Privacy policy

1. Who we are and scope

This policy explains how the Qitaat platform collects, uses, keeps and shares your personal data, and your rights over it. The controller is Bayanat Technology Company, Commercial Registration 7054260257, Jeddah, Kingdom of Saudi Arabia. It covers the website, the applications, the technician app, Platform messages and guest links. In doing so we comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations, and with the principles of data minimisation, purpose limitation and transparency.

2. Data we collect

Data you provide:

• Account data: name (and in Latin letters if you enter it), mobile number, email address, photo and bio if you add them, and date of birth if you agree to it being kept.
• Identity data: national ID or residency number where needed for verification, stored encrypted as described in section 6.
• Business or association data: legal name, commercial registration, VAT number, national address, branches, documents, and a provider's bank account (IBAN).
• Property data: buildings, units, assets, addresses, title deeds, ownership documents, warranties and maintenance history.
• Transaction data: requests, offers, contracts, work orders, bookings, messages, ratings, disputes and support tickets.
• Data of people you invite: the mobile or email of an owner, resident, employee or association manager you invite, for the invitation only.

Data collected as you use the Platform:

• Field photos from the technician app: arrival and completion photos with the capture time and device location, and the scan of the place code.
• Security and operational records: sign-in times, actions taken in the account and the audit trail.
• Measurement data: collected only after your consent, as described in section 7.

Data from third parties:

• Verification, sign-in code and messaging providers, payment providers (the transaction outcome, not your full card details), map and address services, and public information about businesses when verifying provider data.

3. Purposes and legal basis

• Performing our contract with you: creating your account, providing section services, managing transactions and payments, and sending their notices.
• Legal obligations: invoicing and tax, fraud prevention, responding to competent authorities and keeping records for statutory periods.
• Legitimate interest: Platform security, preventing misuse, resolving disagreements and improving the service with statistics that do not identify you.
• Consent: analytics and interaction heatmaps, date of birth and its programmes, WhatsApp messages and marketing messages. You may withdraw consent at any time without affecting what came before.

4. Who sees your data

• Parties to your transaction: a provider sees what is needed to perform the request (such as the location, and contact details after acceptance), and a buyer sees the provider's details and profile. A buyer's name may be hidden until the award if it so chooses.
• Members of your account: according to the permissions granted by the account administrator.
• The owners association: its manager and delegate see the owners register, units and dues, but not an individual member's use of perks.
• The field technician: sees only what is needed to reach the work location, and the person who reported the issue is not disclosed.
• The Qitaat team: according to defined roles and recorded permissions; every sensitive access is logged in the audit trail.
• Technical service providers: hosting and database, text messages, email and WhatsApp, payment and instalment gateways, maps, and artificial intelligence models for suggestions and translation; under contracts binding them to confidentiality, protection and use only for the purpose.
• Competent authorities: where there is a legal obligation or official request.

We do not sell your personal data or share it for others' marketing.

5. What is public

The public sees what a provider chooses to publish in its public profile, portfolio and products, public ratings without the rater's personal data, and blog and news content. Contact details and branch phone numbers are shown only on a reveal request with a reason. The public membership document verification page shows no private data.

6. How we protect data

• National ID or residency numbers are never stored in plain text: they are encrypted with a key held in a separate vault, searched by a blind index, only the last four digits are shown, and they are revealed only with a recorded permission and reason.
• IBANs are encrypted, approved only by someone other than the person who entered them, and revealed only to the person transferring the payout.
• Photos published to the public have their metadata (such as location) removed, and the original remains with its owner.
• Row-level permissions, two-factor verification for Platform permissions, encrypted connections and an unalterable audit trail are applied.
• Sign-in and verification codes are stored as fingerprints, not values, and for a limited time.

No electronic method is completely secure, however; we will notify you and the competent authority of any breach affecting your data as the law requires.

7. Cookies and measurement

• We use necessary cookies to run sign-in, the session, language and mode.
• We collect analytics, click and scroll heatmaps and interest signals only after your consent in the consent bar, and your choice is recorded with its version.
• We do not store IP addresses, browser user-agent strings or identifiers in links; before consent there is no identifier for you.
• You may change your choice at any time and clear "your interests" from your account.

8. Smart tools

Some texts or documents (such as a request to be analysed, a title deed to be read or text to be translated) are sent to an artificial intelligence model provider to prepare a suggestion, limited to what is necessary and subject to each feature's policy, which may prevent documents from being sent. We do not use your data to train models with external providers. No decision with a legal effect on you is taken by a smart tool alone without human review.

9. Retention

We keep data while your account exists and while it is needed for its purpose. After an account is closed we archive its data, keep what the law requires (such as contracts, invoices, payments, the audit trail and disputes) for the statutory period, and then destroy it or make it non-identifying. Invitation data for people who did not accept is kept only as needed to honour a request to stop invitations.

10. Transfers outside the Kingdom

Some technical service providers may process data outside the Kingdom of Saudi Arabia. This happens only under the statutory controls on data transfer, with appropriate contractual and technical safeguards, and to the minimum necessary.

11. Your rights

Under the Personal Data Protection Law you have the right to:

• be informed of how your data is processed (this policy is part of that);
• access your data and obtain a copy of it;
• correct, update or complete your data;
• request destruction of your data when it is no longer needed, subject to what the law requires us to keep;
• withdraw your consent to processing based on consent;
• complain to the competent personal data protection authority.

You can exercise these rights from your account settings or through the support centre, and we respond within the statutory period after verifying your identity.

12. Children

The Platform is not directed at anyone under eighteen and we do not knowingly collect their data. Any record of dependants in a membership is made with the consent of the person responsible for them.

13. Updates to this policy

Each update is published as a new version with its number, date and a summary of what changed, and previous versions remain available. We will notify you of material changes before they take effect where possible.

14. Contact

For any question or request about your personal data, contact us through the support centre in the Platform, or write to us at: King Abdulaziz Branch Road, Al Shati District, Jeddah 23412, Kingdom of Saudi Arabia.