Privacy Policy

Rabaya Real Estate is a real estate marketing, sales, and advisory company based in Jeddah, Saudi Arabia. For the purposes of this Policy and the PDPL, Rabaya acts as the data controller for the personal data described here — meaning we determine the purposes and means of processing it.

The company’s registered legal name is Rabaya Real Estate Company, and it holds the Commercial Registration (Unified Establishment Number) No. 7017105557, and operates under the Val Real Estate Brokerage and Marketing License No. 1200015554 issued by the General Authority for Real Estate.

This Policy applies to personal data we collect through our public website (rabaya.sa) and its associated features, including our property and project listings, inquiry and booking forms, careers portal, and AI Advisor chat. It does not apply to information collected by third-party websites or services that we do not own or control, even if we link to them or use them for a limited purpose described below.

This Policy does not apply to the internal management of our own staff/employee records, which are governed separately.

We only collect personal data that is relevant to the services described in this Policy. Depending on how you interact with us, this may include:

• Contact and identity data — such as your name, phone number, and email address, when you submit an inquiry, contact form, or booking request.
• Property and investment preferences — such as your budget range, preferred city, property purpose (residence or investment), timeline, and any message or notes you choose to share, when you request a consultation or express interest in a project.
• Visit scheduling data — such as your preferred date and time, when you book a property viewing.
• Job application data — such as your name, email, mobile number, CV/resume file, and cover letter, when you apply for a position through our careers page.
• AI Advisor conversation data — the messages you exchange with our AI Advisor, and, if you choose to share them during the conversation, your name, phone number, or email address.
• Attribution data — information about how you arrived at our website (such as the referring website or a marketing campaign reference), captured automatically on your first visit.
• Cookie and consent preference data — as described in the Cookies section below.
• Website usage information collected by analytics and marketing technologies, but only once you have given your consent, as described in the Cookies section below.

We do not ask for, and do not knowingly collect, sensitive categories of personal data (such as health information, religious beliefs, or biometric data) through our website.

• Directly from you, when you fill in a form on our website — including our Contact, Consultation, Schedule a Visit, and Job Application forms.
• Directly from you, through your conversation with our AI Advisor.
• Automatically, through cookies and similar technologies described in the Cookies section below, and only for non-essential purposes once you have given consent.
• Automatically, when you use our Favorites or Compare features, which are linked to your browser session rather than your identity.

We process your personal data for the following purposes, on the following legal bases recognized under the PDPL:

• To respond to your inquiries and provide the information or service you requested — based on your consent in submitting the request, and, where relevant, to take steps at your request prior to entering into an agreement with us.
• To schedule and manage property viewings and consultations — based on your consent and, where applicable, to perform our obligations to you.
• To process your job application and assess your suitability for a role — based on the steps necessary prior to entering into an employment relationship, at your request.
• To operate and improve our AI Advisor and respond to your questions — based on your consent in using the feature.
• To understand how visitors use our website and to measure and personalize marketing, only where you have given your consent — based on your consent.
• To maintain the security, integrity, and proper functioning of our website — based on our legitimate interest in protecting our services and users, exercised in a way that does not override your own rights and interests.
• To comply with our legal and regulatory obligations.

Our AI Advisor is a chat feature that helps visitors get information about our properties, projects, and services. Here is how it works:

• By default, the AI Advisor answers your questions using Rabaya's own internal knowledge base of property and project information — no external AI provider is involved, and your conversation stays within our own systems.
• In some cases, Rabaya may enable a third-party AI service provider (such as OpenAI) to help generate the AI Advisor's responses. If this option is active, the text of your conversation — including any name, phone number, or email address you choose to share during the chat — may be transmitted to that provider in order to generate a response to you.
• Your conversation is linked to an anonymous session identifier stored in your browser, not to a user account, unless you separately submit an inquiry through one of our forms.
• We keep a record of your AI Advisor conversation so that our advisors can review it if you ask to be connected with a member of our team, or if your conversation is escalated for follow-up.
• The AI Advisor's responses are provided for general informational and advisory purposes only. They do not constitute a binding offer, a legal or financial opinion, or a substitute for professional advice, and any transaction remains subject to our usual sales/consultation process with a human advisor.

When you apply for a role through our careers page, we collect your name, email, mobile number, CV/resume file, and, if you provide one, a cover letter.

We take the protection of applicant information seriously. Uploaded CVs and application documents are stored in a private, access-controlled location — they are never publicly accessible by a direct link. Authorized recruitment staff access application documents only through our secure administrative system, using temporary, time-limited, and individually authorized access links generated at the moment they are needed, rather than a permanent public URL.

