Exel by Merak Company (“Exel”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data and preserving your confidentiality.
This Privacy Notice explains what types of personal data we collect, the purposes for which we collect and use it, how we process and protect it, the legal basis for processing, and the rights available to you under the applicable laws in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (“PDPL”) issued by Royal Decree No. M/19 dated 09/02/1443H and its Implementing Regulations.
This Privacy Notice is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia.
Company Name: Exel by Merak Company
Legal Form: Limited Liability Company (LLC)
Commercial Registration No.: 1009107218
Unified No.: 7041880993
Registered Address: 1st Floor, 6959 Prince Turki Ibn Abdulaziz Al Awwal Rd, Al Mohammadiyyah, Riyadh 12364, Kingdom of Saudi Arabia
In this Privacy Notice, references to “Exel”, “we”, “us” and “our” refer to Exel by Merak Company in its capacity as a personal data controller.
This notice is addressed to individuals outside our organization with whom we interact in the course of our business, including (but not limited to) existing and prospective participants in our programs, beneficial owners, directors and representatives of our partners, visitors to our websites, users of our online portals and forms, business partners, vendors, service providers, and any other recipients of our programs and services (“you”, “your”).
Details on how to contact us are provided in the “How to Contact Us” section below.
We may update this Privacy Notice from time to time to reflect changes in our services, our internal processes, or applicable legal and regulatory requirements.
Any updated version of this Privacy Notice will be published on our website, and the “last updated” date will be revised accordingly. We encourage you to review this Privacy Notice periodically to stay informed about how we handle your personal data.
This Privacy Notice was last updated on: 06-APRIL-2026.
We may collect personal data directly from you, indirectly from third parties, and automatically when you interact with our digital channels. Depending on your relationship with us, this can include, but is not limited to, the following categories:
Identification information
Information you provide when completing our onboarding forms, participating in our programs, or using our services, such as:
• Full name, gender, date and place of birth
• National Identification Number, Iqama information, or passport details
• Nationality and other official identification details
Contact and profile information
Information required to communicate with you and manage our relationship, such as:
• Residential and/or business address (including national address)
• Email address(es), mobile number, and other contact details
Financial information
Information related to your participation in our programs and any associated administrative processes, such as:
• Bank account details or payment information (if required for program-related purposes)
Regulatory and compliance information
Information collected to comply with applicable legal and regulatory requirements in the Kingdom of Saudi Arabia and by relevant authorities, such as:
• Identity verification information, where required
• Any regulatory requirements related to participation in our programs Information obtained from official documents or public records
Technical and usage information
Information collected when you visit or interact with our website or digital channels, such as:
• IP address, device identifiers, browser type and version, operating system
• Pages visited, time and date of visits, time spent on pages, and interaction data
• Cookies and similar technologies, where applicable and as permitted by lawfd
Information collected based on your consent
In certain cases, and where required by PDPL, we may collect and process your personal data based on your explicit consent, for example for specific marketing, communication or analytical purposes that are not strictly necessary to perform a contract or comply with a legal obligation. Where we rely on consent, we will clearly explain the purpose to you at the time of collection.
We will not process personal data in a manner that is incompatible with the purposes for which it was collected, except where permitted or required by applicable law.
We may process your personal data for one or more of the following purposes, to the extent permitted by PDPL and other applicable laws:
Providing and managing our products and services
• To establish and manage our relationship with you as a participant in our programs
• To assess and process applications and registrations
• To administer participation in programs, activities, and related initiatives
• To perform our obligations under contracts with you or with entities you represent
Compliance with legal and regulatory obligations
• To comply with obligations under the laws and regulations of the Kingdom of Saudi Arabia (including PDPL, AML/CTF regulations, and other applicable regulations)
• To carry out necessary verification and fraud prevention measures, where required
• To retain records as required by law and regulatory authorities
Improving our services and communication
• To respond to your inquiries, requests and complaints
• To monitor, review and improve the quality, performance, and security of our services, systems and processes
• To conduct internal analysis and reporting to enhance our programs and overall participant experience
Safety, security and risk management
• To maintain the security and integrity of our systems, platforms and premises
• To detect, investigate and prevent fraud, misuse, or other unlawful or unauthorized activities
• To manage operational and information security risks
Notifications and operational communication
• To send you service-related communications such as confirmations, program updates, changes to terms, and other relevant notifications related to your participation in our programs
Awareness and informational communication
• To provide you with guidance and information on security measures and best practices to protect your personal data and interactions with our platforms
• To send you information about our programs, initiatives, and services that may be relevant to you, subject to your preferences and applicable consent requirements
In line with PDPL and applicable regulations, we may share your personal data with third parties in the following circumstances and subject to appropriate safeguards:
With your consent
Where you have given us explicit consent to disclose your personal data for a specific purpose.
