This English text is a translation for convenience; the Arabic version is the official and governing text.

Privacy Policy — Sufaraa Al Watan (National Ambassadors) Competition

Last updated: [DATE] · Version: 1.0

1. Who we are (the data controller)

The Sufaraa Al Watan (National Ambassadors) competition (the "Competition") and its registration and submission platform at ksaambassadors.com (the "Platform") are operated by Saudi Friendship Organization, commercial registration number [CR NUMBER], of [ADDRESS] (the "Organizer", "we", "us"). The Organizer is the data controller responsible for the personal data described in this policy.

For any privacy question or to exercise your rights, contact [DATA CONTACT / DPO NAME] at [DATA CONTACT / DPO EMAIL].

This policy explains what personal data we collect, why, how we use and protect it, who we share it with, and the rights you have under the Personal Data Protection Law of the Kingdom of Saudi Arabia (the "PDPL").

2. Scope

This policy applies to participants in the Competition (Team Leaders and Members), to the parents or legal guardians of participants under 18, and to visitors to the Platform.

3. The personal data we collect

Provided by the Team Leader when registering the Team and its Members:

Identity and contact data: full name; for the Team Leader, an email address and password.
Date of birth (self-declared), used to confirm age eligibility and whether parental consent

is required.

Mobile phone number (Saudi mobile). It is how the program contacts you. A number

registered on more than one team is reviewed by the Organizer during screening and may lead to removal. No government-issued identification number (National ID, Iqama, or similar) is collected from anyone.

Academic Tier (High School or University); the school or institution name and the

academic level within that tier.

For University Members, an institutional email address ending in `.edu.sa`, used to send and

verify a one-time code.

Uploaded or provided during participation:

Recommendation Letters (documents or images) evidencing eligibility.
After acceptance, voluntary-work certificates uploaded by the Team Leader for each

Member.

The content of the Team's Submissions.

For members under 18: an indication that parental or guardian consent is required and, where collected, the consent record and the name, relation, and mobile number of the parent or guardian.

Collected automatically when you use the Platform:

Technical data such as IP address, device and browser information, and pages viewed.
Cookies and similar analytics/marketing identifiers, only where you have consented

(see section 8).

We do not intentionally collect more data than we need for the Competition.

4. Why we use your data and our lawful basis

We process personal data for the following purposes, relying on the lawful bases available under the PDPL (for example, consent, the performance of the relationship with participants, compliance with a legal obligation, or the Organizer's legitimate interests):

to register Teams and Members and manage participation;
to verify eligibility (age band, Eastern Province affiliation, `.edu.sa` status for

University Members);

to review registrations and decide on acceptance, and to notify Team Leaders of decisions;
to enable judging and to administer results, penalties, and awards;
to record and, where required, obtain parental or guardian consent for minors;
to communicate with participants about the Competition (for example, account verification,

password reset, and decision emails);

to operate, secure, and improve the Platform, including preventing fraud and misuse;
to promote and report on the Competition (subject to the licence in the Terms);
to comply with legal and regulatory obligations and to establish or defend legal claims;
for analytics and marketing, only with your consent.

Where we rely on consent (including for non-essential cookies and, for minors, parental consent), you may withdraw it at any time without affecting processing already carried out.

5. Children's and minors' data

A significant number of participants are under 18. We take particular care with their data:

Participation of a Member under 18 requires the verifiable consent of a parent or legal

guardian, in the manner specified by the Organizer.

Parents and guardians may exercise the data rights in section 10 on behalf of a minor.
We limit the minor's data we collect to what the Competition requires.

6. How we share data

We do not sell personal data. We share it only as follows:

Judges and Organizer staff (Admins), to review registrations, verify artifacts, and

score Submissions.

Service providers (processors) acting on our instructions under appropriate agreements,

which may include: cloud hosting and file storage [e.g. Railway (application hosting) and Cloudflare R2 (file storage)], transactional email delivery [e.g. Resend], and analytics/marketing tools configured through our tag manager (see section 8).

Video hosting platforms you choose to use for the Intro Video (for example, YouTube,

Vimeo, or Google Drive). Your use of those services is governed by their own terms and privacy policies.

Competent authorities or third parties where required by law, regulation, or to protect

our rights.

7. Where your data is stored and processed

Personal data is hosted with service providers (Railway and Cloudflare R2) whose infrastructure is located outside the Kingdom of Saudi Arabia. That means data is transferred outside the Kingdom as part of normal operation. We carry out these transfers in accordance with the PDPL and its requirements for transfers outside the Kingdom, including appropriate safeguards.

8. Cookies, analytics, and marketing

Non-essential cookies and analytics/marketing tracking are disabled by default. They are

loaded only after you give consent through the consent banner, using a consent-management approach (Google Consent Mode v2) that keeps tracking off until you agree.

Where enabled, we may use tools such as [Google Analytics 4, Microsoft Clarity, and Meta

Pixel], configured through [Google Tag Manager]. These help us understand how the Platform is used and measure our outreach.

You can decline non-essential cookies and still use the Platform, and you can change your

choice at any time via [the cookie settings / footer link].

Essential cookies necessary for the Platform to function (for example, sign-in and security)

do not require consent.

A separate Cookie Notice [URL], if published, provides further detail.

9. How long we keep your data

We keep personal data only as long as necessary for the purposes above, including the running of the Competition, the resolution of results and any disputes, and compliance with legal obligations. As an indicative period, we keep registration and submission data until the end of the Competition cycle and for 12 months after the results are announced, unless a longer period is required by law. When data is no longer needed, we delete or anonymize it.

10. Your rights under the PDPL

Subject to the conditions and exceptions in the PDPL, you have the right to:

be informed about how your personal data is processed;
access your personal data and obtain a copy;
request correction of inaccurate or incomplete data;
request destruction of your personal data where it is no longer needed;
withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at [DATA CONTACT / DPO EMAIL]. We will respond within the period required by the PDPL. Parents and legal guardians may exercise these rights on behalf of a minor.

If you believe your rights have not been respected, you may lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia [the Saudi Data and Artificial Intelligence Authority (SDAIA) / the competent authority].

11. How we protect your data

We apply appropriate technical and organizational measures to protect personal data, including access controls that restrict registration data to authorized Admins and Judges, protected file access, encryption of passwords and one-time codes, and rate limiting on sensitive actions. No system is completely secure, but we work to protect your data and to respond to incidents as required by law.

12. Third-party links

The Platform may link to third-party sites and services (for example, video hosting). We are not responsible for their privacy practices. Please review their policies.

13. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our processing or in the law. We will publish the updated version on the Platform and, where the change is material, notify participants. The "Last updated" date shows the latest version.

14. Language

This policy is published in Arabic and English. In the event of any conflict or inconsistency between the two versions, the Arabic version prevails.

15. Contact

Organizer / data controller: Saudi Friendship Organization
Privacy contact / Data Protection Officer: [DATA CONTACT / DPO NAME]
Email: [DATA CONTACT / DPO EMAIL]
Address: [ADDRESS]