Data Privacy Notice

1.1 Who We Are

New Murabba (“We”, “Our”, “Us”) is committed to protecting and respecting your privacy. We are a closed joint stock company owned by the Public Investment Fund of Saudi Arabia with an office at King Salman Bin Abdulaziz Road, Riyadh 13421, Saudi Arabia. Under the applicable data protection laws, including the Saudi Data Protection Law, we act as the data controller for your personal information.

1.2 What This Notice Covers

This Privacy Notice sets out the basis for the collection, use, storage and protection of your personal data when you are visiting our website at www.newmurabba.com (the “Web Site”) or using our property information and other services (the “Services”). We value your privacy, and we are committed to the protection of your personal data and being transparent on how we handle it.

1.3 Your Agreement

This Privacy Notice may be supplemented with other privacy notices of individual services. In the event of any inconsistency, the more specific privacy notice will apply to the relevant service or activity.

1.4 Age Restrictions

Our website and Services are not to be used by people under 18 years old. We do not knowingly collect personal data from individuals under 18 years of age.

1.5 Changes to This Notice

This Notice was last updated in [July 2026] and may be subject to further updates from time to time. Any such updates can be viewed through the latest version of this Notice as published on New Murabba’s website.

2.1 Information you provide to us

You may provide personal data to us when you subscribe to our newsletter or any other marketing materials, express interest in our properties by filling out forms on our website, via the contact us page on our website, through telephone, text/SMS, email, and social media.

Such personal data may involve your full name, email address, phone number, nationality, country of residence, communication preferences, occupation, and the content of your communications to us. You can also provide other information related to the Services, including your property preferences and data associated with your interest in purchasing properties.

2.2 Information we collect automatically

When you visit our website or use our Services, we automatically collect certain information sent to us by your computer, mobile phone, or any other device. This may includes:

• Information about the device and connection: IP address, type and identifier of the device, operating system, browser version and language, mobile network data, and available storage space of the device.
• Usage Data: Pages that you visit on our website, referral URL, date and time of your requests, and your usage of our Services.
• Location Information: When you access our website and Services, we may collect approximate location data using technologies, including Wi-Fi access points and IP addresses.
• Transaction Information: Details about your transactions and interactions with us including information about your device and IP address (we do not collect payment card or account information in this auto collection).

We use your personal information for several purposes based on different legal grounds, as required by applicable data protection laws, including the Saudi Personal Data Protection Law. Below, we explain how and why we use your information.

3.1 With Your Consent

Where required by law, we will ask for your consent before using your information for the following purposes:

• To register you for our newsletters or alerts based on your request.
• To communicate marketing information to you with regards to:
  • Properties
  • Tourism
  • Services
  • Promotions
  • Events
  • Other news and information that we believe to be of interest to you, including news and information about other projects of the Public Investment Fund should you have chosen to receive such communications.

You can withdraw your consent at any time by using the unsubscribe link in our communications or by contacting us directly by sending email to [email protected].

3.2 To Provide Our Services (Contractual Necessity)

Contractual obligations include use of your Information in operating the website & Services, including delivering products requested.

3.3 For Our Legitimate Business Interests

To operate our business effectively and to provide you with quality service, we use your information for the following legitimate business purposes:

• Manage the website and Services, including troubleshooting issues, conducting data analysis, testing, conducting research, and performing statistical analyses.
• Maintain a secure environment for our users, our website and services, and support Business Operations.
• Provide you with vital notices concerning security, privacy and organizational issues. These are not marketing communications, but service communications, and you cannot opt out of receiving them.
• Personalize the website and Services to provide you with the best user experience based upon your preferences.
• Improve and Update our Services and Offerings based upon user feedback, comments and behaviour on the website and Services.

3.4 To Comply with Legal Obligations

We may use your information to comply with applicable legal requirements, our rights, and the rights of our users or other individuals.

3.5 Purpose Limitation

We will not use your information for any other purpose other than those mentioned above, except where required or permitted by law.

We use cookies and other similar technologies to collect information about your browsing activities over time and across different websites following your use of our Services. Cookies allow us to recognize and count the number of users and to see how users navigate around our Website when they are using it. This helps us to improve our Services and the way our Website works.

For more information, please review our Cookie Policy.

We do not use or share your information with others except as detailed in this Privacy Notice. Under some situations, we will disclose your information to third parties, with your consent, as necessary, or as otherwise required or permitted by law. Specifically, we share your information:

5.1 With Service Providers

For business purposes in our legitimate interests or to fulfill an obligation to you, we share your information with service providers and vendors. Such third parties include data analytics vendors, security vendors and website hosting vendors. These service providers assist us with functions such as data storage, disaster recovery services, and communicating with you.

5.2 At Your Request

When you request that we share certain information with third parties, with your consent or to perform a contract with you, we will disclose your information to the appropriate third parties.

