Privacy Policy

‍

1. Who we are

Lite Advanced Financial Company, a closed joint stock company ("Lite", "we", "us"), commercial registration number 7043615017, is the controller of personal data processed in connection with our services, except where this policy states otherwise (see Section 2), licensed by the Saudi Central Bank (SAMA) as an Electronic Money Institution, licence no. ٣٤/م ش م/ ١٤٤٧. We provide digital payment acceptance, electronic money accounts, and corporate card and expense services to merchants and businesses operating in the Kingdom of Saudi Arabia.

Contact: compliance@lite.sa · 7463 King Abdulaziz Road, Al Nafl District, Riyadh 13312, Saudi Arabia · 800 124 8888 (within KSA) / +966 800 124 888 (international)

The Saudi Data & Artificial Intelligence Authority (SDAIA) is the competent supervisory authority for the Personal Data Protection Law. As a SAMA-licensed institution, Lite's PDPL compliance is also monitored by SAMA under the supervisory arrangement between SDAIA and SAMA. Certain categories of data, including data collected for anti-money laundering and counter-terrorist financing purposes, sanctions screening, and payment transaction and settlement records, are subject to independent retention and processing requirements under SAMA's regulatory framework, which operate alongside the PDPL.

2. Whose data this policy covers and our role

This policy applies to personal data we process about:

(a) Representatives, signatories, and beneficial owners of our business customers;

(b) Employees or representatives of our business customers who are issued cards or granted access to our platform on their behalf;

(c) End customers of our business customers (for example, shoppers who pay a merchant using our services); and

(d) Visitors to our website.

For (a), (b), and (d), we act as the controller of your personal data, and this policy describes how we process it.

For (c), we generally act as a processor, handling your data on behalf of and according to the instructions of the business you are transacting with. That business remains the controller of your data. If your query relates to a specific purchase or transaction, please contact that business directly, we may not be able to act on a request from you without their instruction. If your question is about how we handle data on their behalf generally, you can still contact us using the details in Section 14.

If your business provides us with personal data of your employees or representatives, for example, to issue corporate cards or grant dashboard access, you are responsible for informing those individuals about our processing of their personal data in accordance with this Privacy Policy.

3. Personal data we collect

(a) Identity and verification data (mandatory): names, national ID/Iqama details, commercial registration data, beneficial ownership information, contact details, and onboarding documents required by law.

(b) Biometric and sensitive data (mandatory during onboarding where applicable): facial verification data processed through the national digital identity platform (Nafath) to verify the identity of representatives and authorized individuals. We process this data to meet our statutory identity-verification obligations, and where the law requires it, on the basis of your explicit consent collected at the point of verification. We do not use biometric data for any other purpose.

(c) Financial and transaction data (mandatory): account activity, payments accepted and made, card transactions, settlement records.

(d) Technical data (mandatory for core service delivery; certain elements optional): see Section 12): device identifiers, IP address, log and usage data from our dashboard, apps, and APIs.

(e) Communications (optional: arises only if you contact us): support requests, complaints, and call or chat records where lawfully made.

4. How we collect it

Directly from you through onboarding forms, account setup, and your use of our dashboard, apps, and APIs (e.g. business registration details, contact information, transaction instructions you submit).

Indirectly through:

• Automated means: cookies, device identifiers, and usage analytics collected as you use our platform (see Section 12).
• Third parties, where the law permits: identity verification through Nafath (Saudi Arabia's national digital identity platform), business verification through commercial registry checks, screening and identity verification service providers, payment card networks, and government registries used to verify businesses.

Where personal data is collected indirectly from a source other than you, we will inform you of the source and the additional required details within 30 days, unless an exemption applies (for example, where the information is already available to you, providing it would involve disproportionate effort, or the data is collected to fulfil a legal requirement).

5. Why we process it and on what basis

We process personal data on the following bases, individually or in combination:

(a) Fulfilling our agreement with your business to open and operate the account and provide the services;

(b) Compliance with statutory obligations, including AML/CTF verification and sanctions screening under the AML/CTF Law and SAMA's AML/CTF Guide, and reporting to SAMA and other competent authorities under the Implementing Regulation of the Law of Payments and Payment Services;

(c) Your explicit consent where the PDPL requires it (for example, certain marketing communications and biometric verification where applicable), withdrawable at any time without affecting prior processing or processing based on another legal basis;

(d) Our legitimate interest in securing and improving our services and preventing fraud, where this does not override your rights, supported by a documented assessment.

Some of our decisions, for example, screening transactions for fraud or assessing risk, involve automated processing. Where a decision produced solely by automated means could significantly affect you, you may request that the decision be reviewed by a member of our team.

Collection and processing of personal data is limited to the minimum necessary to achieve the purposes above. Where we rely on your consent, that consent is not a condition for providing the service unless the specific service or benefit is directly related to that processing.

6. Automated decision-making

We use automated systems to screen transactions for fraud and to score transaction risk in real time. These systems may automatically decline, hold, or flag a transaction. Where an automated decision has a significant effect on you, such as the suspension of an account, you may request that the decision be escalated for human review by contacting us at compliance@lite.sa or through your account support channel.

