Privacy Policy

1. Who we are

BAB is a real-estate collaboration platform operated from Riyadh, in the Kingdom of Saudi Arabia, at albab.one. In this policy "BAB", "we", "us" and "our" mean the company that operates BAB, which is the data controller for the personal data described here.

For any question about this policy or about your personal data, contact us at info@albab.one, which is also our point of contact for data-protection matters.

2. What this policy covers

This policy applies to the public website at albab.one, the sign-up and webinar registration flows, and the investor, broker and developer portals operated by BAB.

It does not cover third-party websites or services we link to (for example a developer's own website), which have their own privacy policies.

3. Personal data we collect

Data you give us directly:

• identity and contact details: full name, email address, phone number, and the language you choose;
• account credentials: a password, which we store only in hashed form;
• professional details: company or agency name, job title, and professional licence numbers (for example a REGA "Fal" advertising licence), and the role you register as;
• content you submit: messages, documents, comments and activity in deal rooms, and anything you send to support;
• webinar registrations: your name, email address and how you heard about the event.

Data we collect automatically when you use the site:

• your IP address, approximate location derived from it, device type, browser and operating system;
• pages viewed, the page that referred you, links clicked, and dates and times of access;
• information collected through cookies and the Meta Pixel — see our Cookie Policy.

Data we receive from others:

• if your employer or an agency invites you to BAB, we receive your name and email from them;
• publicly published regulatory information about developers and projects (for example from the Real Estate General Authority and the Wafi programme) — this is business information, not personal data about you as a website visitor.

4. Why we use your data, and our legal basis

We process personal data for the following purposes, on the following bases under the PDPL:

• to create and run your account and provide the platform — performance of a contract with you;
• to verify professional standing and eligibility for broker and developer accounts — legitimate interests and, where applicable, a legal obligation;
• to let investors, brokers and developers collaborate on shared deals and projects — performance of a contract;
• to send service messages such as password-reset codes, approval decisions and webinar confirmations — performance of a contract and legitimate interests;
• to send optional product updates and marketing — your consent, which you can withdraw at any time using the unsubscribe link or by contacting us;
• to keep the platform secure and prevent fraud, abuse and misuse — legitimate interests and legal obligation;
• to measure and improve the website, including through analytics cookies — your consent for non-essential cookies, and otherwise our legitimate interests;
• to comply with Saudi law and to establish, exercise or defend legal claims — legal obligation and legitimate interests.

5. Cookies and similar technologies

We use strictly necessary cookies to run the site and, with your consent, the Meta Pixel for analytics and campaign measurement. Full detail, and how to change your choice, is in our Cookie Policy.

6. When we share your data

We do not sell personal data. We share it only as follows:

• with other users you deliberately collaborate with — for example, a broker in a deal room can see an investor's activity in that room, as needed to progress the deal;
• with service providers acting on our instructions, including cloud hosting, email delivery, and analytics providers such as Meta;
• with our professional advisers, such as lawyers and auditors, under a duty of confidentiality;
• with regulators, courts, law-enforcement and other authorities where we are required or permitted by law to do so;
• with a buyer or successor if BAB or part of its business is sold, merged or reorganised.

7. Transfers outside the Kingdom

Some of our service providers, including Meta, process data outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom we rely on a transfer condition permitted by the PDPL and its regulations — such as an adequate level of protection in the destination, appropriate safeguards, or another lawful ground — and we limit the data transferred to what is needed.

8. How long we keep your data

We keep account data for as long as your account is active and then for the period required by Saudi commercial, tax and anti-money-laundering law — generally up to ten years for transaction and accounting records.

We keep webinar registration data until the event has taken place and any follow-up is complete, then for up to 24 months. We keep marketing data until you unsubscribe. Aggregated or anonymised data, which cannot identify you, may be kept for longer.

9. How we protect your data

We use encryption in transit, hashed password storage, role-based access controls on a least-privilege basis, and due diligence on our service providers. No method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and for telling us promptly of any suspected unauthorised use.

10. Your rights under the PDPL

Subject to the conditions and exceptions in the PDPL, you have the right:

• to be informed of how your personal data is processed;
• to access your personal data and obtain a copy of it;
• to request correction of inaccurate or incomplete data;
• to request deletion of your data where it is no longer needed;
• to withdraw consent to processing that is based on consent;
• to object to or request restriction of certain processing;
• to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).

To exercise any of these rights, contact info@albab.one. We may ask you to verify your identity. We will respond within the period set by the PDPL (currently 30 days, which may be extended in the cases the law allows).

11. Children

BAB is intended for professionals and for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact info@albab.one and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the date above. If the changes are material, we will notify you by email or through the platform before they take effect.

13. How to contact us

BAB, Riyadh, Kingdom of Saudi Arabia. Email: info@albab.one, which is also our point of contact for data-protection matters.