Privacy Policy for the Tojaz Guarantee Service

This policy explains how personal data related to the use of the “Tojaz Guarantee” service is collected, processed, used, and protected, when creating transactions, carrying out payments or transfers, communicating, submitting objections or complaints, or using any of the service's functions.

1.Introduction

This policy applies to users of Tojaz Guarantee, including the client, buyer, seller, service provider, and any other party using the service, depending on the nature of the transaction.

This policy aims to explain the types of data that may be processed, the purposes of its use, the parties with whom data may be shared, data subjects' rights, and how to contact Tojaz regarding privacy matters.

By using Tojaz Guarantee, the user acknowledges that they have read and understood this policy, to the extent permitted by the regulations and laws in force in the Kingdom of Saudi Arabia.

2.Data Tojaz May Collect or Process

Depending on the nature of the transaction and the use of the service, Tojaz may collect or process certain personal data, including:

Account and registration data: name, mobile number, email, login data, account type, and establishment or company data where applicable.
Verification and identity data: data or documents necessary to verify the user's identity or eligibility to use the service, where required or permitted by law.
Transaction data: the transaction number, the transaction parties, the transaction value, a description of the service, project, or work, deadlines, milestones, and execution terms.
Financial data: payment and transfer data, bank account or payment method data, and refund or disbursement data to the extent necessary to execute the transaction.
Communication and content data: messages, conversations, files, photos, documents, and evidence uploaded or shared by the user within the transaction or dispute.
Dispute and objection data: reasons for objection, complaints, documents, evidence, responses, decisions, and procedures related to the dispute.
Technical and security data: device type, operating system, IP address, login, usage, performance, and diagnostic records, and data necessary for the security of the service.
Support and contact data: support requests, inquiries, reports, and the related communication log.

Tojaz adheres to the principle of data minimization, collecting or processing only the data necessary for, or related to, the purposes specified in this policy or permitted by law.

3.How Data Is Collected

Data may be collected through creating and updating an account, creating or accepting Guarantee transactions, making payments or transfers, uploading documents and evidence, communicating with the transaction parties, and submitting objections, disputes, or support requests.

Some technical data may also be collected automatically when using the app or website, for operational, security, and performance improvement purposes.

Some data may be obtained from other parties where necessary, lawful, and consistent with the applicable regulations, including payment service providers, financial entities, or competent authorities, depending on the nature of the transaction.

The user must provide accurate and up-to-date data, and update it as needed.

4.Purposes of Collecting and Using Data

Depending on the nature of the use, Tojaz uses personal data related to Guarantee for the following purposes:

Operating the Guarantee service and providing its functions.
Creating and managing accounts and verifying user data when necessary.
Creating and organizing transactions, tracking their stages, and carrying out payment, disbursement, transfer, and refund procedures.
Documenting transactions, agreements, approvals, and related procedures.
Enabling communication between the transaction parties and sending related notifications and alerts.
Handling disputes, objections, and complaints, and reviewing related evidence and documents.
Protecting the service and users, and preventing fraud, misuse, and unlawful operations.
Verifying transactions, payment methods, and data when necessary.
Providing technical support and handling requests and inquiries.
Developing the service and improving performance, security, and user experience.
Fulfilling legal obligations or responding to requests issued by competent authorities.
Any other purposes explained to the user when the data is collected, or permitted by law.

Tojaz does not use personal data for purposes incompatible with the purpose for which it was collected, except in cases permitted by law or explained to the user in accordance with the legal requirements.

5.Legal Basis for Processing Data

Personal data is processed according to an appropriate legal basis depending on the nature and purpose of the processing, which may include performing a contract or taking steps at the user's request before concluding the contract, complying with a legal obligation, the data subject's consent when consent is the appropriate basis, or any other basis permitted under the Personal Data Protection Law and its related regulations.

Tojaz undertakes not to request or rely on consent as a basis for processing except in cases where consent is the appropriate basis under the legal requirements, explaining the purpose of the processing when necessary.

