About SurePay
SurePay for Financial Technology (“SurePay”) is a Saudi-licensed financial technology company providing integrated and comprehensive payment solutions. SurePay is licensed by the Saudi Central Bank (SAMA) under license number 45018604 and operates within the Kingdom of Saudi Arabia. Accordingly, all its activities, policies, and compliance requirements are subject to the applicable laws and regulations in the Kingdom.
SurePay was established as a specialized entity within Sure Group for Information Technology, which has been operating since 2005 and has delivered hundreds of successful technology projects. SurePay offers flexible payment solutions, including traditional POS terminals, mobile payment devices, and self-service payment systems, supported by advanced software solutions for device management, settlement reporting, system integration, and continuous monitoring to ensure optimal performance.
Introduction
SurePay (“the Company”, “we”, “us”, “our”) is committed to protecting the privacy of personal data and complying with the Personal Data Protection Law (PDPL), its Implementing Regulations issued by the Saudi Data & AI Authority (SDAIA), the National Data Management Office (NDMO), and all relevant regulations and instructions issued by the Saudi Central Bank (SAMA).
This Privacy Policy explains how personal data is collected, processed, protected, and the rights of data subjects, as well as communication channels and mechanisms for exercising those rights. The Company confirms that personal data is not transferred outside the Kingdom of Saudi Arabia unless a clear legal basis exists and all regulatory safeguards are applied.
Accessing or using SurePay services constitutes explicit acceptance of this Privacy Policy. If you do not agree, you must refrain from using the Company’s services.
Definitions
Personal Data: Any information that may identify an individual directly or indirectly.
Sensitive Personal Data: Includes biometric, health, credit, genetic, criminal, security, religious, political, or precise location data.
Processing: Any operation performed on personal data, whether manual or automated.
Data Subject: The individual to whom the personal data relates.
Controller: The entity determining the purposes and means of processing.
Processor: Any party processing personal data on behalf of the Controller.
Disclosure: Making personal data accessible to another party.
Destruction: Any action rendering personal data permanently inaccessible.
Scope of Application
This policy applies to personal data collected through:
- www.surepay.sa
- SurePay mobile applications
- Customer portals and internal systems
- Digital services and communication channels
- Social media platforms
- Call centers and customer support
This policy does not apply to third-party websites or services, even if accessed through SurePay platforms.
Legal Basis for Processing
SurePay processes personal data based on one or more of the following legal grounds:
- Explicit consent, where required
- Performance of a contract or service requested by the user
- Compliance with legal and regulatory obligations
- Legitimate interest, without overriding data subject rights
- Data made publicly available, in accordance with the law
Type of Data Collected
SurePay adheres to the data minimization principle and collects only what is necessary.
- User-provided data: Identity, commercial registration, contact details
- Automatically collected data: IP address, device type, cookies, usage data
- Transaction data: Payment details, POS terminal IDs (MID/TID), settlement data
- Third-party data: Identity verification (Nafath, Wathq), bank settlement data
Data Collection and Use
Personal data is collected when users register, use services, perform transactions, or are referred to through authorized third parties. Data is used for:
- Service delivery and customer communication
- System improvement and security enhancement
- Identity verification and fraud prevention
- Regulatory compliance and reporting
- Technical support and investigations
- Internal analytics (aggregated and anonymized)
- Marketing activities, subject to consent
Purposes of Processing
- Operating payment and POS services
- KYC and regulatory compliance
- Fraud prevention and risk monitoring
- Legal and regulatory reporting
- Customer support and service improvement
- Marketing (with consent)
Consent Management
SurePay obtains explicit and purpose-specific consent where required and maintains records accordingly. Data subjects may withdraw consent at any time through approved channels. Requests are acknowledged within 5 business days and completed within 30 days, extendable by an additional 30 days where necessary.
Data Subject Rights
Right to Be Informed
The right to know the nature of the data and the purpose for its collection. Any individual has the right to be informed of all data collected directly from them or indirectly through a third party or publicly available data, as well as how such data is processed.
Right to Access Data
The data subject has the right to access their personal data stored by SurePay and obtain it in a clear format compatible with records, free of charge, in accordance with the relevant regulations. This is subject to the Credit Information Law regarding any applicable fees and does not conflict with Article 9 of the law. The right also includes requesting correction or destruction of their data.
Right to Rectification or Erasure of Data
The data subject has the right to request rectification of their personal data or erasure of it, in accordance with Article 18 of the law. They also have the right to demand erasure if the data is no longer necessary for the purposes for which it was collected.
Right to Object or Restrict Processing
The data subject has the right to request restriction of processing of their personal data or to object to its processing, as well as the right to withdraw their consent for processing. This is allowed if it does not conflict with Article 10 of the law.
Right to Withdraw Consent
The data subject has the right to submit a request to withdraw their consent for processing their data, provided this does not conflict with Article 12 of the law and does not affect the processing of personal data carried out on other legal grounds.
Right to Submit Complaints
The data subject has the right to submit a complaint regarding the processing of their personal data if they believe it has not been processed in accordance with the laws and regulations. If the complaint cannot be resolved, the customer has the right to submit a complaint through the Sama Care platform.
Requests are handled according to clear procedures and in accordance with the provisions of the law.
