Privacy Notice
This Notice is intended to provide clear notice in accordance with the Saudi Personal Data Protection Law and its Implementing Regulations. Separate notices may apply to specific activities, including event attendance, mobile applications, recruitment, supplier onboarding or services operated by third parties. A more specific notice will prevail for the activity it covers.
01Controller
Saudi Arabian Oil Company, a Saudi joint stock company registered in Dhahran under commercial registration number 2052101150, is the controller of personal data processed through the Website unless another notice identifies a different controller.
02Scope of this Notice
This Notice applies to personal data processed through the Website, including when you browse, create an account, submit a registration or application, request information, subscribe to updates, contact us, respond to a survey or interact with Website content. It does not govern a third-party website or platform that publishes its own privacy notice.
03Personal data we collect
Depending on how you use the Website, we may collect the following categories of personal data:
- identity and contact data, such as name, title, email address, telephone number, country and preferred language;
- professional and organisational data, such as employer, job title, sector, company details, business interests and professional profile;
- registration and application data, such as participant category, attendance preferences, programme selections, eligibility information, accreditation details and information included in supporting documents;
- account and authentication data, such as username, account identifiers, sign-in events and security credentials stored in protected form;
- communication data, including enquiries, correspondence, support requests, feedback, survey responses and communication preferences;
- marketing data, including subscriptions, consent records, campaign engagement and opt-out preferences;
- technical and usage data, such as IP address, device and browser information, identifiers, access times, pages viewed, links selected, referring pages, error logs and security events;
- cookie and similar technology data, as described in the Cookies Policy;
- media and public-profile data that you choose to submit for publication, such as a biography, headshot, company logo or speaker profile; and
- limited sensitive data where genuinely necessary and lawfully collected, such as accessibility, dietary or health-related information voluntarily provided to support participation.
We seek to collect only data that is adequate, relevant and limited to what is necessary for the stated purpose. Mandatory fields are identified at the point of collection. If mandatory data is not provided, we may be unable to process a registration, respond to a request or provide the relevant service.
04How we collect personal data
We collect personal data directly from you through online forms, accounts, emails, telephone calls, surveys and other communications. We may also collect data automatically through server logs, cookies and similar technologies.
Where permitted by law, we may receive data from your employer or organisation, an authorised representative, an event registration provider, a service provider, an affiliate, a partner involved in the event, or a publicly available source. If another person provides your data, that person must be authorised to do so and should direct you to this Notice.
05Purposes and legal bases
We process personal data only where there is an appropriate legal basis. The principal purposes and bases are summarised below.
| Purpose | Personal data used | Legal basis |
|---|---|---|
| Operate the Website and accounts | Identity, contact, account, technical and security data | Performance of a service or agreement; legitimate interests; legal requirements |
| Process registrations, applications and enquiries | Identity, contact, professional, registration and communication data | Steps requested before an agreement; performance of an agreement; consent where required |
| Administer the event and communicate operational updates | Identity, contact, registration, preference and communication data | Performance of an agreement; legitimate interests; legal requirements |
| Provide accessibility or other requested support | Identity, contact and limited sensitive data | Explicit consent; vital interests where applicable; legal requirements |
| Protect systems, prevent misuse and investigate incidents | Account, technical, usage, security and communication data | Legitimate interests; legal and security requirements |
| Improve content, performance and user experience | Technical, usage, cookie, feedback and survey data | Consent for non-essential technologies. |
| Send news and promotional communications | Identity, contact, professional, marketing and engagement data | Consent. |
| Meet legal obligations and establish or defend claims | Relevant identity, registration, transaction, communication and technical data | Legal requirements; legitimate interests; judicial requirements |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully or processing supported by another legal basis. Legitimate interests are used only after considering necessity, proportionality and your rights, and are not used as a basis for processing sensitive data.
06How we use personal data
We use personal data to deliver requested services, administer Website accounts and forms, verify submissions, communicate event and service updates, provide support, manage subscriptions, analyse and improve the Website, maintain security, prevent fraud or misuse, comply with law, and establish or defend legal rights.
We do not make decisions that produce legal or similarly significant effects solely by automated means through the Website unless we provide specific notice and an appropriate lawful basis.
