This policy explains how the General Authority for Survey and Geospatial Information handles personal data collected from individuals and beneficiaries. It sets out the principles and controls governing the collection, use, storage, processing and sharing of personal data in accordance with the Personal Data Protection Law and its Implementing Regulations. It also aims to protect individuals' privacy and rights and enhance transparency in all digital and service interactions involving personal data.

Unified number: 920000427

Email: info@geosa.gov.sa

Address: 8713 Al Olaya, 2638 Al Olaya District, 12611 Riyadh

Failure to provide your personal data, or restricting its provision, may affect the General Authority for Survey and Geospatial Information's ability to provide geospatial regulatory services, such as licenses, permits and other digital services within its remit. It may also affect your ability to benefit from our digital services and online platforms.

This policy applies to all personal data collected and processed by the General Authority for Survey and Geospatial Information in the course of its activities within the Kingdom of Saudi Arabia, including data relating to employees, beneficiaries, suppliers and any other parties dealing with the Authority.

We collect and process the following personal data:

• Identity data: (name, national ID number, date of birth).
• Contact data: (phone number, email address, address).
• Transaction data: (service requests, payments, applications submitted to the Authority).
• Technical data: (IP address, device type, browsing data).
• Geospatial and descriptive data: (geographic location coordinates, mapping data associated with individuals or entities).
• Geospatial license and permit data:
• Details of licenses and permits issued by the Authority (license/permit number, beneficiary entity, type of activity and other information required to issue a geospatial license or permit).
• Data relating to entities or individuals holding licenses/permits (name, commercial registration, contact details and other information required in this regard).
• Geospatial data and information associated with permits, such as the coverage area and type of licensed geospatial data.

Data Collected Directly

Some personal data is collected directly when you use the Authority's services through the following channels:

• Electronic forms submitted through the Authority's official website and geospatial digital services portal.
• Applications for geospatial permits, licenses and other regulatory services submitted by individuals, government entities and private entities.
• Registration on the Authority's official geospatial digital services portal.
• Paper applications submitted at the Authority's premises.
• Direct communication with the Authority by telephone, email or official correspondence.

Data Collected Indirectly

The Authority collects some personal data from other sources for regulatory and administrative purposes, including:

• Government entities: National identity, commercial registration and other data are verified through electronic integration with national databases.
• Technology service providers: When you use the Authority's services, analytical information such as IP address, browsing data, and device and browser type may be collected.
• Cookies: We use analytics technologies to collect data about usage patterns, such as pages visited and session durations.

We use personal data collected directly or indirectly as follows:

• Providing geospatial regulatory services, including geospatial licenses, permits and other services, and processing digital applications through the digital solutions the Authority provides to beneficiaries.
• Improving user experience by analyzing usage patterns and developing digital services.
• Ensuring regulatory compliance with the Personal Data Protection Law and related legislation.
• Integrating with government entities to share data in accordance with approved controls.
• Enhancing security and protecting data by implementing protection standards and security policies.

Your personal data will not be disclosed to any external party for marketing or promotional purposes. It may be disclosed to the following parties:

• Information technology partners: For data processing.
• Government entities: In accordance with legal requirements.

In accordance with the Personal Data Protection Law, the Authority relies on the following legal bases for processing personal data:

• Consent of the personal data subject, who may withdraw it at any time unless another legal basis applies.
• Performance of contractual obligations between the Authority and the data subject.
• Compliance with regulatory or security requirements under the laws applicable in the Kingdom of Saudi Arabia.
• Serving the public interest or carrying out government functions in accordance with legal controls.

The General Authority for Survey and Geospatial Information retains personal data only for as long as necessary to fulfill the purposes for which it was collected, as follows:

• Data is deleted or anonymized when the lawful purpose for processing it ends, unless there is a legal or regulatory justification for retaining it.
• Where legal or contractual requirements specify a retention period, those periods will be observed in accordance with applicable laws.

We may update this Privacy Policy regularly to reflect changes in our personal data collection and processing practices relating to the services of the General Authority for Survey and Geospatial Information or changes in applicable law. The effective date of this policy can be found at the top of the policy. Any updates or changes will be published on the Authority's official website together with the new review and revision date, which will be the effective date of those updates and changes. Your continued use of this website constitutes acceptance of any changes to this policy.

The data subject's explicit consent to this policy is a fundamental requirement for processing their personal data. Consent is obtained through the channels approved by the Authority.

The data subject may withdraw consent at any time, subject to applicable laws and regulations, without prejudice to any resulting impact on the ability to provide certain services that depend on data processing.

The Authority allows data subjects to submit requests to withdraw consent through approved official channels.

Under the Personal Data Protection Law, you have the following rights, which depend primarily on the purpose for collecting and processing personal data:

• Right to be informed: The personal data subject has the right to know how we collect their data, the legal basis for its collection and processing, how it is processed, stored and destroyed, and with whom it will be shared. You can find all details in this Privacy Policy or contact us by email at DMO@geosa.gov.sa.
• Right of access to personal data: The personal data subject may request a copy of their personal data by emailing the address above. It will be provided by email, free of charge, within 15 working days.
• Right to rectification of personal data: The personal data subject may request correction of personal data they consider inaccurate, incorrect or incomplete by email. The data will be reviewed and updated within 15 working days, and the data subject will be notified by email.
• Right to destruction of personal data: The personal data subject may request destruction of their personal data in certain circumstances, unless a legal provision specifies a retention period or contractual requirements apply.
• Right to withdraw consent to personal data processing: The personal data subject may withdraw consent to processing their personal data at any time, unless legitimate purposes require otherwise.

• Name: Data Management Office, General Authority for Survey and Geospatial Information
• Email: DMO@geosa.gov.sa

If you have concerns or believe we have not complied with the Personal Data Protection Law, you may submit a complaint to the Data Management Office at the General Authority for Survey and Geospatial Information by email. If you are dissatisfied with how we handle your complaint, or if we do not respond within 10 working days, you may submit a complaint to the Saudi Data and Artificial Intelligence Authority (sdaia.gov.sa) through the National Data Governance Platform (dgp.sdaia.gov.sa).