Your application information is used solely to evaluate your candidacy and to contact you about your application, and is visible only to Rabaya staff involved in recruitment.

We use a small number of cookies and similar technologies, divided into three categories:

• Essential — necessary for our website to function, such as remembering your session, your chosen language, your AI Advisor conversation, and your cookie preference itself. These cannot be switched off, because the website cannot work properly without them, and are not used for advertising.
• Analytics — help us understand how visitors use our website (for example, Google Analytics), so we can improve it. These are only activated if you give your consent.
• Marketing — used by our advertising partners (Meta, Snapchat, and TikTok) to measure and personalize advertising. These are also only activated if you give your consent.

When you first visit our website, you will be shown a cookie preference banner where you can accept all non-essential cookies, reject them, or choose exactly which categories to allow. Analytics and marketing technologies do not load, and do not collect any information, until you actively grant that specific consent.

You can change or withdraw your consent at any time by selecting "Cookie Preferences" in the footer of our website. Withdrawing consent stops non-essential tracking from that point onward; it does not affect the lawfulness of anything that occurred before you withdrew it.

We do not sell your personal data. We share it only in the following circumstances:

• With Rabaya staff and advisors who need it to respond to your inquiry, manage your booking, or process your application, within our own organization.
• With our analytics and advertising technology partners (Google, Meta, Snapchat, and TikTok), but only for visitors who have given consent to the relevant cookie category, and only to the extent necessary for the analytics/advertising purpose described above.
• With a third-party AI service provider, only if and when the optional AI Advisor integration described above is active, and only the conversation content necessary to generate a response.
• With government authorities, regulators, or law enforcement, where we are legally required or permitted to do so.
• With a successor entity, in the event of a merger, acquisition, or sale of all or part of our business, subject to the same protections described in this Policy.

Some of the third-party technologies described in this Policy — including our analytics and advertising partners, and, where active, our optional AI service provider — are operated by companies that may process data outside Saudi Arabia as part of their global infrastructure.

Where personal data is transferred outside Saudi Arabia, we rely on the safeguards recognized under the Regulation on Personal Data Transfer Outside the Kingdom, such as standard contractual clauses, binding common rules, or an equivalent certified mechanism, and we only use providers for this purpose once you have given the relevant consent (for analytics and marketing technologies), as described in the Cookies section above.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy — including providing our services, responding to your inquiry, managing our relationship with you, and complying with our legal, regulatory, accounting, or employment-record obligations, whichever requires the longer period for the relevant category of data.

Where we no longer have a legitimate purpose for retaining your personal data, we take steps to securely delete, anonymize, or otherwise dispose of it, in accordance with our internal data-retention practices.

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or loss. These include restricting access to personal data to authorized personnel who need it to perform their role, using secure, authenticated methods to access sensitive documents such as job applications, and applying access controls across our administrative systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us using the details in the Contact Us section below.

Our website and services are intended for individuals who are legally capable of engaging in real estate inquiries and transactions, and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can address it.

Under the PDPL, you have the following rights in relation to your personal data:

• The right to know the legal basis and purpose for collecting your personal data.
• The right to access the personal data we hold about you.
• The right to receive your personal data in a clear, readable format.
• The right to request the correction, completion, or updating of inaccurate or incomplete personal data.
• The right to request the destruction of your personal data where there is no longer a legal basis for us to retain it.
• The right to withdraw your consent at any time, where our processing is based on your consent — including your cookie preferences — without affecting the lawfulness of processing carried out before your withdrawal.
• The right to object to your personal data being used for direct marketing purposes.

To exercise any of the rights listed above, or if you have any question or concern about how we handle your personal data, please contact us using the details in the Contact Us section below. We will respond to your request within the timeframe required under the PDPL and its Implementing Regulations.

We may need to verify your identity before processing certain requests, and in some cases, a request may be subject to limitations permitted under the PDPL — for example, where we have a legal obligation to keep certain information.

If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent authority for the PDPL.

We may update this Policy from time to time to reflect changes in our services, technology, or legal requirements. If we make material changes, we will update the "Last Updated" date below and, where appropriate, take reasonable steps to bring the change to your attention. We encourage you to review this Policy periodically.

If you have any questions about this Privacy Policy, or would like to exercise any of your rights, please contact us at:

• Email: info@rabaya.sa
• Phone: +966 55 335 3394
• Address: Jeddah, Saudi Arabia