Terms of Service

1. Introduction and Scope

Saudi Motorsport Company (“SMC”, “we”, “us”, or “our”) operates and supports the Jeddah Corniche Circuit (“JCC”) and its digital channels. This Privacy and Personal Data Protection Policy (the “Policy”) explains how SMC, as a controller of Personal Data where applicable, collects, uses, stores, discloses, transfers, protects and otherwise processes Personal Data in connection with the JCC website at https://www.jeddahcircuit.com/, SMC/JCC mobile applications, digital services and forms, account and registration features, recruitment interfaces, customer-service channels, visitor Wi-Fi services, and related digital interactions (together, the “Services”).

SMC is committed to processing Personal Data in accordance with the Kingdom of Saudi Arabia’s Personal Data Protection Law (“PDPL”), its Implementing Regulations, the Regulation on Personal Data Transfer Outside the Kingdom, and other applicable legal, regulatory and cybersecurity requirements.

This Policy applies to Website visitors, application users, registered users, customers, event registrants, job applicants, Wi-Fi users and other individuals whose Personal Data is processed through or in connection with the Services. Certain activities may also be subject to a more specific privacy notice, including an event privacy notice, recruitment privacy notice, ticketing notice or cookie policy. Where a specific notice applies, it should be read together with this Policy.

Third-party platforms used in connection with the Services may process Personal Data under their own privacy notices. Where a third party acts solely as SMC’s processor, SMC remains responsible for the relevant processing in accordance with applicable law; where a third party determines its own purposes and means of processing, its own privacy terms may apply.

By accessing or using the Services, you acknowledge that you have been provided with this Policy. This acknowledgement does not constitute consent to processing where consent is required by law. Where SMC relies on consent for a particular processing activity, consent will be requested separately in accordance with applicable requirements.

2. Personal Data We Collect

Depending on your interaction with SMC/JCC and the Services, we may collect and process the following categories of Personal Data:

• Identity Data: name, date of birth, gender, nationality and identification information where reasonably necessary and legally permitted.

• Contact Data: email address, telephone/mobile number, postal address and other contact details.

• Account and Profile Data: login or account details, profile information, preferences and employer or organization information where applicable.

• Ticketing, Event and Service Data: information relating to registrations, tickets, access credentials, hospitality, events, activities, services and requests.

• Payment and Transaction Data: payment status, transaction amount, transaction reference, billing details and limited payment-related information necessary to process or record a transaction. Full payment-card credentials may be processed directly by authorized payment service providers rather than stored by SMC.

• Technical, Device and Usage Data: IP address, device identifiers, browser type, operating system, log information, website/app activity and related technical data.

• Communications and Customer-Service Data: inquiries, correspondence, call records where applicable, complaints, requests and other communications with us.

• Recruitment Data: CV/resume information, employment and education history, professional qualifications, contact details and other information provided in connection with a job application.

• Wi-Fi and Network Data: device and connection information, authentication details and technical logs generated when using visitor or event Wi-Fi services.

• Image, Video and CCTV Data: images or recordings captured at SMC/JCC premises or events where applicable, including CCTV used for security, safety and access-control purposes.

• Survey, Competition and Feedback Data: information voluntarily submitted through surveys, competitions, questionnaires or feedback channels.

• Marketing Preference Data: subscription status, communication preferences and records of consent or opt-out requests.

• Cookie and Analytics Data: information collected through cookies, software development kits and similar technologies, subject to applicable consent requirements.

SMC seeks to collect Personal Data that is adequate, relevant and limited to what is necessary for the stated purpose. Where particular information is mandatory or optional, this will be communicated at the relevant point of collection where required.

3. How We Collect Personal Data

• Directly from you, including when you create an account, purchase or register for tickets or services, submit a form, apply for a role, connect to Wi-Fi, contact customer service, participate in a survey or competition, or subscribe to communications.

• Automatically through the Services and SMC/JCC systems, including through cookies, application technologies, server logs, security systems, CCTV and similar technologies.

• From authorized service providers and business partners involved in delivering relevant services, including ticketing and technology platform providers, payment providers, event operators and registration providers.

• From public or legally permitted sources, or from other persons or entities, where collection from a source other than the Data Subject is permitted under applicable law.

Where Personal Data is collected from a source other than you, SMC will process it only where permitted and will provide the information required by applicable law where necessary.

