Your Privacy Rights in Kuwait, GCC, Jordan, and Egypt.
Introduction
MyFatoorah Privacy Policy describes your privacy rights and governs how we collect, use, store, share, and protect your personal information. It applies to the MyFatoorah Application.
MyFatoorah will always ensure that your privacy is protected and secured. You can be assured that we shall use your personal information only in accordance with this privacy policy. Please read and understand the Privacy Policy carefully to get on terms with our views and practices regarding your personal data and how we use it.
MyFatoorah reserves the right to make changes to this policy at any point in time at its discretion, and accordingly update this page. Please check this page periodically to make sure you are happy with the changes.
MyFatoorah collects the following types of personal information in order to provide you with the highest level of service using MyFatoorah Application.
Information MyFatoorah Collects Automatically & Information you provide to us:
- Name, designation, and contact information, including email address
- Business/Financial information
- Demographic information like postcodes, preferences, and interests
- IP Address
- Any other information related or relevant to our application process
We may also collect information from or about you from other sources, such as through your contact with us, including our customer support team.
You may choose to provide us with access to certain personal information stored by third parties, such as social media sites (e.g., Facebook and Twitter). The information we may receive varies by site and is controlled by that site. By associating an account managed by a third party with your MyFatoorah account and authorizing MyFatoorah to have access to this information, you agree that MyFatoorah may collect, store, and use this information in accordance with this Privacy Policy.
How We Protect and Store Personal Information
We protect your information using physical, technical, and administrative security measures to reduce the risks of misuse, unauthorized access, disclosure, and alteration. Some of the safeguards we use are firewalls and data encryption, physical access controls to data centers, and information access authorization controls.
MyFatoorah Security
MyFatoorah recognizes its responsibility to keep confidential and secure at all times any information which MyFatoorah receives in connection with a transaction through its Apps. MyFatoorah has all the necessary electronic and physical procedures in place to keep your information secure in order to prevent any unauthorized access. When you log in to your MyFatoorah account, all internet communications are secured using Secure Socket Layer (SSL) technology with 128-bit encryption security. For your own safety, please make sure never to share your MyFatoorah login details with anyone.
Why does MyFatoorah collect your information? And How We Share it with other Third Parties:
We may share your personal information we collect from you, including your name, contact details, and transactions and activities, with:
- Law enforcement, government officials, Banking partners, or other third parties pursuant to a court order, or other legal process or requirement applicable to MyFatoorah; when we need to do so to comply with law or credit card rules; or when we believe, in our sole discretion, that the disclosure of personal information is necessary to prevent physical harm or financial loss, or to report suspected illegal activity or to investigate violations of our User Agreement.
- Other unaffiliated third parties, for the following purposes:
- Fraud Prevention: Fraud Prevention: to help prevent fraud or assess and manage risk. For example, if you use the MyFatoorah application to buy or sell goods using our API or Plugins, we may share account information in order to help protect your accounts from fraudulent activity, alert you if we detect such fraudulent activity on your accounts, or evaluate credit risk.
- Marketing purposes: We may use your information for promotional activities of our new products and features, special offers, and for advertising our products.
- Personalizing user experience: We may use information to understand how our Users as a group use the services and resources provided on www.MyFatoorah.com
- Improving customer service: Your information helps us to respond more effectively to your customer service requests, inquiries, and support needs. (e.g., billing).
- Processing your application: We use the information collected to understand the nature and profile of your business and accordingly approve or decline your application.
- Other third parties with your consent or direction to do so.
Last updated: 30 September 2026
1. Who we are
This notice explains how Fatoorah For Electronic Marketing, a closed joint stock company (Commercial Registration No. 1010709742) (“MyFatoorah”, “we”), processes personal data in the Kingdom of Saudi Arabia in accordance with the Personal Data Protection Law (PDPL) and its Implementing Regulation. MyFatoorah is regulated and supervised by the Saudi Central Bank (SAMA), licence No. 21/LLC/1444.
