MASTERY GULF
Official Document

Privacy Policy

Itqan Al-Khaleej Business Services Company – Mastery Gulf

Last updated: August 24, 2026

1

Introduction

In alignment with the digital transformation and the building of a thriving economy under Saudi Vision 2030, Itqan Al-Khaleej Business Services Company, trading as "Mastery Gulf" or "Mastery", is committed to protecting the privacy of its clients and platform visitors and to handling their personal data responsibly and transparently.

This Policy has been prepared in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations, with the aim of clarifying how personal data is collected, processed, retained, disclosed, and destroyed, and of setting out the rights of data subjects and how those rights may be exercised.

2

Scope of the Policy

This Policy applies to personal data collected or processed by Mastery through:

  • The website: www.mastery.sa
  • Contact forms and consultation requests
  • Email, telephone, and unified number
  • WhatsApp conversations
  • The Mastery digital assistant and chat services
  • Social media accounts
  • Contracts, quotations, and service execution requests
  • Company formation and post-formation services
  • Premium residency and citizenship-by-investment services
  • Governmental, administrative, and operational transactions carried out by Mastery on behalf of the client

This Policy does not apply to external websites and services that are governed by their own independent privacy policies.

3

Identity of the Data Controller

The data controller is:

  • Itqan Al-Khaleej Business Services Company – Mastery Gulf
  • Address: Riyadh, Al-Olaya District, Al-Olaya Main Street, Riyadh 12221
  • Unified Number: 920004339
  • Email: [email protected]
  • Website: www.mastery.sa
4

Personal Data We May Collect

Mastery may, depending on the service requested, collect the following categories:

First: Identity and Contact Data

  • Full name
  • Nationality
  • Date and place of birth when required
  • Mobile number
  • Email address
  • Address
  • Copy of national ID, residency permit, or passport
  • Signature and client representative details

Second: Entity and Investment Data

  • Company name and business activity
  • Job title or legal capacity
  • Data of partners, directors, and ultimate beneficial owner
  • Commercial registration, licences, contracts, and resolutions
  • Data of foreign companies and shareholders
  • Capital, ownership, and corporate structure data

Third: Service Execution Data

  • The requested service or package
  • Client request details and correspondence
  • Company formation and licensing documents
  • Residency, visa, and premium residency documents
  • Human resources and employee data
  • Professional qualifications, certificates, and experience
  • Documents required by governmental or relevant professional bodies

Fourth: Financial Data

  • Invoice and payment data
  • Bank transfer receipts
  • Bank name and payment reference
  • Information required for preparing quotations, contracts, and monitoring financial obligations

Card and electronic payment data is typically processed by the payment service provider. Mastery does not retain full card data unless this is necessary and permitted by applicable regulations.

Fifth: Technical Data

  • IP address
  • Device type, browser, and operating system
  • Pages visited and duration of use
  • Cookie data
  • Website and advertisement interaction information
  • Approximate location inferred from IP address when available

Sixth: Correspondence Data

  • WhatsApp and email conversations
  • Messages sent via the contact form or Mastery assistant
  • Call recordings where the user has been notified and the required consent obtained

We may process sensitive data only when it is necessary for service execution, required by a competent authority, or where an appropriate legal basis exists.

5

Methods of Data Collection

First: Direct Collection

We collect data directly when the data subject or their representative:

  • Completes the contact form
  • Requests a consultation or quotation
  • Communicates via telephone, email, or WhatsApp
  • Uses the Mastery digital assistant
  • Signs a contract or subscribes to a service package
  • Submits documents required for service execution
  • Pays fees or submits proof of payment

Second: Indirect Collection

We may obtain data from:

  • The client's representatives, partners, or employees
  • Governmental bodies and platforms
  • Relevant professional and financial bodies
  • Service providers and contracted agents
  • Public sources and legally accessible records
  • Cookies and website usage analytics technologies

When data is collected from another source, Mastery takes the necessary steps to inform the data subject accordingly, where required by applicable regulations.