4. Purposes and Legal Bases for Processing

SMC processes Personal Data only for specified and lawful purposes and where an appropriate legal basis applies. Depending on the processing activity, the applicable basis may include consent, performance of an agreement to which you are a party, compliance with a legal or regulatory obligation, or SMC’s legitimate interests where permitted under the PDPL and where such interests do not prejudice your rights or interests. Sensitive Personal Data will not be processed on the basis of legitimate interests where prohibited by law.

The precise legal basis may vary according to the circumstances. Where processing is based on consent, you may withdraw that consent as described below, without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies and Similar Technologies

The Services may use cookies, software development kits, pixels and similar technologies to enable essential functionality, maintain security, remember preferences, understand usage and improve performance. Non-essential analytics, advertising or similar technologies will be used only in accordance with applicable consent requirements.

You may manage available cookie preferences through the relevant cookie-management tool or device/browser settings. Disabling certain essential technologies may affect the functionality of the Services. Further information should be provided in the SMC/JCC Cookie Policy once published.

SMC may use third-party technology providers in connection with these technologies. Their role and applicable privacy terms will depend on the relevant service and configuration.

6. Sharing and Disclosure of Personal Data

SMC does not sell or rent Personal Data. We may disclose Personal Data only where there is a lawful basis and to the extent reasonably necessary for the relevant purpose. Recipients may include:

• ticketing, application, website, hosting, cloud and technology service providers, including providers supporting SMC/JCC digital platforms;

• payment processors, banks and financial service providers involved in transactions;

• event organizers, operators, accreditation, access-control, hospitality and other event service providers where necessary for the relevant service;

• communications, customer-service, analytics and marketing service providers, subject to applicable consent and legal requirements;

• professional advisers, auditors, insurers and other professional service providers where necessary;

• governmental, regulatory, judicial, law-enforcement, security or other competent authorities where disclosure is required or permitted by applicable law;

• other third parties where you direct or authorize the disclosure, or where disclosure is otherwise permitted under the PDPL.

Where a service provider processes Personal Data on SMC’s behalf, SMC will take appropriate steps required by applicable law to govern that processing. Any disclosure will be limited to the Personal Data reasonably necessary for the relevant purpose.

7. Transfers Outside the Kingdom of Saudi Arabia

Certain technology, cloud, ticketing, support or other service arrangements may involve Personal Data being transferred, stored, accessed or otherwise processed outside the Kingdom of Saudi Arabia. Where this occurs, SMC will comply with the PDPL, the applicable Regulation on Personal Data Transfer Outside the Kingdom and any other applicable requirements.

Where required, SMC will assess the transfer, apply appropriate safeguards or approved transfer mechanisms, and limit the Personal Data transferred to what is necessary for the relevant purpose.

8. Retention and Destruction of Personal Data

SMC retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected or processed, or for a longer period where retention is required or permitted by applicable law. Retention periods are determined by reference to the nature and sensitivity of the data, the purpose of processing, contractual and operational requirements, applicable statutory or regulatory periods, audit requirements, security and fraud-prevention needs, and the establishment, exercise or defense of legal claims.

Examples include retaining transaction and financial records for applicable statutory periods; recruitment records for an appropriate period following completion of a recruitment process; security, access and CCTV records for periods proportionate to security and operational needs; and marketing preference records for as long as necessary to respect and evidence your choices.

When Personal Data is no longer required and no lawful basis exists for further retention, SMC will destroy it without undue delay or anonymize it so that the individual can no longer be identified, using appropriate methods in accordance with applicable requirements.

9. Protection and Security of Personal Data

SMC maintains appropriate organizational, administrative and technical measures designed to protect Personal Data against unauthorized or unlawful access, use, disclosure, alteration, loss, destruction or other unlawful processing. These measures are selected having regard to the nature of the processing and applicable legal, regulatory and cybersecurity requirements.

No method of transmission or storage can be guaranteed to be completely secure. Accordingly, while SMC applies appropriate safeguards, this Policy does not constitute a guarantee that security incidents can never occur. Where a Personal Data breach triggers notification obligations, SMC will make the notifications required by applicable law.

10. Your Rights

Subject to the conditions, procedures, limitations and exceptions set out in the PDPL and its Implementing Regulations, you may have the following rights:

• Right to be informed: to be informed of the legal basis and purpose for collecting and processing your Personal Data and other information required by applicable law.

