Privacy Policy

This policy covers the Lbbak app, our website, and every form connected to them, including the waitlist, the contact form, and job applications. Lbbak has not launched to the public yet, so this policy governs the service once it becomes available, and it governs the data we collect through the website starting now.

The data controller, meaning the party that decides the purpose and means of processing, is: legal name [__] · commercial registration number [__] · national address in Al Khobar [__] · VAT number [__] · data protection officer and contact details [__].

Regulatory status for providing payment services: [Saudi Central Bank regulatory status — to be completed]. Payments and transfers are executed through [__].

The service is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under that age, and if we find that we have, we destroy it within a reasonable period. If you are a guardian and believe a minor has given us their data, please contact us so we can destroy it.

We collect the following, depending on how you use the service:

• Account and identity data: when you create an account we verify your identity through the National Single Sign-On (Nafath), and receive verification data from it such as your name, national ID or iqama number, and the verification result [exact scope of the data received from Nafath to be confirmed: [__]], along with your mobile number and email address.

• Occasion data: the type of occasion (Eid money, wedding and milkah gifts, congratulations, graduation, a new baby, and others), its name, date and description, any messages you add, the share link, and the record of who took part.

• Invitee data: the names and contact details you upload or share in order to invite others, and the status of each invitation (sent, opened, accepted).

• Payment and transfer data: the gift amount and date, the two parties to the transfer, the payment method, the status of the transaction, the 2.5% service fee on the value of gifts transferred, and the archived record of every transaction. The payment instrument details themselves, such as card or bank account data, are handled by payment service providers and are not stored in full on our systems [to be confirmed: [__]].

• Contact form and waitlist: your name, email address, subject and message, plus the details you give when joining the pre-launch waitlist [fields to be confirmed: [__]].

• Job applications: your name, contact details, and the CV you upload, including the qualifications and experience it contains.

• Technical and usage data: device type, operating system, app identifiers, IP address, sign-in and crash logs, the pages you visit, and cookies.

We do not ask for sensitive data, as defined in the Personal Data Protection Law, in order to provide the service. Please do not include such data in your messages or attachments unless we expressly ask for it.

We only process your data for a specific, legitimate purpose, and each purpose has a legal basis:

• Performing the contract: creating and running your account, organizing occasions and sending invitations, executing transfers and calculating the service fee, notifying you about transactions, and providing support. Basis: performance of a contract you are party to, or steps taken at your request before entering into one.

• Legal obligation: identity verification, anti-money-laundering and counter-terrorist-financing requirements, applicable Saudi Central Bank requirements for payment services, accounting, tax and invoicing obligations, and responding to requests from competent authorities. Basis: an obligation imposed by law or by a competent authority.

• Legitimate interest: protecting our systems, preventing fraud and misuse, detecting faults and improving the service, and measuring usage in aggregate. We do not rely on this basis where your rights and interests outweigh it, and we never rely on it to process sensitive data.

• Consent: marketing messages, optional notifications, and non-essential cookies. You can withdraw your consent at any time, and withdrawal does not affect the lawfulness of processing carried out beforehand.

Job applications are processed to assess your candidacy and contact you about it, on the basis of steps taken at your request, and on your consent where we keep your application on file for future openings.

By its nature, Lbbak involves sharing other people's data: when you upload an invitee list or share an occasion link, you are giving us data that is not only yours.

Your responsibility: you must have a lawful basis for sharing invitee data, such as their consent or a relationship that justifies contacting them; the data must be limited to what the invitation needs, and must be accurate; and the list must not be used for any purpose unrelated to the occasion.

What we do: we use invitee data to send the invitation, enable participation in the occasion, show the organizer who has taken part, and keep the occasion record. Nothing more. We do not sell this data, we do not use it to market our services to invitees without their own separate consent, and we do not build profiles from it.

Invitee rights: any invitee may contact us to access, correct or destroy their data, or to object to receiving invitations, and we will respond as far as the law allows, coordinating with the occasion organizer where necessary. If someone asks us to stop contacting them, we stop sending further notifications [in-app mechanism: [__]].

We do not sell or rent your personal data. We share it, only as far as necessary, with:

• Licensed payment and transfer service providers, to execute payments, transfers and refunds and to handle disputes.

• The identity verification provider, the National Single Sign-On (Nafath), to confirm your identity when you create an account.

