What personal data will be collected, when and why we use it
Personal data in this Policy means any information relating to an identified or identifiable natural person (a “Data Subject”). An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
In this section, we describe what personal data we collect, how we use that personal data and, where required under data protection law, the legal bases for each processing activity. We do not process your personal data in a manner that is inconsistent with the purposes set out below or in a manner that is inconsistent with applicable law.
If you choose not to provide us with all or some your personal data described below, our ability to provide you with our services and your ability to use the VCM website may be affected.
If you contact us through the VCM website or email
If you contact us by way of VCM’s website, email, live chat, message boards or any other facility made available by VCM with a query or comment about any of our services, we will need to collect information about you (including your contact details) to help us respond to your query or request or provide our services to you.
We may do this when you send us a message using the form available on VCM’s website or interact with us through our online support tools. The personal data that we will collect from you in order to respond to you for the purposes you have contacted VCM, may include identification data (such as your name, date of birth, gender, nationality etc.), contact details (such as email address and telephone number) and other information.
Legal basis: Consent, Contract Performance, unless we can rely on Legitimate Interest (to keep you updated with news in relation to our products and services and to enable us to analyse how you interact with our communications).
If you apply for a job through VCM’s website or email
If you contact us through the VCM’s career section of the website or email, we will need to collect information about you (including your contact details, such as your name, date of birth, gender, nationality etc.) and your resume to consider you as a candidate to work with VCM.
Legal basis: Consent, Legitimate Interests (to consider you as a candidate for the applied position), Legal Obligations (where applicable).
We may also keep a record of any communications we have with you (including a recording of any calls you make). We do this to help monitor and improve the quality of our customer support services, to make and defend legal claims, and to comply with legal obligations to which we are subject to. If you do not wish to have your calls recorded, please disconnect and contact us as follows: contact@vcm.sa.
Legal basis: Contract Performance, Legitimate Interests (to enable us to provide our services and support), Legal Obligations (where applicable).
In connection with legal or regulatory obligations
We may process your personal data to prevent fraud, protect VCM’s business, comply with regulatory requirements or dialogue with regulators as applicable which may include disclosing your personal data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so.
Where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime.
Legal basis: Legal Obligations, Legitimate Interests (to cooperate with law enforcement and regulatory authorities). Where this includes Sensitive Data, we rely on Substantial Public Interest (prevention or detection of crime), Legal Claims or Explicit Consent.
To reorganize or make changes to our business
In the event that we: (i) are subject to negotiations for the sale of our business or part thereof to a third party; (ii) are sold to a third party; or (iii) undergo a re-organization, we may need to transfer some or all of your personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed sale or re-organization.
We may also need to transfer your personal data to that re-organized entity or third party after the sale or reorganization for them to use for the same purposes as set out in this Policy.
Legal basis: Legitimate Interests (in order to allow us to change our business).
To provide you with marketing communications
Subject to your marketing preferences, we may use your personal data to market and promote our own and selected business partners’ products and services to you by post, email, SMS, social, media, phone and fax including where you would like us to keep you informed about the latest news and developments at VCM through our newsletter or other means.
Legal basis: Consent, unless we can rely on Legitimate Interest (to keep you updated with news in relation to our products and services).
Storage and destruction of personal data
Personal data is stored inside the Kingdom of Saudi Arabia in servers, and these servers are protected with the best technologies in accordance with the policies and controls of the National Authority for Cybersecurity and international standards in order to prevent non-authorized entry and reduce cyber risks, and then the data will be destroyed within 6 years from the date of its storage in a secure manner, through which it cannot be viewed or retrieved again.
Legal basis for collecting and processing personal data
A description of the legal basis used to process personal data referred to in this Policy is set out below:
A description of the legal basis used to process sensitive data referred to this policy is set out below:
Rights of the data subject
Right to access personal data: The Data Subject has the right to request a copy of his/her personal data, via the e-mail address provided below and it will be provided to them free of charge within seven (7) working days by e-mail.