Company Rights (SurePay)
Collection of Personal Data
SurePay has the right to collect and process personal data within the limits permitted by the Personal Data Protection Law and related regulations, to achieve legitimate and specific purposes, primarily “Know Your Customer” requirements and regulatory obligations issued by the Saudi Central Bank.
Personal data is primarily collected directly from the data subject but may be collected from other sources in cases permitted by law, such as obtaining the data subject’s consent, if the data is publicly available, to achieve public interest or legitimate interest for the company without compromising the data subject’s rights, and provided the data is not sensitive.
Disclosure of Personal Data
SurePay does not disclose personal data except in cases permitted by law, such as the data subject’s consent, compliance with requests from competent government authorities, protection of health or public safety, or to achieve legitimate interests of the company without affecting the data subject’s rights.
The company is committed not to disclosing data in any situation that may harm the security or interests of the Kingdom or violate the privacy of other parties, and to notify the competent authority and the data subject in the event of any data breach or unauthorized access in accordance with applicable regulations.
Operational and Marketing Purposes
The company may use personal data to improve services, develop products, and enhance user experience, as well as for marketing purposes after obtaining the necessary approvals, with the right to withdraw consent at any time. SurePay is committed to using data fairly and non-discriminatorily, respecting data subjects’ rights and applicable regulations.
Verification and Legal Restrictions
The data subject may be required to verify their identity before their requests are fulfilled, and some rights may be subject to legal restrictions or exceptions in accordance with the Personal Data Protection Law and its executive regulations.
Data Sharing with Third Parties
Personal data may be shared only with:
- Data subject consent
- Government authorities
- Banks and settlement partners
- Authorized processors under compliant contracts
- Vital interest or public health cases
- SurePay ensures adequate safeguards with all processors.
Data Retention and Destruction
Personal data is retained in accordance with SAMA-approved retention policies and legal requirements. Upon completion of purpose, data is securely destroyed or anonymized to prevent re-identification.
Information Security
SurePay applies robust security measures including:
- Encryption at rest and in transit
- Access control and least privilege principles
- Security monitoring and incident response
- Endpoint protection
- Vulnerability management
Personal Data Breach Notification
In case of personal data breach:
- Central Bank (SAMA) is notified within 24 hours
- Affected data subjects are notified within 72 hours, where applicable
- Incidents are documented and remediated
- Preventive measures are implemented
Where a breach occurs through a third party, SurePay shall not be legally liable unless the breach resulted from its failure to apply regulatory or contractual safeguards.
Access from Outside Kingdom
Use of SurePay services from outside the Kingdom remains subject to Saudi laws and regulations, regardless of the user’s location.
Cross-Border Data Transfers
Personal data is stored and processed within the Kingdom of Saudi Arabia. Cross-border transfers are permitted only in accordance with Article (29) of the PDPL and applicable approvals.
Children’s Data
SurePay does not intentionally collect data of individuals under 18 years of age. If collected inadvertently, such data is deleted immediately and corrective measures are taken.
Cookies
SurePay uses cookies to enhance performance, user experience, and analytics. Users may manage cookies via browser settings. Third-party cookies are governed by their respective privacy policies.
Cookies Policy
SurePay Company uses cookies and similar technologies to improve website performance and user experience, enable certain essential functions, analyze website usage, and provide appropriate content and services.
Some cookies may be used for operational, analytical, or marketing purposes, in accordance with the Personal Data Protection Law and after obtaining the necessary approvals when required.
Users can control or disable cookie settings through their browser settings. Please note that disabling cookies may affect the availability of certain website features or services.
The Sure Payments website may contain links or services of third parties (such as analytics tools or social media platforms). The cookies of those parties are subject to their own privacy policies, and SurePay bear no responsibility for the practices of those parties.
User Responsibilities
The user is required to:
- Provide accurate and up-to-date information.
- Maintain the confidentiality of login data.
- Use official communication channels.
- Do not misuse the services.
The data plays an important role in protecting and safeguarding their personal data by following several measures:
- Regularly review the privacy policy and updated terms and conditions, update all personal data, and manage privacy preferences.
- Control and modify marketing preferences, make sure of link sources before opening them, and verify the sender’s name before opening any notifications or links.
- Do not disclose passwords, security codes, account information, or any personal data to anyone, and do not respond to any calls or websites that collect personal data without ensuring the security of the connection. Please note that Sure Payments will never ask for such data.
- Choose how to manage cookies and understand how they or other tracking technologies work.
- Always log out at the end of your session, especially if you are using someone else’s devices or public internet locations.
Please note that Sure Payments disclaims responsibility for unauthorized access to personal data resulting from the failure of the data subject to maintain the confidentiality of their personal information.
Periodic Compliance Assessments
SurePay conducts periodic PDPL compliance assessments in accordance with Article (36) to ensure continuous adherence and address any identified gaps
Policy Updates
This policy may be updated from time to time. The latest version will be published on the official website with the effective date.
Contact Information
Data Management Office: DMO@surepy.sa
Contact page: https://surepay.sa/contact
Support: 8001110102
Head Office: Al-Hayat Center, Al-Imam Saud Bin Abdulaziz Rd, Al-Muruj, Riyadh 11564
Complaints: Complaints@surepay.sa
External escalation: SAMA Cares – https://samacares.sa