Privacy & Personal Data Protection Statement

1. Who we are and our role

OPM ("Olaat", "OPM", "we", "us") is a Saudi company trading under the OPM® brand, providing asset management, property management, facility management, brokerage, valuation, and research and consultancy services, headquartered in Riyadh.

We act as a data controller where we determine the purposes and means of processing, which is the case for most of our services. We may act as a data processor on behalf of asset owners whose properties we manage, in which case the owner remains the controller.

2. What is personal data?

Personal data is any information — whatever its source or form — that would lead to identifying an individual specifically, or that makes identification possible directly or indirectly. This includes separate pieces of information that do not identify you on their own but do so when combined.

3. How we collect your data

3.1 Data you provide directly

a. Tenants and space seekers

b. Owners and landlords

c. Buyers, sellers and investors

d. Visitors to our projects, offices and events

3.2 Data collected when you visit our sites or engage with our ads

Website visitors

We automatically collect: IP address, device, browser and operating system type, pages visited and time spent, traffic source, and campaign identifiers (UTMs) and cookies. Full detail is in our Cookie Policy.

Leads generated through paid advertising

When you complete an in-platform lead form on LinkedIn, Meta (Facebook and Instagram) or X, the platform pre-fills certain fields from your profile and then shares with us the data you agreed to submit. We typically receive: name, contact details, company name, job title, and your answers to our qualifying questions (space required, unit type, target move-in date).

The platform's own processing is governed by its privacy policy; our processing is governed by this statement.

3.3 Data from other sources

• Referrals from clients, partners and co-operating brokers.
• Publicly available sources: commercial registers, official websites, public professional profiles.
• Business data providers and property portals.
• Government authorities where a legal basis exists.

4. Sensitive personal data

We do not request or seek to collect sensitive personal data (health, religious, intellectual, political, genetic, biometric, security, or association membership data). Please do not include such data in our forms or correspondence. Where collection is required for a specific lawful purpose, we will seek your separate explicit consent.

5. Legitimate interests

Where we rely on legitimate interests, we balance our interest in running our business against your rights, freedoms and privacy, and we do not rely on this basis where your interests override ours. Our legitimate interests include developing our services, understanding client requirements, securing our sites and assets, preventing fraud, and protecting our legal rights. You may ask us to explain the balancing exercise carried out in any given case.

6. If you do not provide your data

Some data is necessary for us to serve you. If you do not provide data required to conclude a contract or meet a legal obligation — such as identity documents for property registration — we may be unable to provide the service or complete the transaction. Optional data has no effect on the service if withheld.

7. Who we share your data with

We do not sell or trade your personal data. We may share it, only as necessary, with:

Service providers are bound by agreements requiring confidentiality, restricting use to the specified purpose, and prohibiting use for their own purposes.

We may also disclose data under a court order or lawful request, to protect our rights or the safety of individuals, or in the context of a merger, acquisition or restructuring.

8. Third-party links, social media and plug-ins

Our sites may contain links to third-party websites and social media share buttons or plug-ins. These parties are independent of us and have their own privacy policies; we are not responsible for their practices. Some plug-ins may collect data about you as soon as the page loads, even without interaction. We recommend reviewing their policies.

9. Use of artificial intelligence

We may use AI tools to support our operations — for example prioritizing incoming enquiries, matching units to stated requirements, summarizing correspondence, and analyzing market trends.

• No decision producing legal or similarly significant effects on you is made by fully automated means without human involvement.
• We do not use your personal data to train third-party general-purpose AI models.
• Providers of these tools are bound by contractual data protection controls limiting use of the data.

10. Security

We apply organizational, technical and administrative controls including need-to-know access restriction, encryption in transit, access and audit logging, backups, staff awareness training, and contractual confidentiality obligations. No method of transmission over the internet can be guaranteed absolutely secure.

11. Retention

We retain your data for as long as necessary for the purpose collected, or for the period required by law, whichever is longer.

Data is destroyed or anonymised once the purpose for which it was collected no longer applies.

12. Transfers outside the Kingdom

Some data may be processed on servers outside Saudi Arabia as a result of our use of global platforms and service providers (including LinkedIn, Meta, X, Google and CRM systems). Such transfers are made in accordance with the PDPL and the Regulation on Transfer of Personal Data Outside the Kingdom, following assessment of the level of protection and implementation of appropriate safeguards. You may request details of the safeguards applied.

13. Your rights

• Right to be informed — of the legal basis and purpose of collection.
• Right of access — to your data and to receive a copy in a clear format.
• Right to request correction — correction, updating or completion of your data.
• Right to request destruction — where the data is no longer needed.
• Right to withdraw consent — at any time, for consent-based processing.

To exercise any of these rights, email it@olaat.com. We will respond within the statutory period and may ask you to verify your identity first. Exercising your rights is free of charge unless requests are repetitive or excessive.

14. Unsubscribing from marketing

• We will not send marketing by SMS, email or WhatsApp without your prior consent.
• You may unsubscribe at any time by replying "STOP"/"إلغاء", using the unsubscribe link in our messages, or emailing it@olaat.com.
• Withdrawal does not affect the lawfulness of prior processing, and does not prevent us contacting you about an active enquiry or contract.

15. How to complain

If you believe our processing breaches the law, please contact us first at it@olaat.com so we can resolve it. You also have the right to complain to the Saudi Data & Artificial Intelligence Authority (SDAIA), the authority competent to supervise the PDPL.

16. Children

Our services are directed at businesses and adults. We do not knowingly collect data from anyone under 18. If we learn that we have collected a minor's data without guardian consent, we will destroy it.

17. Changes to this statement

We may update this statement from time to time. The version published on this page applies from its publication date. Where changes are material, we will notify affected individuals by appropriate means.

18. Contact

Data Protection Officer

OPM

Email

it@olaat.com

Telephone

920009362

Address

King Abdullah, Salahuddin District, Riyadh