, where you have informed the referee that you are providing their information to Hov Global and have any required permission to do so;
• Any other personal information you choose to submit to Hov Global in connection with your application.

Hov Global uses the Personal Data you provide in your application, and Personal Data collected from permitted recruitment sources, for recruitment and workforce planning purposes. This includes assessing your qualifications and suitability, verifying your information, conducting reference and background checks where permitted by law, communicating with you, making hiring decisions, retaining appropriate recruitment records, and informing you of further career opportunities where permitted by law.

In some jurisdictions, we may be required or permitted to process information relating to gender, disability, nationality, racial or ethnic origin or similar diversity information for equal-opportunity, diversity monitoring or legal reporting purposes. Where this information is Sensitive Personal Data or special-category Personal Data, we will process it only where we have a valid legal basis and any required additional condition, such as explicit consent or a legal reporting obligation.

International Transfers, Hosting and Data Storage

The Personal Data Hov Global processes may be stored on Hov Global systems, on servers operated by Hov Global or its group companies, and/or on systems and cloud-based services provided by third party service providers.

Where Personal Data is transferred outside the country in which it was collected, including outside Saudi Arabia or the European Economic Area, Hov Global will do so only where permitted by applicable law and where appropriate safeguards are in place. These safeguards may include adequacy decisions or adequacy findings, standard contractual clauses, binding intra-group arrangements, data processing agreements, transfer risk assessments, supplementary security measures, or other safeguards or approvals required by the PDPL, the GDPR or other applicable privacy laws.

Where the PDPL applies to a transfer of Personal Data outside Saudi Arabia, Hov Global will also consider the PDPL transfer requirements, including whether the transfer is necessary for a permitted purpose, whether the destination provides an appropriate level of protection or other permitted safeguards apply, whether the transfer is limited to the minimum Personal Data necessary, and whether any required regulatory assessment, notification, approval or documentation is needed.

Retention

Hov Global will process and store Personal Data only for as long as necessary for the purposes for which it was collected, including to fulfill legal, contractual, regulatory, employment, tax, accounting, health and safety, immigration, compliance, audit or recordkeeping obligations; to resolve disputes; or to establish, exercise or defend legal claims. Retention periods may vary by jurisdiction, data category and processing purpose. Examples of storage periods are noted below:

• Suppliers and customers – records will be retained for 10 years after the end of the relationship
• Prospective employees – unsuccessful applicants’ data will be retained for 6 months, unless a longer period is required or permitted by applicable law or you consent to a longer talent-pool retention period.
• Employees – will have employment data held for the duration of their employment.
  Post-employment:
  • benefit data will be held for a period of 10 years;
  • Medical records – 40 years from the date of the last entry, where required or permitted by applicable law;
• Contractors – will have relationship data held for the duration of their engagement.
  Post-employment:
  • Medical records – 40 years from the date of the last entry, where required or permitted by applicable law;
  • Medical records related to ionizing radiation – until the person reaches 75 years of age, but in any event for at least 50 years, where required or permitted by applicable law;
• Site visitors – Registration data for site entrance will be retained for 12 months. For any injury on site, the visitor will be referred to our on-site Occupational Health Team and would have records stored as follows:
  • General injury records – 3 years from the last entry or, for minors, until the individual reaches 21 years of age, where required or permitted by applicable law;
• CCTV footage – footage is retained on site for approximately 14 days unless an incident is identified during that period. If an incident occurs, relevant footage may be retained for the duration of the incident investigation and for any longer period required or permitted by applicable law.

When the relevant retention period expires, we will securely delete, anonymize or otherwise dispose of Personal Data, including by securely destroying paper records through an approved waste management provider.

Your Data Protection Rights

Subject to applicable legal conditions and limitations, you may have the following rights under the PDPL, the GDPR or other applicable privacy laws:

• Your right to be informed and your right of access
  • You have the right to ask us for information about how we process your Personal Data and for a copy of the Personal Data we hold about you.
• Data portability
  • You may ask Hov Global to provide you with a copy of Personal Data that you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller where technically feasible and legally required.
• Correction of your personal information (the right to rectification)
  • You have the right to ask Hov Global to correct, complete or update any inaccurate, incomplete or out-of-date Personal Data that we hold about you.
• Deletion of your personal information (the right to be forgotten)
  • You have the right to ask Hov Global to delete or destroy your Personal Data where applicable law gives you that right and where Hov Global has no overriding legal, regulatory, contractual or legitimate basis to retain it.
• Restriction of processing of your personal information
  • You have the right to ask Hov Global to restrict the processing of your Personal Data where applicable law gives you that right, including where:
    • you contest the accuracy of the Personal Data held by Hov Global, for a period enabling us to verify its accuracy;
    • the processing is unlawful, but you oppose deletion and request restriction of use instead;
    • Hov Global no longer needs the Personal Data for the purposes of processing, but you need it for the establishment, exercise or defense of legal claims; or
    • you have objected to processing and Hov Global is verifying whether it has overriding legitimate grounds to continue the processing.
• Automated decision-making and profiling
  • Hov Global does not generally make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If Hov Global carries out such processing, we will provide information required by applicable law and allow you to exercise any rights available to you, such as requesting human intervention, expressing your point of view, contesting the decision or objecting where applicable.
    • Objections and direct marketing – You have the right to object to processing of your Personal Data where applicable law gives you that right, including processing based on legitimate interests or actual interests, direct marketing and related profiling. You may opt out of direct marketing at any time.
    • Withdrawal of consent – Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

If you wish to exercise any of the above rights, please contact Hov Global using the contact details below. We may need to verify your identity before responding, and we will respond within the time limits required by applicable law.

You also have the right to make a complaint with the relevant supervisory or regulatory authority if you are unhappy with the way Hov Global processes your Personal Data or handles your rights request. In Saudi Arabia, the relevant authority is the Saudi Arabian Data and AI Authority (“SDAIA”). In the European Economic Area, you may contact the supervisory authority in the EU Member State where you live or work or where you believe an infringement occurred.

Navigation and Cookies

Please note that Hov Global is the Controller of Personal Data collected through the Hov Global website (the “Website”) and the Hov Global Portal (the “Portal”).

Hov Global collects Personal Data through the Website and Portal when users register, request publications or information, send instructions in connection with services, sign up for conferences and events, apply for jobs, participate in surveys or forums, use online services, or otherwise interact with the Website or Portal. The Personal Data collected may include information you provide, such as names, mailing addresses, email addresses, telephone and fax numbers, account credentials, service instructions, event preferences and, for recruiting purposes, application materials and other information included in your resume or application.

The Website and Portal use cookies and similar technologies to operate the Website and Portal, remember your preferences, understand usage, improve services, support security, diagnose technical issues and, where permitted, measure or personalize communications. Essential cookies are used where necessary to provide the Website or Portal. Non-essential cookies, analytics cookies, advertising cookies or similar technologies will be used only where permitted by applicable law and, where required, with your prior consent.

You can manage cookies through the cookie settings provided on the Website or Portal, where available, and through your browser settings. If you disable certain cookies, some features of the Website or Portal may not function properly.

How do we protect Personal Data?

Hov Global is committed to ensuring the security of your Personal Data. Hov Global takes appropriate technical, organizational, physical and administrative measures designed to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, alteration, disclosure or access. These measures are selected with regard to the nature, scope, context and purposes of processing and the risks to individuals.

Employees and contractors of Hov Global with data-handling responsibilities are trained to handle Personal Data securely and confidentially. Access to Personal Data is limited to personnel who need it for the purposes described in this Privacy Notice or to perform their official functions.

If Hov Global becomes aware of a Personal Data breach, security incident or unauthorized disclosure affecting your Personal Data, we will assess the incident and notify affected individuals and competent authorities where required by applicable law.

Hov Global will not disclose your Personal Data to a third party unless the disclosure is necessary for a purpose described in this Privacy Notice, required or permitted by law, necessary to protect vital interests, necessary to protect rights or security, or made with your consent where consent is required.

Changes to this Notice

Hov Global may update this Privacy Notice from time to time. Where required by applicable law, we will notify you of material changes or obtain your consent before applying changes that materially affect how we process your Personal Data. We advise you to periodically review this Privacy Notice to stay informed about how Hov Global protects your privacy.

Privacy Officer

If you have any questions, concerns or complaints about this Privacy Notice, how Hov Global handles your Personal Data, or if you wish to exercise any of your rights, please send an email to privacyofficer@hovglobal.com. If you prefer to send a letter, the mailing address is listed below:

For Hov Global and all Hov Global Based Companies

Attention: Hov Global Privacy Officer
Business Gate, Gate 5
Airport Road, Building 7555, 1st Floor
Qurtobah District
Riyadh, 13244
Saudi Arabia

You can also contact the Saudi Arabian Data and AI Authority (“SDAIA”) if you have concerns with how we have used your Personal Data or handled your complaint.

SDAIA’s address:
Al Nakheel District
Building Code: B001-1003
Riyadh, 12382
Saudi Arabia

Phone Number: 8001221111 (when dialing from Saudi Arabia)
SDAIA website: https://www.sdaia.gov.sa