07Disclosure of personal data
We may disclose personal data only as reasonably necessary and subject to appropriate safeguards to:
- Aramco affiliates and authorised personnel involved in the Website or event;
- service providers supporting hosting, cybersecurity, registration, communications, analytics, customer support, event operations and document management;
- event partners, sponsors, exhibitors or other participants when you request an interaction, give appropriate consent, or a separate notice explains the disclosure;
- professional advisers, auditors and insurers where necessary for legitimate business and legal purposes;
- competent public authorities, regulators, courts or law-enforcement bodies where required or permitted by law; and
- a successor or relevant counterparty in connection with a proposed or completed corporate reorganisation or transfer, subject to appropriate confidentiality and legal safeguards.
We do not sell personal data. We do not disclose personal data to sponsors or exhibitors for their independent direct marketing merely because you visited the Website. Any such sharing will require an appropriate legal basis and clear notice at the relevant point of interaction.
08International transfers
Personal data may be accessed or processed outside the Kingdom of Saudi Arabia where necessary for event operations, global support or the use of service providers. Transfers are made only in accordance with the Saudi Personal Data Protection Law, the Regulation on Personal Data Transfer Outside the Kingdom and other applicable requirements.
Depending on the destination and circumstances, safeguards may include transfer to a jurisdiction recognised as providing an appropriate level of protection, standard contractual clauses, binding common rules, contractual and technical controls, or another permitted transfer mechanism. Risk assessments and regulatory approvals will be completed where required.
09Retention and secure destruction
We retain personal data only for as long as necessary for the purpose for which it was collected and to meet legal, accounting, audit, security and dispute-resolution requirements. In general, data relating to a relationship or transaction may be retained for up to seven years after that relationship ends, or longer where required by law or necessary to protect legal rights.
Marketing preferences are retained until consent is withdrawn or communications are no longer relevant; limited suppression records may then be kept to respect an opt-out. Cookie durations are described in the Cookie Settings panel. When retention is no longer justified, data is securely deleted, destroyed or irreversibly anonymised in accordance with approved procedures.
10Security
We apply reasonable technical, organisational and administrative safeguards designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. Measures may include access controls, encryption where appropriate, logging, monitoring, secure development, backups, supplier controls, staff confidentiality obligations and incident-response procedures.
No system is completely secure. You should use strong, unique credentials, protect your devices and contact us promptly if you suspect unauthorised access or misuse.
11Your rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- be informed about the collection and processing of your personal data;
- access personal data held about you and request a readable copy;
- request correction, completion or updating of inaccurate or incomplete data;
- request destruction of personal data when it is no longer necessary or where another legal ground applies;
- withdraw consent at any time where processing is based on consent;
- object to or request restriction of processing in circumstances recognised by applicable law;
- submit a complaint concerning the processing of your personal data; and
- seek compensation for material or moral damage where provided by applicable law.
To exercise a right, email data.privacy@aramco.com and describe your request. We may verify your identity and authority before acting. We will respond within the period required by applicable law and will explain any lawful limitation or refusal.
12Marketing communications
Where required, we send promotional emails, SMS messages or similar communications only with consent. You may opt out using the unsubscribe method in the communication or by contacting us. Operational messages about a registration, account, security matter or requested service are not marketing and may continue where necessary.
13Children
The Website is intended primarily for adults and business users. We do not knowingly collect personal data from a child through the Website without the involvement of a parent or legal guardian where required. If you believe a child has provided personal data inappropriately, contact us so that we can review and take appropriate action.
15Complaints
Please contact data.privacy@aramco.com first so that we can review and address your concern. If you are not satisfied, you may submit a complaint to the competent authority for personal data protection in the Kingdom of Saudi Arabia through the National Data Governance Platform at dgp.sdaia.gov.sa, subject to its current procedures.
16Changes to this Notice
We may update this Notice to reflect changes in law, technology, Website functions or our practices. The updated version will be published on the Website with a revised effective date. Where a change materially affects your rights or the way we use personal data, we will provide additional notice where required.
17Contact us
Privacy enquiries and rights requests may be sent to data.privacy@aramco.com. General Website enquiries may be sent to support@iktva.sa.