• Right of access: to access Personal Data held by SMC, subject to applicable restrictions.

• Right to obtain a copy: to request your Personal Data in a readable and clear format in accordance with applicable requirements.

• Right to correction, completion and updating: to request correction of inaccurate Personal Data, completion of incomplete Personal Data, or updating of outdated Personal Data.

• Right to destruction: to request destruction of Personal Data where the purpose for which it was collected has ended and no lawful basis requires or permits continued retention.

• Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time in accordance with applicable requirements. Withdrawal does not affect processing lawfully carried out before withdrawal.

These rights are not absolute. SMC may decline, restrict or defer a request where the PDPL or other applicable law permits or requires it to do so.

11. How to Exercise Your Rights

To exercise a right or submit a privacy request, please contact SMC using the details in Section 17 below. Please describe your request sufficiently to allow us to identify the relevant processing and right being exercised.

SMC may request information reasonably necessary to verify your identity, authority or entitlement before acting on a request. We will respond within the periods prescribed by applicable law. Where the applicable rules permit an extension because of the nature or complexity of the request, SMC may apply that extension and will communicate as required.

SMC will not require more Personal Data than reasonably necessary to verify and process a request. Requests will be handled subject to applicable exemptions, restrictions and record-keeping obligations.

12. Marketing Communications

Where permitted, SMC may send information about SMC/JCC events, services, experiences, offers or related activities. Where consent is required, marketing communications will be sent only after obtaining the required consent.

You may opt out of electronic marketing using the unsubscribe mechanism included in the relevant communication or by contacting SMC. We may retain limited information necessary to record and respect an opt-out request.

13. Recruitment

Where the Services provide recruitment or career functionality, SMC may process applicant Personal Data for recruitment, candidate assessment, communications, interview administration, background or eligibility checks where lawful, and related workforce planning and compliance purposes.

A separate Recruitment Privacy Notice may provide additional information and, once published, should be read together with this Policy.

14. CCTV, Photography, Video and Event Environments

SMC/JCC premises and events may use CCTV and other security or access-control systems for safety, security, incident management, asset protection, access control, regulatory compliance and the establishment or defense of legal claims.

Events may also involve photography, filming, broadcasting and media coverage. Where such activities involve Personal Data, they will be handled in accordance with applicable law and, where appropriate, relevant event terms, notices, signage or consent mechanisms.

15. Children and Persons Lacking Full Legal Capacity

Certain SMC/JCC services or events may be available to children or persons lacking full legal capacity. Where consent or other authorization from a legal guardian is required under applicable law, SMC will seek the required authorization through an appropriate mechanism. SMC does not intend to collect more Personal Data from such individuals than is reasonably necessary for the relevant purpose.

16. Third-Party Services and Links

The Services may contain links to, or integrate with, third-party websites, applications, ticketing platforms, payment services or social-media services. SMC is not responsible for the independent privacy practices of third parties that determine their own purposes and means of processing. You should review the privacy information made available by those third parties.

17. Privacy Requests, Complaints and Contact Details

If you have a question, concern, complaint or request concerning this Policy or SMC’s processing of your Personal Data, please contact:

SMC will review privacy complaints through its designated privacy/data-protection channel and respond in accordance with applicable requirements. If you are not satisfied with the outcome, you may submit a complaint to the competent authority responsible for enforcing the PDPL through the channels made available by that authority.

18. Changes to this Policy

SMC may update this Policy from time to time to reflect changes in processing activities, Services, technology, legal or regulatory requirements, or organizational practices. The current version will be made available through the relevant SMC/JCC digital channel and will identify its effective or last-updated date.

Where a change introduces processing that requires consent or another specific action under applicable law, SMC will obtain the required consent or take the required action separately.

19. Applicable Law

This Policy and the processing described in it are subject to the applicable laws and regulations of the Kingdom of Saudi Arabia, including the PDPL and its Implementing Regulations. Nothing in this Policy limits any right or protection that cannot lawfully be limited.

IMPLEMENTATION NOTE – REMOVE BEFORE PUBLICATION: Complete all [TBC] fields; confirm the actual controller identity and official address; verify live ticketing/app/Wi-Fi/CCTV/recruitment data flows; identify any analytics/advertising technologies in use; and align this Policy with the Cookie Policy, Event Privacy Notice and Recruitment Privacy Notice before publication.