PRIVACY NOTICE

Saudi Fransi Finance Leasing Company (J-B)

Update Date: July 2026

Saudi Fransi Finance Leasing Company (J-B) is a licensed Saudi company and a subsidiary of Banque Saudi Fransi Group, specializing in providing innovative digital financing solutions for individuals and businesses.

Purpose of This Privacy Notice

The purpose of this Privacy Notice is to explain how J-B collects, uses, processes, stores, protects, retains, and shares your personal data, the legal bases for processing, and your rights under the Personal Data Protection Law (PDPL). This Privacy Notice has been prepared in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia.

Scope of This Privacy Notice

This Privacy Notice applies to all personal data collected or processed through the following channels and business interactions:

• Mobile Application.

• Website.

• Sales team through official channels.

• Customer service and call center interactions.

• J-B's partners and service providers.

Types of Personal Data We Collect

Depending on the nature of the service, we may collect and process the following categories of personal data:

• Identity Information: 

  Information that relates to identifying the customer, or communicating with them, such as full name, national ID or Iqama number, date of birth, place of birth, nationality, marital status, mobile phone number, email address, and national address.

• Professional, Financial, and Credit Data: 

  Information related to the customer's employment and income data, financial, and credit status, which may be used to assess financing eligibility. This may include employer details, job title, income information, bank account details, financial obligations, and credit reports issued by authorized credit bureaus.

• Biometric Data: 

  Data resulting from the use of biometric verification technologies that may be used to verify the customer's identity when using digital services, where applicable.

• Technical Data and Digital Channel Usage Data: 

  Information collected when using the application or website, such as device information, Internet Protocol (IP) address, system logs, and application or website usage data.

Sources of Personal Data

We collect personal data directly from you when you apply for or use our products and services. We may also obtain personal data from authorized third parties, government entities, credit bureaus, identity verification providers, and other sources permitted under applicable laws. In addition, certain technical and usage data may be collected automatically through our digital channels, including device information, IP address, cookies, system logs, and application or website usage data.

Purposes of Processing Personal Data

We process personal data for the following purposes:

Core Service Purposes:

• Identity verification: 

  To confirm your identity when using our services.

• Creditworthiness assessment: 

  To evaluate your financial eligibility for financing products.

• Processing and assessing financing applications

  to review and process your requests for financing products or services.

• Managing customer accounts and payments

  to manage your account, process payments, and provide related services.

• Compliance with legal and regulatory requirements

  to comply with applicable laws, regulations, and supervisory requirements.

• Fraud prevention and risk management

  to detect, prevent, and investigate fraudulent or suspicious activities.

• Measuring customer satisfaction and improving service delivery

  .

Failure to provide the required data may result in our inability to provide the requested service.

Optional Purposes:

• Marketing and promotional offers

  to inform you about relevant products, services, and promotional offers.

• Customer communications and service-related notifications

  to provide updates, information, or notifications related to the services.

You may withdraw your consent for optional purposes at any time through your profile within the J-B application, without affecting core services.

Automated Processing and Decision-Making

J-B utilizes tools that allow automated processing of personal data and make real-time automated decisions about you, including but not limited to, automated decisions to approve your finance application and to assess creditworthiness. If you would like to learn more about automated processing and decision-making, please contact the Data Privacy Officer at: dpo-jb@j-b.com.sa

Legal Basis for Processing Personal Data

We may process personal data based on one or more of the following legal bases:

• Contractual necessity: 

  where processing is required to provide our products or services to you.

• Compliance with legal or regulatory obligations: 

  where processing is necessary to comply with applicable laws, regulations, or supervisory requirements.

• Explicit consent of the data subject (where applicable): 

  where you have provided consent for specific purposes, such as marketing communications or other communication services.

Sharing of Personal Data

We may share your personal data with the following categories of recipients where necessary for the purposes described in this Privacy Notice:

• Banque Saudi Fransi and its subsidiaries,

  where you have provided your consent or where permitted under applicable laws, for providing products, services, or other approved business purposes.

• Credit bureaus and authorized verification service providers,

  to verify your identity, assess creditworthiness, and support financing decisions.

• Regulatory, supervisory, judicial, and law enforcement authorities

  , where disclosure is required by applicable laws or regulatory obligations.

Personal data is shared only to the extent necessary and in accordance with applicable laws and appropriate security safeguards.

Cross-Border Data Transfers

Personal data will not be transferred outside the Kingdom of Saudi Arabia unless in compliance with the applicable legal and regulatory requirements under the Personal Data Protection Law.

Data Retention, Storage, Protection, and Destruction

J-B retains personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice or as required by applicable laws and regulations. Retention periods are determined based on applicable legal, regulatory, contractual, and operational requirements. Personal data is securely stored within the Kingdom of Saudi Arabia and protected using appropriate technical and organizational measures to ensure its confidentiality, integrity, and availability throughout the applicable retention period. Once the applicable retention period expires, personal data will be securely destroyed or anonymized in accordance with applicable laws and regulations.

Data Subject Rights

Under the Personal Data Protection Law, you have the following rights:

• Right to be informed about how your personal data is collected and processed.

• Right of access to your personal data held by J-B.

• Right to obtain a copy of your personal data in a clear and readable format.

• Right to request correction of inaccurate or incomplete personal data.

• Right to request destruction of personal data when there is no longer a legal or regulatory requirement to retain it.

• Right to withdraw consent for optional processing activities at any time through your profile in J-B mobile application.

• Right to submit a complaint regarding the processing of your personal data.

Minors and Persons Lacking Legal Capacity

The Company’s services are not intended for minors or individuals lacking legal capacity. Accordingly, the Company does not knowingly collect or process their personal data. Should the Company provide services to such individuals in the future, any processing of their personal data will be carried out only in accordance with applicable laws and regulations, including obtaining the consent of a parent or legal guardian.

Data Breach Notification

In the event of a personal data breach, the Company will take the necessary actions to contain and address the incident and will notify the relevant authorities and affected individuals when required by applicable laws and regulations.

Updates to This Privacy Notice

This Privacy Notice may be updated from time to time. Any updates will be communicated through the available channels prior to or upon their effective date.

Contact Information

For any privacy-related inquiries or to exercise your rights under the Personal Data Protection Law (PDPL), please contact our Data Privacy Office at dpo-jb@j-b.com.sa

Requests will be handled within thirty (30) days from the date of receipt. Where additional time is required due to the complexity or volume of the request, we may extend the response period as permitted under applicable laws and regulations. If an extension is necessary, you will be notified before the expiry of the original response period, together with the reason for the extension and the expected response date.

If J-B fails to respond within the applicable response period (30) days, or if you are not satisfied with our response, you may submit a complaint to the Saudi Central Bank (SAMA) through SamaCare.