Right to destroy personal data: The Data Subject has the right to request the destruction of his/her personal data in certain circumstances via the e-mail address provided below, unless there is a legal text specifying a specific period of retention or contractual requirements.
Right to withdraw consent to the processing of personal data: The Data Subject can withdraw his/her consent to the processing of his/her personal data at any time via the e-mail address provided below, unless there are Legitimate Purposes that require the contrary.
Right to opt out of receiving marketing materials: The Data Subject can withdraw his/her consent to receive marketing materials at any time via the e-mail address provided below.
For any of the above mentioned matters, please send an e-mail on contact@vcm.sa.
If you withdraw your consent in respect of processing your personal data, opt out of receiving marketing materials, request to delete your personal data, we may be unable to provide a benefit, good or service that requires the use of such personal data.
Your personal data will not be used in a manner that contradicts with the purpose that it was collected for as stated in this Policy.
Your personal data will not be kept for longer than is necessary to fulfil the specific purposes outlined in this Policy, and to allow us to comply with our legal requirements. Any personally identifiable information will not be kept longer than required.
For avoidance of doubt, the data retention periods for each of the circumstances where we would store personal data are:
How we share your data with others
We work closely with a number of trusted partners with whom we may need to share your personal data for the purposes (and in strict accordance with applicable data protection laws) mentioned in this policy, including:
From time to time, we may share information about you with government organizations and agencies, including international organizations, to comply with applicable laws, regulations and rules, and legitimate requests from law enforcement, regulatory and other governmental or international agencies, or when to do so is in our Legitimate Interests, even if we are not compelled to share that information by applicable law.
In all cases when we share your personal data, we implement all necessary technical, organizational, administrative and security measures to safeguard your personal data. We only share your personal data to the minimum extent necessary to achieve the purposes of processing set out in this Policy and in accordance with applicable law.
Transferring personal data internationally
We store and process your personal data in the Kingdom of Saudi Arabia. Your personal data may also be shared with and processed by other entities outside the Kingdom of Saudi Arabia, where this is permitted by applicable law, or the country from which your personal data was collected.
We may only transfer your personal data when permitted under to jurisdictions that a ord the same standard of protection to Personal Data as is provided in the Kingdom of Saudi Arabia or where we are otherwise permitted to do so by applicable law, if, for example, a special circumstance applies (e.g. the transfer is necessary for the performance of a contract with you, the transfer is necessary to comply with certain legal obligations or it is to protect your vital interest) and/or we have implemented certain additional security measures to protect it, including:
In all cases, we implement necessary and appropriate measures to safeguard your personal data when we transfer it outside of the Kingdom of Saudi Arabia or to another jurisdiction from where we have collected it and only ever share the minimum amount needed for the transfer.
You can contact us on contact@vcm.sa for more information about the safeguards we have put in place to ensure the adequate protection of your personal data when this is transferred.
How we protect your information
We take all necessary steps required by applicable law to protect your personal data, including implementing all appropriate technical, organizational, and administrative security measures. This includes physical, electronic, and administrative procedures that ensure that your personal data is safeguarded from loss and misuse as well as unauthorized access, deletion, disclosure, alteration, and destruction.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites/mobile applications (where applicable), you are responsible for keeping this password confidential and for complying with any other security procedures that we notify you of. We ask you not to share a password with anyone.
Storing your personal data
We will store your personal data for only as long as is necessary for the purposes for which it was collected, as explained in this Policy, and any permissible related purpose(s).
In some circumstances we may need to store your personal data for longer periods of time, for instance where we are required to do so in accordance with legal, reporting, regulatory, tax, accounting obligations, or in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal data or dealings. Should you require further information about how we retain your personal data you can contact us on contact@vcm.sa.
This Website may contain links to other Websites or applications whose privacy policies may differ; you are encouraged to review the terms of such privacy policies.
We may disclose personal information submitted to VCM's Website to satisfy legal or judicial requirements or to authorized third parties such as VCM's affiliates, information technology advisors, and legal or business consultants, as required.
