Privacy Policy
Privacy Policy
Last updated: July 2026
KnowKSA ("KnowKSA", "we", "us", "our") operates the website available at knowksa.com and related subdomains (the "Site"). This Privacy Policy explains how we collect, use, share, retain and protect personal data when you use the Site, and the rights available to you under the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 9/2/1443H) and its Implementing Regulations issued by the Saudi Data & Artificial Intelligence Authority (SDAIA) ("PDPL"), together with any other applicable laws.
By using the Site you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Site.
1. About the source of listings and content
KnowKSA is a directory. A significant portion of the business listings, opening hours, phone numbers, addresses, photos, descriptions and similar data displayed on the Site is compiled from publicly available sources online, including but not limited to open web pages, business profiles published by the owners themselves, public map services, government open-data portals, press releases, tourism websites and other third-party publications. We also enrich this content with automated tools and translations. We make reasonable efforts to keep this data accurate, but:
we do not warrant that any listing information is complete, current or error-free;
listings do not imply any endorsement, partnership or affiliation between KnowKSA and the business unless expressly stated;
if you are the owner of a listing and wish to correct, claim or remove it, use the "Claim listing" or "Suggest edit" links on the listing page, or contact us via the Contact page.
2. Data Controller
For the purposes of the PDPL, KnowKSA is the Data Controller of the personal data processed through the Site. You can reach our privacy contact via the Contact page on the Site.
3. Personal data we collect
Depending on how you use the Site, we may collect the following categories of personal data:
3.1 Data you provide directly
Account data — full name, email address, password (stored hashed), and optional profile fields such as bio, location, phone number, avatar image and profile slug.
Authentication data — sign-in identifiers when you use Google or another supported social login, limited to the fields that provider returns to us (e.g. name, email, profile picture).
User-generated content — reviews, star ratings, review titles, review photos, "helpful" votes, favourite lists (name, description, visibility), saved favourites.
Business-owner submissions — listing claims (message, supporting evidence such as documents or URLs), suggested edits (field, suggested value, contact name and email), and new-listing submissions.
Communications — messages you send us through contact forms, support requests or email.
3.2 Data collected automatically
Usage and analytics data — pages viewed, listing pages visited, referring URL, timestamp, session identifier and anonymised user identifier when signed in.
Device and technical data — IP address, user-agent string (browser, operating system, device type), approximate country derived from IP, language preference.
Cookies and similar technologies — see section 9 below.
Diagnostic and security logs — error events, 404 events, request paths, response status, honeypot/anti-abuse signals, and downtime incidents. These may include IP address and user-agent.
3.3 Data from third parties
Public information about businesses (see section 1).
Enrichment data from third-party APIs (for example map coordinates, category suggestions, translations).
Media that you or others upload and that is stored in our media library.
3.4 Sensitive personal data
We do not intentionally collect sensitive personal data (as defined by the PDPL) such as racial or ethnic origin, religious or philosophical beliefs, criminal or security data, biometric or genetic data, or health data. Please do not include such information in reviews, claims, edit suggestions or messages.
4. Legal bases and purposes
We process personal data on the following legal bases permitted by the PDPL and, where applicable, based on your consent:
Performing the service — creating and managing your account, publishing your reviews, processing claims and edit suggestions, delivering favourites and personalised features.
Legitimate interests — running and improving the directory, measuring traffic, preventing abuse, spam and fraud, securing the Site, moderating user content, and defending legal claims.
Legal obligations — complying with requests from competent Saudi authorities and applicable laws.
Consent — for optional cookies (where applicable), marketing communications, and any other processing that requires it.
5. How we use personal data
Operate, maintain and improve the directory and its features.
Create and secure your account and authenticate you.
Publish and display your reviews, ratings, photos and public profile fields.
Review and process listing claims and edit suggestions.
Respond to your enquiries and provide customer support.
Send transactional emails (account, security, claim status, review moderation).
Detect, investigate and prevent abuse, spam, scraping, fraud and violations of our Terms.
Apply rate limits and other integrity controls (for example limiting how many reviews can be posted per 24 hours).
Produce aggregated and de-identified statistics about the Site.
Comply with legal, regulatory and law-enforcement requirements.
