Privacy Policy

1. About National Infrastructure Fund (Infra)

The National Infrastructure Fund (“Infra”, “we”, “us”, or “our”) is committed to protecting your personal data and safeguarding your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website. By accessing our website, you agree to the practices described in this Privacy Policy.

2. Purpose and Application

This Privacy Policy describes how Infra collects, uses, and protects personal data obtained through our official website and any online forms, tools, or digital services linked to it.

This Policy applies to:

Visitors who browse our website

Individuals who submit inquiries or forms

Users who interact with website features or tools

Any personal data collected through cookies or analytics tools

This Policy does not apply to:

Offline interactions or data collected through other Infra channels

Third-party websites linked from our platform

The purpose of this Policy is to provide transparency regarding:

What information we collect

How we use and protect it

How individuals can exercise their rights

How we comply with applicable laws, including the Personal Data Protection Law (PDPL)

3. Information We Collect

We collect personal and technical information to provide secure and effective browsing experience and to enable communication with you. The information we collect includes the following:

3.1. Information You Provide to Us

You may provide personal data when you:

Submit a contact form or inquiry

Request information about our services or initiatives

Upload documents or provide additional information voluntarily

This may include:

Full name

Email address

Mobile number

Organization details

Inquiry details or message content

Any attachments you upload

3.2. Information Collected Automatically

When you access the website, certain information is collected automatically to improve functionality, security, and system performance, including:

IP address, device identifiers, and operating system

Browser type, version, and language settings

Date and time of visits

Pages viewed, links clicked, and navigation paths

Session duration and interaction patterns

General geographic location (city/country)

Cookies and similar tracking technologies (see Section 10)

This data is primarily non-identifiable and used to help improve the website’s performance and security.

4. How We Use Your Information

We use your personal and technical information for clear and legitimate purposes. These purposes include:

To Respond to your requests

To Operate and improve the website

To enhance user experience

Comply with legal and regulatory obligations

4.1. To Respond to Your Requests, which include:

Processing and responding to inquiries

Contacting you regarding your submitted request

Providing clarifications or follow-up communication

4.2. To Operate and Improve the Website, which include:

Ensuring smooth functionality and usability

Enhancing navigation and user experience

Understanding usage patterns and visitor behavior

Conducting performance analytics

Implementing accessibility improvements

4.3. To Enhance User Experience, which include:

Generating anonymized reports for performance analysis

Improving digital services and user interaction

Capacity planning and resource optimization

4.4. To Comply with Legal and Regulatory Obligations, which include:

Complying with the Personal Data Protection Law (PDPL)

Meeting requirements from regulators or government authorities

Supporting audits, inspections, or supervisory reviews

Responding to lawful requests or regulatory inquiries

5. Storing Personal Data

Personal data is stored on cloud servers within the Kingdom of Saudi Arabia and is protected by advanced technologies in compliance with the regulations of the National Cybersecurity Authority to prevent unauthorized access and minimize cyber risks.

6. Legal Basis for Processing Personal Data

We process your personal data only when there is a lawful bases under the Saudi Personal Data Protection Law (PDPL). These include:

Explicit consent: we process personal data based on the explicit consent; upon submitting optional forms, enabling non-essential cookies, and sharing optional information through digital channels.

Fulfilling a requests or providing a service: we process personal data when necessary to: respond to your inquiries, communicate with you, and provide information or services requested.

Compliance with legal and regulatory obligations: we process personal data when necessary to comply with obligations under PDPL or other applicable laws, respond to lawful requests from regulatory or governmental authorities, or maintain proper records and reporting required for public entities

Legitimate interest: we process personal data based on legitimate interests, such as: ensuring website security and preventing misuse, improving website functionality and user experience, conducting analytics using aggregated or anonymized data, protecting against fraud or cybersecurity risks.

Public interest or official authority: process personal data when supporting operations aligned with public interest, fulfill duties that fall under our mandate or official responsibilities.

7. How We Share Your Information

We treat your information with care and share it only when necessary and in accordance with applicable laws. Your information may be shared only with:

Authorized government entities when legally required, or regulators or supervisory authorities, if mandated

Internal Infra teams for legitimate business needs

All third parties are subject to confidentiality obligations.