6

Purposes of Data Processing

Mastery uses personal data for the following purposes:

  • Responding to enquiries and consultation requests
  • Assessing client eligibility for the requested service
  • Preparing quotations and contracts
  • Company formation and the issuance, amendment, and renewal of licences
  • Following up with the Ministry of Investment, Ministry of Commerce, and the Saudi Business Center
  • Executing services on Qiwa, Muqeem, Mudad, GOSI, Zakat, Tax, Baladi, and other platforms
  • Executing residency, visa, and premium residency services
  • Providing citizenship or residency by investment services
  • Liaising with governmental bodies, embassies, banks, and professional bodies
  • Managing the contractual relationship and client service
  • Issuing invoices and following up on payments
  • Preparing reports and monitoring entity status
  • Identity and document verification and fraud prevention
  • Compliance with regulatory, judicial, and supervisory requirements
  • Improving the website, services, and user experience
  • System security and detection of unlawful use
  • Sending promotional offers and marketing news after obtaining the required consent
  • Managing complaints and rights exercise requests

Data will not be processed for a purpose incompatible with the purpose for which it was collected, except on a legal basis or after obtaining the required consent.

7

Legal Bases for Processing

Mastery relies on one or more legal bases, depending on the nature of the processing, including:

  • Consent of the data subject
  • Taking steps at the client's request prior to entering into a contract
  • Performance of a contract to which the data subject is a party
  • Compliance with a legal obligation or a request from a competent authority
  • Protection of vital interests where applicable
  • Pursuing the legitimate interests of Mastery, such as system protection, fraud prevention, and service improvement, without prejudice to the rights of the data subject
  • Any other basis permitted by applicable laws and regulations

The data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal or processing based on another legal basis.

8

Cookies

The website uses cookies and similar technologies for the following purposes:

  • Operating the website and its essential functions
  • Saving user preferences
  • Measuring performance and analysing website usage
  • Improving content and services
  • Providing support and chat services
  • Measuring campaigns and advertisements upon consent

Users may accept or reject non-essential cookies through the cookie settings panel, and may also adjust their browser settings or delete stored cookies.

Disabling essential cookies may affect certain website functions, while rejecting non-essential cookies should not prevent the use of core services.

9

Disclosure of Data

Mastery may disclose data, to the extent strictly necessary, to:

  • Ministries, authorities, governmental bodies, and platforms
  • Embassies, consulates, and bodies responsible for immigration, residency, and nationality
  • Banks and payment service providers
  • Lawyers, accountants, auditors, and consultants
  • Technology, hosting, cloud computing, and cybersecurity service providers
  • Telecommunications, email, and WhatsApp service providers
  • Local and international agents and service providers involved in executing the client's request
  • Judicial or supervisory bodies where a legal obligation exists
  • Any party to whom the data subject consents to disclosure

Mastery does not sell or lease personal data to third parties.

Recipient parties are subject to appropriate contractual or regulatory obligations relating to confidentiality and data protection, according to the nature of the relationship.

10

Transfer of Data Outside the Kingdom

Certain services — such as the formation of foreign companies, residency or citizenship-by-investment programmes, liaison with embassies, cloud hosting services, or the use of international platforms — may require the transfer of personal data outside the Kingdom or making it accessible from abroad.

When carrying out such transfers, Mastery complies with the provisions of the Personal Data Protection Law and the Regulations on the Transfer of Personal Data Outside the Kingdom, adopts appropriate safeguards, and limits transfers to the minimum necessary to achieve the purpose.

Safeguards may include contractual agreements, confidentiality and security requirements, risk assessments, and any other consents or measures required by applicable regulations.

11

Data Retention and Destruction

Mastery retains data for the period necessary to fulfil the purpose for which it was collected, taking into account regulatory and contractual obligations, as follows:

  • Contact requests that do not result in a contract: up to two years from the last contact
  • Marketing data: until consent is withdrawn or the subscription is cancelled
  • Client files, contracts, and transactions: throughout the duration of the relationship, then for the period required for regulatory, accounting, and tax obligations and the settlement of claims
  • Commercial and financial documents: in accordance with the retention periods prescribed by applicable regulations, which may generally extend to ten years
  • Cookie data: according to the type, settings, and purpose of the cookie
  • Complaints and rights request data: for the period necessary to demonstrate that the request was handled and regulatory compliance was achieved

Once data is no longer needed, it is destroyed or anonymised in a secure manner that prevents its recovery or the identification of the data subject, unless a regulatory obligation requires its retention.