7. Who we share it with

We disclose personal data only as needed to provide the services and meet our obligations, to the following categories of recipients:

All service providers process personal data only on our documented instructions, under contracts consistent with the PDPL. Nafath and government registries operate under their own legal mandate as government identity and business verification services, rather than under contract with us. We do not sell personal data, and we do not disclose it to third parties for their own direct marketing purposes.

8. Where your data lives and transfers outside the Kingdom

We limit the personal data transferred outside the Kingdom to the minimum necessary to achieve the purpose of the transfer. Personal data we process is stored and processed primarily within the Kingdom of Saudi Arabia.

Where we transfer personal data outside the Kingdom of Saudi Arabia for example, to service providers located abroad we do so only where the transfer does not affect national security or the vital interests of the Kingdom, and only on one of the following bases:

• Standard Contractual Clauses: in the absence of a SDAIA adequacy determination for the destination country, we rely on Standard Contractual Clauses issued by SDAIA, or another SDAIA-approved safeguard, to ensure the recipient provides a level of protection consistent with the PDPL.
• Adequate level of protection: where SDAIA has determined that the destination country, sector, or organization provides a level of personal data protection not less than that guaranteed under the PDPL.
• Limited exceptions: in specific circumstances permitted by law, for example, where the transfer is necessary to perform our agreement with you.

9. How long we keep it

Personal data collected for identity verification and transaction purposes is retained for up to ten (10) years, in line with applicable Saudi Central Bank regulations governing record-keeping for licensed payment institutions. Other categories of personal data are retained only for as long as necessary for the purpose collected, in line with our data minimization obligations under the Personal Data Protection Law.

When the applicable retention period ends, or the data is no longer necessary for the purpose it was collected for, we securely delete or anonymize it in a manner that prevents recovery or reconstruction.

Some personal data, in particular records held to meet our anti-money laundering and regulatory obligations cannot be deleted before the end of its required retention period, even if you request deletion.

10. Your rights

These rights apply where we act as the controller of your personal data (see Section 2). If we process your data as a processor on behalf of a business customer, please direct your request to that business.

Under the Personal Data Protection Law, you have the following rights:

• Right to be informed: about the legal basis and purpose for which we collect and process your personal data.
• Right to access: request access to your personal data held by us.
• Right to request a copy: to receive your personal data in a readable, commonly used format, or a printed copy where feasible.
• Right to correction: to request correction, completion, or updating of inaccurate or incomplete data.
• Right to request destruction: to request deletion of your personal data where it is no longer necessary for the purpose it was collected for.
• Right to withdraw consent: at any time, where processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to complain: to submit a complaint about our compliance with the PDPL to SDAIA (see Section 14).
• Right to compensation: you may apply to a competent court for proportionate compensation if you suffer material or moral damage as a result of a violation of the PDPL or its Implementing Regulations.

To exercise these rights, contact us using the details in Section 14. We will act on your request within 30 days of receipt. This period may be extended by a further 30 days where the request requires disproportionate effort or where we have received multiple requests from you, in which case we will notify you of the extension and reason before the initial period ends. We may ask you to verify your identity before acting on a request. Exercising these rights is free of charge, unless otherwise permitted by law.

Some data in particular records we are required to retain for anti-money laundering or regulatory purposes (see Section 9)  cannot be deleted before the end of its required retention period, even where you request deletion.

The Personal Data Protection Law also provides that an individual who suffers material or moral damage as a result of a violation of the Law or its Implementing Regulations may apply to a competent court for proportionate compensation.

11. How we protect it

We apply organizational, administrative, and technical measures appropriate to the sensitivity of the data, encryption in transit and at rest, access controls, monitoring, and staff confidentiality obligations, aligned with recognized cybersecurity standards applicable to licensed payment institutions in the Kingdom.

Essential and functional cookies are necessary and do not require consent. Analytics and marketing cookies are used only with your consent, given or withdrawn at any time through the cookie settings on our website (via the banner on first visit, or the "Cookie Settings" link in the footer). Retention periods per category are set out in the cookie settings.

13. Changes to this policy

We may update this policy to reflect changes in our practices, services, or legal requirements. For material changes we will notify you through the dashboard, by email, or by app notification before the change takes effect. This policy was last updated on Rabi II 10, 1448 AH, September 21st, 2026. A record of prior versions is maintained and available on request.

14. Contact, complaints, and language

If you have a question, request, or complaint about how we handle your personal data, contact the Compliance Department at compliance@lite.sa or 7463 King Abdulaziz Road, Al Nafl District, Riyadh 13312, Saudi Arabia. We aim to resolve complaints within three (3) calendar days of receipt.

If your complaint relates to a purchase or transaction with a specific business using our services, please raise it with that business first, as they are the controller of your data in that context (see Section 2).

You may also contact our Personal Data Protection Officer, Ather Alam Khan directly at a.khan@lite.sa. And in case of no response you may directly contact our CEO, Fahad Anteet, at fahad@lite.sa

If you are not satisfied with our response, or if we do not respond within the period stated above, you may submit a complaint to the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent authority for the Personal Data Protection Law, via sdaia.gov.sa. Where your concern relates to our conduct as a SAMA-licensed institution, you may also contact the Saudi Central Bank through its consumer protection channels.

This policy is made available to you before or at the time we collect your personal data, and is written to be clear and accessible. If you need this policy in an alternative format or language, contact us using the details above.

‍

This policy is issued in Arabic and English. In the event of any conflict between the two versions, the Arabic version prevails.