Privacy Policy

1. Who we are

SARD Investment ("SARD", "we") runs the SARD website and the SARD mobile app, which let people invest in Saudi real estate through small shares. This policy explains what personal data we collect, why, and what rights you have under the Saudi Personal Data Protection Law (PDPL).

Contact for anything in this policy: contact@mysard.com.

2. What we collect

On this website

• Waiting list: your name, email address, mobile number, the language you chose, and your consent.
• Contact form: your name, email address, the topic and the message you write.
• Technical data: a salted, one-way hash of your IP address, used only to limit spam and repeated submissions. We do not store your raw IP address.

In the SARD app

• Account data: name, email, mobile number, and your sign-in details.
• Verification data: identity details needed to confirm who you are, and the bank account (IBAN) you register to receive payments.
• Investment data: your orders, shares, ownership records, payments, and income distributions.
• Service data: notifications, device type and app version, and support messages.

3. Why we use it

• To manage the waiting list and invite you when access is ready.
• To answer your messages.
• To open and run your account, verify your identity, and carry out your investments and payouts.
• To meet legal duties, including anti-money-laundering, tax and record-keeping rules.
• To keep the service secure, prevent fraud and spam, and fix problems.
• To send service messages. We send marketing only if you agreed, and you can stop at any time.

Our legal bases are your consent, the need to provide the service you asked for, and our legal obligations.

4. Who we share it with

We do not sell your personal data. We share it only when needed, with:

• Service providers that work for us under contract: hosting, email delivery, payment processing, bank-account verification, and identity verification.
• Banks and payment institutions, to collect and pay out money.
• Government and regulatory authorities, when the law requires it.
• Professional advisers (for example auditors and lawyers) under a duty of confidentiality.

Our production systems are hosted in the Kingdom of Saudi Arabia, and we keep your personal data inside the Kingdom. We do not transfer it outside the Kingdom.

5. How long we keep it

Waiting list and contact data: until you ask us to delete it, or until a reasonable time after the launch invitations are finished. Account and transaction data: for as long as your account is open, and afterwards for the period the law requires us to keep financial and ownership records.

6. How we protect it

We use encryption in transit, access controls, separate environments for testing and production, and logs of who accessed sensitive data. Bank details are stored with extra protection and are visible only to staff who need them. No system is perfectly secure, so if a breach affects you we will tell you and the authority as the law requires.

7. Your rights

Under the PDPL you can ask us to:

• Tell you what data we hold about you and how we use it.
• Give you a copy of your data.
• Correct data that is wrong or incomplete.
• Delete your data, where the law allows.
• Withdraw your consent at any time. This does not affect what we did before you withdrew.

Email contact@mysard.com from the address you registered with. We will reply within the time the law sets. If you are not satisfied, you may complain to the Saudi Data and AI Authority (SDAIA).

8. Cookies

This website uses only what it needs to work, such as remembering your language choice in your browser. It does not use advertising cookies.

9. Children

SARD is for adults aged 18 and over. We do not knowingly collect data from children.

10. Changes

We may update this policy. The date at the top shows the latest version. If a change is important, we will tell you in the app or by email.