12

Rights of the Data Subject

The data subject is entitled, in accordance with applicable laws and regulations, to the following rights:

  • The right to be informed of how their data is collected and the legal basis and purpose of its processing
  • The right of access to their personal data
  • The right to request a legible and clear copy of their data
  • The right to request the correction, completion, or updating of inaccurate data
  • The right to request the destruction of data that is no longer needed
  • The right to withdraw consent where processing is based on consent
  • The right to lodge a complaint with Mastery or with the competent authority
  • The right to claim compensation where the regulatory conditions therefor are met

These rights are subject to the restrictions and exceptions set out in applicable regulations.

13

Exercising Rights

To exercise any of the above rights, please contact us via:

  • Email: [email protected]
  • Unified Number: 920004339
  • Address: Riyadh, Al-Olaya District, Al-Olaya Main Street, Riyadh 12221

The request must include the data subject's name, contact details, a description of the right to be exercised, and the information necessary to verify identity.

The request will be processed within a period not exceeding thirty days from the date it is complete. This period may be extended by a further period not exceeding thirty days where necessary, with the data subject being notified of the reason for the extension.

14

Data Security

Mastery implements appropriate administrative, organisational, and technical measures to protect data, including, depending on the nature of the data:

  • Restricting access permissions
  • User identity verification
  • Encrypting data or transmission channels where required
  • System and device protection
  • Backup and recovery
  • Security incident monitoring
  • Confidentiality obligations on employees and contractors
  • Service provider review
  • Training of persons who handle data

Notwithstanding the adoption of appropriate measures, absolute protection of any electronic system cannot be guaranteed. In the event of a data incident, Mastery will take the necessary regulatory steps for remediation, reporting, and notification where required.

15

Data of Children and Dependants

Mastery's services are primarily directed at adults, companies, and investors.

Data relating to children or dependants may be processed in connection with residency, visa, or citizenship services, provided that it is submitted by the guardian or legal representative and only to the extent necessary for service execution.

16

Marketing and Communications

Mastery may send informational or marketing messages where consent or an appropriate legal basis exists.

Subscriptions may be cancelled at any time via the unsubscribe link, by replying to the message, or by contacting Mastery.

Opting out of marketing messages does not affect messages that are necessary for the performance of contracts and services.

17

External Websites and Services

The website may contain links or services belonging to third parties, such as:

  • WhatsApp and social media platforms
  • Google Maps
  • Banks and payment service providers
  • Tamara and Tabby
  • Governmental websites and platforms
  • Residency or citizenship programme websites

Data processing by those parties is governed by their own privacy policies, which users should review before using their services.

18

Complaints and Objections

Privacy-related complaints may be submitted to Mastery via email at [email protected], setting out the subject of the complaint, contact details, and any supporting documents.

Mastery will review the complaint and respond within the appropriate regulatory period.

If the data subject is not satisfied with the handling of the complaint, they may refer the matter to the competent personal data protection authority in the Kingdom of Saudi Arabia through the official channels of the Saudi Data and Artificial Intelligence Authority (SDAIA).

19

Policy Updates

Mastery may update this Policy when regulations, services, or data processing practices change.

The updated version will be published on the website with the date of the last update indicated, and users are advised to review the Policy periodically.

If the amendment is material, Mastery will take appropriate steps to notify data subjects or obtain fresh consent where required.

20

Governing Language

Mastery may provide a translation of this Policy into other languages. In the event of any conflict or difference in interpretation, the Arabic version shall prevail, without prejudice to applicable mandatory regulations.

Relevant Legislation and References

  • Personal Data Protection Law of the Kingdom of Saudi Arabia
  • Implementing Regulations of the Personal Data Protection Law
  • Regulations on the Transfer of Personal Data Outside the Kingdom
  • Guidance documents issued by the Saudi Data and Artificial Intelligence Authority (SDAIA)
  • Other applicable sectoral laws and regulations