6. Automated processing and AI
We use automated systems to enrich and translate listings, generate summaries, moderate content, detect abuse and improve search. These tools do not make legally significant decisions about you. Where we use third-party AI providers, only the minimum data necessary for the specific task is shared with them, and we do not permit them to train their public models on your personal data where that option is available to us.
7. Sharing and disclosure
We do not sell your personal data. We share personal data only in the following situations:
Service providers ("processors") acting on our behalf under contract — including hosting, database and storage providers, email delivery providers, analytics providers, translation and AI providers, error-monitoring providers and content-delivery networks.
Business owners — a business that claims its listing may see reviews, edit suggestions and public-profile information related to that listing.
Public display — information you post publicly (reviews, ratings, public profile fields, public favourite lists) is visible to other visitors and may be indexed by search engines.
Legal and safety — competent Saudi authorities, courts, regulators and law-enforcement bodies, when required by law or to protect the rights, property or safety of KnowKSA, our users or the public.
Business transfers — in connection with a merger, acquisition, restructuring, insolvency or sale of assets, subject to appropriate confidentiality and PDPL requirements.
8. International data transfers
Our hosting, storage and some processing may take place on infrastructure located outside the Kingdom of Saudi Arabia. When we transfer personal data outside the Kingdom, we do so in accordance with the PDPL and its Implementing Regulations, including transfers to jurisdictions recognised by SDAIA as providing an adequate level of protection or under appropriate safeguards (such as contractual commitments imposing equivalent obligations on the recipient).
9. Cookies and similar technologies
We use first-party and third-party cookies and similar technologies to:
keep you signed in and remember your preferences (essential);
secure the Site and prevent abuse (essential);
measure how the Site is used and improve it (analytics).
You can control cookies through your browser settings. Blocking essential cookies may break parts of the Site (for example login).
10. Data retention
We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention is required by law:
Account data — while your account is active. If you request deletion, we remove account data within 30 days, except where retention is legally required.
Reviews and public content — retained while your account is active, and may be retained in anonymised form after deletion where necessary for the integrity of the directory.
Claims and edit suggestions — retained for audit and anti-abuse purposes.
Analytics and diagnostic logs — retained for a limited period consistent with security and operational needs, then deleted or aggregated.
Backups — encrypted backups are rotated on a defined schedule; data deleted from the live database is removed from backups when they cycle out.
11. Your rights under the PDPL
Subject to the conditions and exceptions of the PDPL, you have the right to:
be informed about the collection and processing of your personal data;
access your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data when no longer needed;
request a copy of your personal data in a readable format (portability);
withdraw consent where processing is based on consent;
object to certain processing;
lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe your rights have been infringed.
To exercise any of these rights, contact us via the Contact page. We may need to verify your identity before we act on your request. We will respond within the timeframes set by the PDPL.
12. Security
We apply administrative, technical and physical safeguards designed to protect personal data, including access controls, role-based permissions in the database, row-level security policies, encrypted connections (HTTPS/TLS), hashed passwords, rate limiting, honeypot and anti-bot controls, audit logs, and monitoring for unauthorised access. No system is completely secure; we cannot guarantee absolute security, but we will notify affected users and the competent authority in the event of a personal data breach in line with the PDPL.
13. Children
The Site is not directed to children under the age of 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will take appropriate action to delete it.
14. Third-party sites and content
The Site may link to or embed content from third-party websites, maps, social platforms and media providers. Their privacy practices are governed by their own policies, and we are not responsible for them.
15. User-generated content and moderation
Reviews, ratings, photos, favourite lists and other content you make public will be visible to other users and may be indexed by search engines. Please do not include personal data of others, defamatory statements, unlawful content or sensitive personal data. We may edit, hide or remove content that violates our Terms or applicable law.
16. Marketing communications
We may send you transactional emails necessary to operate your account. Any marketing emails will be sent only where permitted by law, and you can unsubscribe at any time using the link in the email or by contacting us.
17. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, provide additional notice on the Site. Your continued use of the Site after changes take effect constitutes acceptance of the updated Policy.
18. Contact us
For questions about this Policy or to exercise your rights, please contact us via the Contact page on the Site. For unresolved concerns, you may also contact the Saudi Data & Artificial Intelligence Authority (SDAIA), which supervises the PDPL in the Kingdom.