To public authorities and regulators
Where disclosure is required by a public authority or regulatory body for security purposes, law enforcement, or to comply with legal and regulatory obligations, including judicial orders and regulatory requests.
To protect vital interests and public interest
Where the disclosure is necessary to protect your life, health, or safety or that of others, or to protect public health or safety, as permitted by law.
To service providers and professional advisers
To third-party service providers who support our operations (for example: IT and cloud service providers, platform providers, auditors, legal and other professional advisers), strictly for the purposes described in this Privacy Notice and subject to confidentiality and data protection obligations.
To protect our legitimate interests
Where the disclosure is necessary to achieve the legitimate interests of Exel by Merak or a third party, provided that such disclosure does not override your rights and interests under the Personal Data Protection Law (PDPL).In all cases, any disclosure of your personal data will be carried out in compliance with applicable laws and regulations and, where required, subject to appropriate contractual and technical safeguards.
We will only process your personal data when we have a lawful basis to do so under PDPL. Depending on the context, the lawful basis may include:Your consent
Where you have provided your explicit consent for one or more specific purposes that we clearly explain to you.
Compliance with legal obligations
Where processing is necessary to comply with obligations imposed by applicable laws and regulations in the Kingdom of Saudi Arabia or by other competent authorities.
Performance of a contract
Where processing is necessary to enter into, perform, or administer a contract to which you are a party, or to take steps at your request prior to entering into such a contract (for example, program participation agreements or other documentation).
Legitimate interests
Where processing is necessary to achieve our legitimate interests or those of a third party (such as operating our programs, improving our services, and maintaining security), provided that such processing does not override your fundamental rights and freedoms under the Personal Data Protection Law (PDPL).
Protection of your vital interests or the interests of others
Where processing is necessary to protect your life, health, or safety or that of another individual, as permitted by applicable law.
We are committed to safeguarding the confidentiality, integrity, and availability of your personal data. To this end, we implement appropriate technical and organizational measures, including but not limited to:
• Access controls and role-based permissions
• Encryption and secure transmission where appropriate
• Physical and logical security for our IT systems and premises Internal policies, procedures and training on information security and data protection
• Monitoring and testing of our security controls
While we take reasonable steps to protect your personal data, no system is completely secure. We therefore cannot guarantee absolute security, but we strive to use best-practice measures to reduce risks and respond appropriately to any potential incident.
We retain your personal data only for as long as necessary to achieve the purposes described in this Privacy Notice, taking into account:
• The nature of our relationship with you;
• The purposes for which the data was collected and processed;
• Our legal and regulatory obligations under applicable laws and regulations in the Kingdom of Saudi Arabia and by relevant authorities; and
• Our legitimate business needs (for example, to assert or defend legal claims).
We may retain certain records for a defined period after our relationship with you ends, where required by law or where necessary to protect our rights or comply with regulatory requirements. Once retention periods expire, we will securely delete, anonymize, or otherwise dispose of personal data in accordance with our internal policies and applicable law.
Subject to the conditions and exceptions set out in PDPL and other applicable laws, you may have the following rights in relation to your personal data:
Right to be informed
Right to withdraw consent
Where we rely on your consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal and may affect our ability to continue providing certain services. We will assess and respond to any request you submit in accordance with PDPL and other applicable regulations.
Right to lodge a complaint
You have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia (the Saudi Data & Artificial Intelligence Authority / National Data Management Office) if you believe that our processing of your personal data infringes applicable law.
To exercise your rights under PDPL or to submit any request relating to your personal data, you may contact us using the details below:
Email (data and privacy inquiries):
contact@exelbymerak.com
Postal address:
Exel by Merak
1st Floor, 6959 Prince Turki Ibn Abdulaziz Al Awwal Rd
Al Mohammadiyyah, Riyadh 12364
Kingdom of Saudi Arabia
We may need to verify your identity (and, where applicable, your authority to act on behalf of another individual) before responding to your request.
We aim to respond to your request within the timeframe required under PDPL and applicable regulations.
In certain cases, this period may be extended, for example, where your request is complex or where we receive multiple requests from you.
Exel by Merak has designated internal resources responsible for overseeing compliance with PDPL and this Privacy Notice.
If you have any questions, concerns, or complaints about how we handle your personal data, or if you wish to escalate an issue relating to your rights, you may contact us at:
Email: info@exelbymerak.com
Please indicate in the subject line that your inquiry relates to “Personal Data / Privacy” so that it can be directed appropriately.