5.3 With Professional Advisors

We disclose your details to professional advisors in our legitimate interests or as required by law. As necessary, we will share your information with professional advisors acting as service providers such as auditors, law firms, or accounting firms.

5.4 For Legal and Regulatory Requirements

For legal and security reasons and to protect our Services and business, in our legitimate interests or as required by law, we will disclose your information to the regulators, law enforcement agencies, public authorities, or any other relevant organizations when it is necessary to respond to a legal obligation, comply with applicable law or any obligation arising under it (including cooperation with law enforcement, judicial orders, and regulatory inquiries), protect our interests and ensure the safety and security of us, our users, a third party or the public, exercise or defend legal claims, and enforce our terms and conditions, other terms of service, or other agreements.

As we are located in the Kingdom of Saudi Arabia, the personal data that we collect from you will be transferred to and stored or processed within the Kingdom of Saudi Arabia. Where permitted by applicable laws, we may transfer your personal data to other countries as necessary to provide our services, including to our service providers. Any cross-border transfer of personal data will be carried out in accordance with the requirements of the Personal Data Protection Law (PDPL) and its Implementing Regulations.

We will take appropriate technical and organizational measures to ensure that your personal data is processed securely and in accordance with this Privacy Notice and applicable laws.

We retain personal data for different periods depending on the type of personal data and the purposes for which it was collected.

7.1 Retention Periods

We retain your contact, registration, and communication data for as long as necessary to provide our services and fulfil the purposes for which the data was collected, in accordance with our approved data retention periods and applicable legal and regulatory requirements.

We also retain technical and usage data relating to your use of our website and Services for as long as necessary for operational, security, and audit purposes, in accordance with our approved data retention periods and applicable legal and regulatory requirements.

Once the purpose for retaining your personal data has been fulfilled or the applicable retention period has expired, we will securely destroy the personal data unless there is a legal basis that requires or permits us to retain it for a longer period.

7.2 Legal and Contractual Requirements

We may retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our terms and conditions, other applicable terms of service, and contractual agreements.

7.3 Aggregated and Anonymized Data

After the applicable retention periods have expired, we may retain data in an aggregated and anonymized form for analytical, statistical, and business purposes, provided that such data can no longer be used to identify you.

Your personal data is important to us, and we have ensured that we have put technical and organization controls to safeguard your personal data when you send it via our website, email, text/SMS and other means of communication. We also constantly assess and revise our security practices including, but not limited to access controls, encryption, and employee training, to provide the most security for your personal data.

In accordance with the Personal Data Protection Law (PDPL) and its implementing regulations, you may, under certain circumstances, have specific rights in relation to your personal data. The availability and exercise of these rights may be subject to applicable legal requirements, exceptions, and limitations.

9.1 Your Privacy Rights

• Right to Be Informed: The right to be informed about the legal basis and purpose for collecting your personal data and how it will be processed, stored, used, and shared.
• Right to Access: The right to access your personal data held by us and obtain information about how it is processed.
• Right to Obtain a Copy: The right to request a copy of your personal data held by us in a clear and readable format, in accordance with applicable legal requirements.
• Right to Correction: The right to request the correction, completion, or updating of any inaccurate or incomplete personal data we hold about you.
• Right to Destruction: The right to request the destruction or deletion of your personal data were permitted by applicable laws and regulations.
• Right to Withdraw Consent: Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time, subject to applicable legal requirements.

9.2 Limitations on Your Rights

Please note that your rights may be subject to certain limitations and exceptions as permitted under applicable laws and regulations. In some circumstances, we may be unable to fulfil your request were doing so would adversely affect the rights of others, compromise our trade secrets or intellectual property, conflict with legal or regulatory obligations, serve overriding public interests, or where we are required by law to retain your personal information.

9.3 How to Exercise Your Rights

To exercise any of these rights, you may contact us at [email protected]. We will respond to requests to exercise these rights without undue delay and in accordance with any timelines prescribed by PDPL and its implementing regulation.

Our website may contain links to third-party websites, online platforms, plug-ins, or applications that are operated independently from us. We do not control these third parties and are not responsible for their content, privacy policies, or any processing activities conducted by them in relation to your personal data.

If you choose to provide personal information directly to a third party, including through social media platforms or other external websites, such information will be subject to that third party's privacy policy and terms of use. We encourage you to review their privacy policies before sharing your personal information.

The inclusion of links to third-party websites or services does not constitute an endorsement by us of such websites, their content, or their operators, except where expressly stated.

If you have a complaint regarding how we process your personal data, please contact us at [email protected]. We will review and respond to your complaint in accordance with the applicable requirements under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.

If you are not satisfied with our response or how your complaint has been handled, you have the right to submit a complaint to the Saudi Data & AI Authority (SDAIA) through its available complaint channels.

We welcome your questions, comments, and concerns about this Privacy Notice or your information. Please send us any feedback to [email protected].