6.Data Sharing and Disclosure

Personal data may be shared, to the extent necessary and for a lawful purpose, with:

Payment service providers or related financial entities, when necessary to carry out payments, transfers, or refunds.
Banks and entities related to the transaction, depending on the nature of the service and the required procedure.
Hosting, infrastructure, and technical support providers.
Providers of notification, messaging, verification, security, and supporting technology services.
Government or competent authorities, when disclosure is required or permitted by law.
Entities necessary to protect Tojaz's or its users' rights, the security of the service, and to prevent fraud or misuse.
The transaction parties, to the extent necessary to execute the transaction or handle a dispute, as permitted by the service and the regulations.

Tojaz does not sell personal data merely for the sake of selling it, and any sharing or disclosure is carried out in accordance with the purposes, bases, and controls permitted by the applicable regulations.

7.Data Protection and Information Security

Tojaz applies appropriate technical and organizational measures to protect personal data from unauthorized access, use, alteration, disclosure, loss, or destruction, commensurate with the nature of the data and the risks related to its processing.

Tojaz periodically reviews and updates its protection and security measures as needed.

The user is responsible for keeping their login data confidential and not sharing it with others, and must notify Tojaz immediately if they suspect any unauthorized access to their account.

Tojaz handles security incidents in accordance with the relevant procedures and legal requirements, while acknowledging that no electronic environment can be guaranteed to be absolutely secure.

Tojaz does not ask the user to share their password or secret verification codes through official support channels, and the user must not share them with anyone.

8.Cookies and Similar Technologies

The Tojaz website and apps may use cookies and similar technologies necessary to operate the service, improve performance, and analyze usage, depending on the nature of the technology used.

These technologies may be used to remember certain user settings, improve the user experience, measure the service's performance, and improve security.

Cookie control options may vary depending on the browser or device used, and disabling some necessary technologies may affect certain website or service functions.

9.Financial Data, Payments, and Transfers

When Tojaz Guarantee is used to make a payment, transfer, or refund, the data necessary to complete and document the transaction may be processed in accordance with the approved payment mechanism.

Some payment or transfer operations may be carried out through payment service providers or financial entities, and their processing of data is subject to the relevant regulations and policies.

Data related to financial transactions may include the transaction value, payment method data, bank account or transfer data, and disbursement and refund data, to the extent necessary to execute the transaction.

Financial data is processed to the extent necessary to execute, protect, and document the transaction, and to fulfill the relevant legal obligations.

10.Hosting, Processing, and Transfer of Data Outside the Kingdom

The personal data of Tojaz users is hosted and processed within the Kingdom of Saudi Arabia, in accordance with the regulations and laws in force in the Kingdom, depending on the technical infrastructure approved for the service.

Tojaz does not transfer personal data outside the Kingdom unless it becomes necessary to do so in the future, in which case the transfer is carried out in accordance with the requirements and controls in force in the Kingdom of Saudi Arabia.

11.Data Retention and Destruction

Tojaz retains personal data related to Guarantee for the period necessary to achieve the purposes for which it was collected, or for the period required by the regulations and laws, or to protect rights and prove obligations, depending on the nature of the data and its purpose.

Once the legal or legitimate need to retain the data ends, Tojaz destroys, deletes, or de-identifies it in accordance with the applicable procedures and controls.

Tojaz may retain some transaction, dispute, or other records after an account is closed if retention is required by law or necessary to prove existing rights or obligations, or for legitimate legal purposes.

12.Data Subject Rights

In accordance with the applicable regulations and laws, the data subject has the right to exercise the rights established for them, depending on the circumstances, including:

The right to know how their personal data is collected, the legal basis, and the purpose of its processing.
The right to access and obtain their personal data in accordance with the legal controls.
The right to request the correction, completion, or updating of their personal data.
The right to request the deletion or destruction of their personal data when the legal conditions for doing so are met.
The right to withdraw consent, when consent is the basis for processing, in accordance with the legal controls.
Any other rights established under the Personal Data Protection Law and its related regulations.

