At Matrix General Contractors ("Matrix"), we are committed to protecting personal data in accordance with the Personal Data Protection Law (PDPL) issued in the Kingdom of Saudi Arabia under Royal Decree M/19 dated 09/02/1443H and its Implementing Regulations.

This Privacy Policy explains how we collect, use, store, share, and protect personal data, and outlines your rights as a data subject.

1. Who We Are

We are Matrix General Contractors, a company established under the laws of the Kingdom of Saudi Arabia, with CR No. 4030007353, headquartered at: P.O. Box 2781, Jeddah 21461, Kingdom of Saudi Arabia.

2. What Personal Data We Collect

We only collect personal data necessary for specific and lawful business purposes. The types of personal data we may collect include:

Data Subject	Personal Data Categories
Job Applicant	Name, address, telephone, email, CV details
Client	Name, telephone, email
Consultant	Name, address, telephone, email, bank details
Supplier	Name, address, telephone, email, bank details
Sub-Contractor	Name, address, telephone, email, bank details

3. Purposes and Legal Basis for Processing

We process personal data in accordance with the lawful bases defined under the PDPL, including:

• Performance of a contract: To fulfill contractual obligations.
• Legal obligations: To comply with laws and regulations.
• Explicit consent: Where required, we will obtain your clear consent.
• Legitimate interest: Where processing is necessary for business needs, provided it does not conflict with your rights.
• Vital interest: To protect individuals' life or health in emergencies.

4. Sources of Personal Data

We primarily collect data directly from you. However, in some cases we may receive data from authorized sources such as:

• Government authorities
• Background verification services
• Public databases

5. Data Sharing

We may share personal data with:

• Regulatory and governmental bodies when legally required
• Auditors, banks, legal advisors, and insurance companies
• Third-party service providers (processors) under strict contractual obligations
• Affiliates and business partners, where required for service delivery

We ensure any data sharing complies with PDPL requirements.

6. Cross-Border Data Transfers

Matrix may transfer personal data outside the Kingdom of Saudi Arabia only when necessary and after obtaining the required approvals from the Saudi Data and Artificial Intelligence Authority (SDAIA), or when conditions specified by PDPL for cross-border transfers are met (e.g., safeguarding national interests, adequate protection levels, explicit consent).

7. Retention of Personal Data

We retain personal data only for the duration necessary to fulfill its intended purpose or comply with legal requirements.

For example:

• Employment-related health and safety data may be retained for up to 40 years
• Financial and contractual data may be retained for 7-10 years
• CVs and applicant data may be retained for 2 years

Once the purpose is fulfilled or retention is no longer required, data will be securely deleted or anonymized.

8. Your Rights Under PDPL

As a data subject under the Saudi PDPL, you have the following rights:

• Right to be Informed: About the legal basis and purpose for processing.
• Right to Access: A copy of your personal data processed by us.
• Right to Correct: Inaccurate or incomplete personal data.
• Right to Delete: Personal data, unless required for legal or contractual obligations.
• Right to Restrict Processing: In specific situations defined by law.
• Right to Withdraw Consent: Where consent is the legal basis.
• Right to Lodge a Complaint: With SDAIA in case of violations.

To exercise your rights, please contact our Data Protection Officer at dpo@Matrix.com.

9. AlmaMOB Application and Vendor Portal

9.1 AlmaMOB

AlmaMOB is a mobile application owned and operated by Matrix General Contractors Company to facilitate internal employee operations, communication, and access to HR and project-related services.

When using AlmaMOB, we may collect and process personal data such as:

• Employee name, ID, contact details
• Attendance, location (where authorized), and shift data
• Access credentials and user activity logs
• Submitted requests or documents (e.g., leave requests, reports, etc.)

Data collected through AlmaMOB is used solely for operational and administrative purposes and is handled with strict access controls and secure mobile data transmission protocols.

9.2 Vendor Portal

The Vendor Portal is used to manage procurement interactions between Matrix and its vendors, subcontractors, and service providers. Through the Vendor Portal, we may collect and process the following data:

• Vendor contact person names, positions, and contact information
• Company registration data, licenses, VAT certificates
• Bank account information for payment processing
• Transaction history and submitted documentation
• User access logs and communication records

All data submitted via the Vendor Portal is used exclusively for the purpose of evaluating, onboarding, managing, and processing transactions with suppliers and subcontractors. Access to the portal is protected through authenticated logins, and the data is retained in accordance with our retention policy and PDPL requirements.

If you are a user of either AlmaMOB or the Vendor Portal and would like to know more about how your personal data is processed or to exercise your rights under PDPL, please contact our Data Protection Officer at dpo@Matrix.com.

10. Contact Us

11. Updates to This Policy

We may update this policy to comply with changes to laws or our business practices. You will be notified in advance of any material changes.