• Cloud hosting, messaging, analytics and technical support providers, acting as processors on our written instructions and under contracts that require confidentiality, an appropriate level of protection, and no use of the data for their own purposes.

• Competent, supervisory and judicial authorities, where there is a lawful request or a legal requirement.

• Relevant parties in the event of a merger, acquisition or transfer of the business, on condition that the same level of protection continues and that you are notified as the law requires.

Because of how the service works, other participants see some of your data: your name is shown to the occasion organizer when you send a gift. What other participants see is governed by the privacy settings in the app [default setting to be confirmed, including whether the gift amount is displayed: [__]].

Your data is stored and processed inside the Kingdom of Saudi Arabia [hosting location and provider to be confirmed: [__]].

We may need to transfer some data outside the Kingdom, or allow access to it from outside, for example when using a cloud provider or external technical support. Where that happens, we comply with the Personal Data Protection Law, its implementing regulations, and the rules on transferring personal data outside the Kingdom.

In practice that means: the transfer must not prejudice national security or the Kingdom's vital interests; the recipient must offer an appropriate level of protection; the transfer must be limited to the minimum needed for the purpose; and we carry out a data impact assessment wherever the law requires one.

Depending on the case, the safeguards we rely on include an adequacy decision issued by the Saudi Data and AI Authority, standard contractual clauses, binding common rules, or an accreditation certificate. The list of countries or parties data may be transferred to: [__].

We keep data for as long as the purpose it was collected for requires, and then destroy it or render it anonymous.

Specifically: financial transaction records and identity verification data are kept for [__] years in line with anti-money-laundering requirements and accounting obligations; job applications are kept for [__] and then destroyed, unless you agree to us keeping them on file for future openings; contact messages and waitlist data are kept for [__]. When you close your account we destroy your data, except what the law requires us to retain.

On security: data and payments are encrypted in transit and at rest; access is restricted on a need-to-know basis and access events are logged; multi-factor authentication is applied to sensitive systems; staff are bound by confidentiality obligations and trained on data protection; and controls are reviewed regularly.

If a leak, disclosure or unlawful access does occur, we notify the Saudi Data and AI Authority within the period set by law (72 hours from becoming aware of the incident), and we notify you where the incident could harm your data or conflict with your rights. Even so, no protection is absolute, so please keep your sign-in credentials confidential.

The law gives you the following rights over your personal data:

• The right to be informed: to know the legal basis for collecting your data and the purpose of collecting it, which this policy sets out.

• The right to access the data we hold about you.

• The right to obtain a copy of your data in a clear, readable format.

• The right to have your data corrected, updated or completed.

• The right to request destruction of your data once it is no longer needed for the purpose it was collected for.

• The right to withdraw your consent at any time, for anything processed on the basis of consent.

To exercise any of these rights, write to us at info@lbbak.com or use the contact channels below. We may ask you to verify your identity first, and we respond within no more than thirty days of receiving your request; if a request is complex or repetitive, or needs longer, we will tell you and explain why [__].

Exercising these rights is free of charge. We may not be able to act fully on a destruction request where the data is needed to meet a legal obligation, such as financial transaction records; in that case we explain the reason and the retention period the law sets.

The Lbbak website uses cookies that are necessary to run the site, remember your language preference, and protect forms against misuse. The site does not work without these.

We may also use analytics cookies to measure how pages perform and understand what visitors care about. Non-essential cookies are only set with your consent, and you can withdraw that consent at any time [tools actually in use: [__]].

You can control or delete cookies through your browser settings, bearing in mind that disabling the necessary ones may break parts of the site. In the app, we use device identifiers for operation, security and fraud prevention.

We may update this policy whenever the service or the legal requirements change. We publish the updated version on this page with its last-updated date, and if a change is significant we will notify you in advance through a suitable channel, and may ask for your consent again where the law requires it.

To contact us or exercise your rights: email info@lbbak.com or Info@1speciality.com, or call +966 13 868 7779. Working hours are Sunday to Thursday, 9am to 5pm. Data protection officer: [__].

If you are not satisfied with our response, you have the right to complain to the Saudi Data and AI Authority (SDAIA) through its official channels. You can also follow the steps set out on the Complaints Procedure page of our website.

Complaints about payments and transfers should be raised with us first, and then with the competent supervisory authority in line with [Saudi Central Bank regulatory status — to be completed].