1. Who we are
MATANA Buildings (متانة بيلدينجز) is a construction and contracting company registered in the Kingdom of Saudi Arabia, based in Riyadh. We decide why and how the personal data described here is used, so we are responsible for it, as the controller, under the Personal Data Protection Law and its Implementing Regulations.
This notice covers everybody whose data we hold: visitors to our websites and people who contact us, job applicants, employees and trainees and their dependants, workers and visitors on our sites, and the people we deal with at clients, consultants, suppliers and subcontractors. The short notices we give in a job advertisement, an offer letter, a site sign or a contract point here for the full detail.
For anything about your personal data, email [email protected]. A question sent to any other MATANA address or person is passed to the privacy mailbox the same day.
2. What we hold, why, and for how long
We collect only what each purpose needs, and nothing “in case”. Most of it comes from you; a subcontractor’s workers’ details come from their employer, and dependants’ and emergency contacts’ details from the employee.
| People | What we hold | Why | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Website visitors and people who contact us | Name, email, telephone, your message | To answer you | Legitimate interest: you wrote to us and expect a reply | 2 years after the last contact, unless it becomes a project or contract |
| People who tick the box to hear from us | Name, email, telephone; a protected (hashed) copy of the email or telephone for advertising platforms | News, vacancies, offers and invitations; MATANA advertisements on social media and other platforms | Your consent | Until you withdraw your consent |
| Job applicants | CV, qualifications, certificates, professional registration, contact details, interview notes; references only with your agreement | To decide whom to employ | Steps you asked for before a contract | Until the decision |
| Applicants not selected | CV, qualifications, contact details | To contact you about a later vacancy | Legitimate interest: you may object at any time | 3 years after the decision; 6 months after it if you object |
| Employees and trainees | Contract, ID or iqama and passport details, contact details, bank account, pay, attendance, leave, GOSI registration, training, evaluations, disciplinary records | To employ and pay you, and to meet the Labour Law | Contract; legal obligation | The employment and 5 years after |
| Employees: health | Sick-leave certificates, fitness for work, injuries, medical insurance | Sick leave, fitness for site work, insurance, GOSI claims | Legal obligation | The employment and 5 years after; injuries 10 years |
| Dependants and emergency contacts | Names, relationship, dates of birth, ID or iqama numbers; an emergency contact’s telephone | Medical insurance, iqamas and tickets; reaching your family in an emergency | Legal obligation; legitimate interest | The employment and 5 years after; an emergency contact until replaced |
| Subcontractors’ workers on our sites | Name, employer, ID or iqama number and expiry, trade, certificates, safety induction | Site safety, access and permits | Legal obligation | With the project’s safety records: 5 years, or 10 where there was an injury |
| Site visitors | Name, company, time in and out, safety induction | Safety and security of the site | Legitimate interest | 12 months after the visit |
| People on site cameras | Video recordings | Security of the site and its materials | Legitimate interest | As the Law on the Use of Security Surveillance Cameras requires; longer only for an incident under investigation |
| People in our photographs | Images and video in which you can be identified | Publicity | Your written consent | While your consent stands |
| People at clients, consultants, suppliers and subcontractors | Name, position, work email and telephone; a sole trader’s bank account | To run the contract and to pay | Legitimate interest; contract | While the relationship lasts, then with the contract and accounting records |
Sensitive data. The only sensitive data we hold is employees’ health data, kept in a separate restricted folder and never in the personnel file, and a criminal record certificate where a law or a client requires one. We never collect religious, tribal, intellectual or political information. Before we introduce any fingerprint, face-recognition or location system, we assess its risk and tell the people concerned.
Identity documents. We do not copy ID cards, iqamas or passports unless a law or a public authority requires it. Otherwise we see the original and record only its number and expiry.
When a period ends, the data is deleted or shredded securely, or made anonymous so that nobody can be identified from it. A legal claim or an investigation can pause this until it is closed.
3. Who receives it, and whether it leaves the Kingdom
Inside MATANA, only the people whose work needs your data can see it. We never sell personal data. We give it only to:
- Government authorities, as the law requires: the Ministry of Human Resources and Social Development (Qiwa, Mudad), GOSI, the General Directorate of Passports (Muqeem) and ZATCA. They receive only what the law requires.
- Organisations that act for their own purposes: our bank, for salaries through the Wage Protection System; our medical insurer, for employees’ and dependants’ cover; a client, only where our contract requires it, such as a list of the workers on its site; and, only if you ticked the box to hear from us, advertising platforms, which receive a protected (hashed) copy of your email or telephone to show you MATANA advertisements (Section 4).
- Service providers that act on our instructions: the providers of our business system, email, document storage and AI assistants, our travel agent, and any recruitment agency we use. Each is bound by contract to use the data only for us, keep it confidential and secure, tell us of any breach within 24 hours, and return or destroy it when the service ends. No health or identity-document data is ever given to an AI service.
Outside the Kingdom. Some of our service providers hold or reach data outside the Kingdom:
| Service | Where it holds the data |
|---|---|
| Our business system (Odoo) | In the Kingdom (Dammam); backup copies in Europe and Canada |
| Email and office applications (Microsoft 365) | The European Union |
| AI assistants (Anthropic) | The United States |
| Advertising platforms, only if you ticked the box (Section 4) | Where each platform operates, mainly the United States and Europe |
Where a service lets us keep data in the Kingdom, we choose to. Data leaves the Kingdom only as the Regulation on Personal Data Transfer outside the Kingdom allows: to a country SDAIA recognises as adequate, or under safeguards such as SDAIA’s standard contractual clauses, and only the data the purpose needs.
5. Your rights and how to use them
You have the right:
- to be told how we use your data;
- to see the data we hold about you and have a copy in a readable, commonly used form;
- to have it corrected or completed;
- to have it destroyed once we no longer need it;
- to withdraw a consent you gave, at any time;
- to object to a use that rests on our legitimate interest;
- to complain to the Saudi Data & AI Authority (SDAIA), which supervises the Personal Data Protection Law.
How to ask. Email [email protected]. It is free. We confirm who you are before we give or change anything, asking only for what confirms it; a request made for somebody else needs their written authority.
When we answer. Within 30 days of receiving your request. Where the law allows more time, for a complex request or several at once, we tell you within those 30 days and why, and answer within a further 30 days.
Withdrawing a consent or objecting needs no form: an email is enough. The use stops at once where it rests on your consent. Where it rests on our legitimate interest, it stops unless a law requires it or our reason clearly outweighs your objection, and we tell you which within 30 days.
If we cannot do all that you ask, for example because the law requires us to keep the data, or because answering would reveal another person’s data, we tell you why.
6. Security, breaches and changes to this notice
Security. Personal data is kept only in company systems, protected by access rights so that only the people whose work needs it can see it. It is never kept in personal email, personal devices or messaging groups, and it is sent outside the company only to a named recipient by a protected link or file.
Breaches. If your data is lost, disclosed or reached by somebody who should not have it, and this may harm you, we notify SDAIA within 72 hours of becoming aware of it and tell you without undue delay: what happened, which data, what you can do to protect yourself, and whom to contact.
Children. We do not collect personal data from children, except dependants’ details that an employee gives us for medical insurance, iqamas and tickets.
Changes. We update this notice before we change how we use personal data, and the date at the top shows when it last changed.
Questions or requests
Email [email protected]. We answer within 30 days.