MyFatoorah provides online payment services to businesses, including a payment gateway, invoicing and payment links, and related merchant tools. This notice applies to merchants and their owners and authorised representatives, to customers who pay a merchant through MyFatoorah, and to visitors to our website and applications.
| Contact | Details |
|---|---|
| Address | Kharijat Ibn Hudhafah, Al Sulaimaniyah District, Unit No. 101, Riyadh 12234-8032, Kingdom of Saudi Arabia |
| Toll-free | 8001000342 |
| Website | www.myfatoorah.com |
| Data Protection Officer | Muath Al Nuzhah — [email protected] |
2. Personal data we collect
| Category | Examples | Mandatory or optional |
|---|---|---|
| Merchant account and verification data | Name, National ID or Iqama number or passport, Commercial Registration number, email, mobile number and address of the business owner and authorised representatives; supporting documents | Mandatory to open and maintain a merchant account |
| Bank and settlement data | IBAN and bank details of the merchant | Mandatory to receive settlements |
| Payment and transaction data | Payer name and contact details provided at checkout, masked card number, amount, date, transaction reference and payment method | Mandatory to process a payment |
| Data from other parties | Payment and chargeback information from banks, acquirers and card schemes; verification results from licensed identity verification providers | Received as part of the service |
| Technical and cookie data | IP address, device and browser type, logs and cookies | Collected automatically when you use our website and applications |
| Communications | Support requests, complaints and related correspondence | Optional; needed to answer your request |
| Marketing preferences | Your choice to receive marketing messages | Optional |
If mandatory data is not provided, we cannot open the account, process the payment or meet our legal obligations.
3. How we collect personal data
- Directly from you: registration and onboarding forms, document uploads, checkout pages, and messages or calls to our support channels.
- Indirectly: cookies and automatic collection when you use our website and applications; banks, acquirers and card schemes; verification providers; and the merchant who sends you an invoice or payment link.
4. Why we process personal data and the legal basis
| Purpose | Legal basis |
|---|---|
| Opening and managing merchant accounts and providing payment services | Performance of our agreement with you |
| Identity verification, anti-money laundering checks, fraud monitoring and investigation, and regulatory reporting | Legal obligation |
| Protecting the security of our systems and services | Legal obligation |
| Answering support requests and complaints | Performance of our agreement and legal obligation |
| Sending marketing about our products | Your consent, which you may withdraw at any time |
We do not process your personal data for a purpose that is inconsistent with the purpose for which it was collected.
5. Who we share personal data with
- Banks, acquirers and card schemes, to process payments, settlements and chargebacks.
- The merchant you are paying, for payments you make through MyFatoorah.
- SAMA and other competent authorities, where required by law.
- Service providers that process data on our behalf under written contracts that meet the Implementing Regulation, such as hosting, communications and customer support providers.
Personal data is transferred or disclosed outside the Kingdom only as permitted by PDPL Article 29 and its regulations.
6. Where we store personal data
Our core payment and customer systems are hosted in data centres in the Kingdom of Saudi Arabia, and their backups are kept in the Kingdom.
7. How long we keep personal data
| Data | Retention period |
|---|---|
| Merchant account, verification, transaction and fraud records | Ten years after the end of the business relationship, as required by applicable anti-money laundering law |
| Marketing consent records | While the consent is active and for the period needed to show that marketing was lawful |
When the retention period ends, personal data is destroyed or anonymised, unless it must be kept for a judicial proceeding.
8. How we protect personal data
We apply administrative, technical and organisational measures that include encryption of data in transit, access controls with multi-factor authentication and role-based permissions, logging and continuous security monitoring, masking of payment card numbers, anonymisation of data that is no longer needed in identifiable form, data loss prevention controls, confidentiality obligations for staff and suppliers, and PCI DSS compliance for payment card data.
9. Your rights and how to exercise them
Under the PDPL you have the right to:
- be informed of the legal basis and purpose of the processing of your personal data;
- access your personal data and obtain a copy in a readable and clear format;
- request correction, completion or updating of your personal data;
- request destruction of your personal data when it is no longer needed, subject to legal retention requirements;
- withdraw your consent at any time, where processing is based on consent;
- submit a complaint to the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA);
- claim compensation for material or moral damage caused by a violation of the PDPL or its regulations.
To exercise your rights, email [email protected] or call Customer Care on 8001000342. We verify your identity using the email address or mobile number registered with us before acting on a request. We respond without delay and within 30 days. If a request requires disproportionate effort, or you submit several requests, we may extend this period by up to 30 additional days; we will tell you in advance, with the reasons. We may decline a request that is repetitive, manifestly unfounded or requires disproportionate effort, and we will tell you why.
To withdraw consent to marketing, use the unsubscribe link in any marketing message or contact us as above.
10. Changes to this notice
We publish any change to this notice on this page with a new “last updated” date and inform you of material changes before they take effect.
11. Contact and complaints
Our Data Protection Officer monitors MyFatoorah’s compliance with the PDPL, oversees our personal data procedures, receives and responds to requests and complaints about personal data, and is the point of contact with the competent authority.
For any question about this notice or your personal data, contact our Data Protection Officer at [email protected]. You can also submit a complaint at www.myfatoorah.com/en/complaint-form/#ksa, or to SDAIA.