The user may request the deletion of their account and personal data through the means and channels Tojaz provides for this purpose; deleting an account does not necessarily mean all transaction records or data are deleted immediately if there is a legal obligation or legitimate basis for retaining them.

13.Minors' Data

Tojaz Guarantee does not target the collection of minors' personal data without an appropriate legal basis and the necessary measures to protect their data.

If any transaction or service requires processing a minor's data, the processing is carried out in accordance with the legal provisions and controls applicable to minors' data and depending on the nature of the transaction.

14.Third-Party Services and Links

Tojaz Guarantee may rely on services or integrations provided by other parties, including payment service providers, banks, and technical service providers.

Tojaz is not responsible for the privacy policies or data-processing practices of those parties, beyond the scope of its control.

The user should review the privacy policies and terms of any third party before using its services or sharing their data with it.

15.Updates to This Privacy Policy

Tojaz may update this policy from time to time to reflect the development of the Guarantee service or regulatory or operational changes.

The updated version will be published through the appropriate channels on the platform, and the last-updated date will be shown at the end of the policy.

The user is advised to review the policy periodically to stay informed of any updates.

16.Contact and Privacy Inquiries

For inquiries related to this privacy policy, personal data, or exercising rights, the user may contact Tojaz through the official contact channels shown on the website or app.

A request to exercise a right must include, when necessary, information that helps Tojaz verify the identity of the requester and identify the relevant data, account, or transaction, in accordance with the applicable requirements and procedures.

Legal name of the data controller: Tojaz
Privacy contact email: support@ijaz.sa
Contact number: +966 12 345 6789
Address: Kingdom of Saudi Arabia
Last updated: September 18, 2026

17.Bank Account and Transfer Data

Bank account or beneficiary data requested by Tojaz Guarantee to carry out transfers, disburse dues, refund amounts, or settle transactions may be processed. Processing of this data is limited to purposes related to the transaction and to the extent necessary to execute it and comply with the applicable legal requirements.

18.Payment Method Data

Data related to the payment method used to complete a transaction may be processed. Payment data is processed through the approved or licensed entities or payment service providers, depending on the nature of the transaction. Tojaz Guarantee is not required to retain sensitive payment card data except to the extent permitted by the regulations and the requirements of the payment service provider and the technical infrastructure actually used.

19.Identity Verification and Fraud Prevention

Tojaz Guarantee may request additional documents or data to verify the user's identity, the accuracy of their data, or the eligibility of the transaction's beneficiary, to verify unusual transactions, or to limit fraud and misuse, in accordance with the applicable legal requirements and security procedures.

20.Entities Data May Be Shared With

Data may be shared, to the extent necessary, with entities that provide identity verification, hosting and technical, payment and transfer processing, customer service, systems analysis, and transaction execution services, as well as with banks, financial entities, or licensed or authorized payment service providers, or competent government, judicial, or security authorities, when required or permitted by law.

21.Transaction and Dispute Records

Tojaz Guarantee may retain records related to transactions, including the transaction parties' data, details of requests, payments, and transfers, correspondence, documents, attachments, and evidence submitted in disputes, and login, usage, and in-system action records, for the purposes of executing the transaction, managing disputes, protecting rights, and complying with legal requirements.

22.Correcting and Updating Data

The user has the right to request the correction or updating of their personal data when it is inaccurate or incomplete, in accordance with the procedures and channels specified by Tojaz Guarantee, and without conflicting with legal obligations or the need to retain records related to an existing financial transaction or dispute.

23.No Use of Data for Undisclosed Purposes

Personal data is not processed for purposes that differ materially from those explained in this policy, except as permitted by the regulations, or after taking the appropriate legal action to inform the user or obtain their consent where consent is required.