8. Your Personal Data Rights

Under the Saudi Personal Data Protection Law (PDPL) and applicable regulations, you have several rights that allow you to understand, control, and manage how your personal data is collected and used. Infra is committed to respecting these rights and enabling you to exercise them in a clear and transparent manner.

You may exercise any of these rights by contacting us through the details provided in the Contact Us section. We may verify your identity before fulfilling your request to ensure your information is protected.

8.1. Right to Be Informed

You have the right to receive clear, transparent, and easily accessible information about:

What personal data we collect

Why we collect it

How we use it

Who we share it with

How long we keep it

Your rights and how to exercise them

8.2. Right to Access

You may request:

Confirmation of whether we hold personal data about you

A description or a copy of the personal data we maintain

Information about the purposes of processing

The categories of data collected

The entities with whom your data may be shared

We will provide such information within the legally required timeframe, unless restricted by law or necessary to protect national security, public safety, or another person’s rights.

8.3. Right to Correction

If you believe that any personal data we hold about you is:

Incorrect

Incomplete

Outdated

Misleading

You may request that we correct or update it. We will inform you once the update is completed or if we require additional information.

8.4. Right to Deletion

You may request the deletion of your personal data in the following circumstances:

The data is no longer required for the purpose it was collected

You withdraw your consent (where consent was the basis for processing)

The processing is unlawful or in violation of PDPL

You no longer wish for us to retain your data

However, we may continue to retain certain data where required by:

Legal, regulatory, or supervisory obligations

National security or public interest considerations

Fraud prevention or security monitoring

Ongoing investigations, audits, or dispute resolution

8.5. Right to Withdraw Consent

Where processing is based on your consent (such as optional cookies or specific user-submitted information); you may withdraw your consent at any time.

Withdrawal will not affect any processing completed prior to the withdrawal.

8.6. Right to Restrict Processing

You may request that we temporarily or permanently restrict the processing of your personal data if:

You dispute the accuracy of the data

You believe the processing is unlawful but prefer restriction over deletion

We no longer need the data but you require it to establish or defend a legal claim

You have objected to processing and we are assessing the objection

During restriction, we will continue to store your data but will not use it unless legally permitted.

9. Data Retention

We retain your personal data only for as long as necessary to:

Fulfill the purpose for which it was collected

Meet legal and regulatory requirements

Support operational needs

Data is securely deleted or anonymized after retention periods expire or the purpose for its collection ends, whichever is longer.

10. Cookies and Tracking Technologies

10.1. What Are Cookies?

Cookies are small text files that are stored on your device when you visit our website. They help us ensure the site functions correctly, improve your browsing experience, and understand how visitors interact with our website.

Cookies do not give us access to your device, nor do they allow us to view information unrelated to your interaction with our website.

10.2. Types of Cookies We Use

Cookie Type	Purpose
Strictly Necessary Cookies	Enable core website functions such as navigation and security.
Performance & Analytics Cookies	Help us understand how visitors use the site and improve performance.
Preference Cookies	Store user settings such as language preferences.
Functionality Cookies	Enhance the experience by recognizing returning users.

11. Changes to the Privacy Notice

The privacy notice was last updated on 05/08/2026, and may be updated as needed. Infra recommends regularly visiting its website and reviewing this privacy notice to stay informed of any changes. By continuing to use Infra’s website and electronic platforms after the updated notice is published, the user acknowledges their acceptance of all modifications in this notice.

12. Governing Law and Dispute Resolution

This privacy notice is governed by the laws and regulations in force in the Kingdom of Saudi Arabia, and any dispute arising from it shall be referred to the competent courts in Riyadh for resolution.

13. Contact Us

If you have any inquiries or requests related to your personal data or this Privacy Notice, you may contact us through the following official channels:
Data Governance Officer - Infra's Data Management Office
Email: dmo@infra.gov.sa
Address: Building 2.07 B, Zone 2
King Abdullah Financial District (KAFD)
Riyadh, Saudi Arabia