When does Mora collect your Personal Data?

Once you use the application, contact customer service, or visit the website, data collection starts via the data entered or read through the servers, or through the direct authorization of the user (when asked to provide data). You may give us your identity, contact, and other personal information by filling in forms or by corresponding with us by phone, email, or otherwise. This includes sharing Personal Data for the following purposes:

• Records of your interactions with us, such as emails and other correspondence, and your instructions to us.
• Providing your feedback.
• By filling in forms.
• By interacting with us on social media platforms such as Facebook, Instagram, and LinkedIn, etc.

Mora collects personal data from trusted third parties, such as:

• Governmental third parties.
• Analytics providers.

Social media platforms.

What Personal Data do Mora collect?

All data required for the execution and fulfillment of contracts, including but not limited to full name, ID number or residence number, place of residence, workplace, financial and credit information.

• When using the Mora app, creating an account, applying for products, or contacting us, we reserve the right to collect a range of data and information, including the following:
• Account information: Email address, registered devices, account status, and age.
• Device information: Data that can identify your device, such as the device’s serial number or information about your device.
• Contact information: Data such as name, email address, physical address, phone number, or other contact details.
• Payment information: Data related to billing address and payment methods.
• Fraud prevention information: Data used to help detect and prevent fraud.
• Location information: Your current location only.
• Financial information: Details including salary and income information.
• Government identity data: Legally, we are required to collect your national ID information.
• Other information you provide to us: Interactions with customer support and contact through social media channels.
• Data related to your products and transactions with us: Such as account activity and product usage.

How and why does Mora use your Personal Data?

There are many contact points that help us collect your data. Below are a few examples:

• During onboarding and service utilization – When you use Mora’s services, become a customer, and benefit from Mora’s products.
• Information exchange – When you complete and upload a form to Mora’s website, mobile apps, email, or social media posts, call the customer center, or participate in promotional campaigns.
• Interaction (social media) – Any posts, messages, or interactions you carry out with us directly on Mora’s social media channels.
• Browsing patterns – Data on how you explore Mora’s website, the timing of your visits, the types of internet browsers you use, and how you were referred to Mora’s website.
• Surveys – Online web surveys that enable us to gather feedback on topics, such as what you like and dislike about the look of Mora’s website and mobile apps. Your valuable feedback enables us to improve the quality of the experience Mora provided to you.
• You personally or your authorized agent or legal representative.
• In legally accepted cases, from third parties and public sources. This includes government entities and credit information companies and agencies.

Mora may also use your Personal Data in the following situations, which are likely to be rare:

• Where Mora needs to protect your interests (or someone else’s interests);
• Where it is needed in the public interest or for official purposes, and legal purposes.

Personal Data Collected Directly from the Data Subject

Mora collects Personal Data directly from the Data Subject when the Data Subject voluntarily provides such data through the following means, including but not limited to:

• Electronic and physical forms, including e-forms containing empty fields, drop-down lists, radio buttons, and similar input mechanisms;
• Account registration, onboarding, and application processes;
• Communication through customer service channels, including phone calls, emails, and written correspondence;
• Interactions through Mora’s official social media platforms;

Surveys, feedback forms, and direct communications provided by the Data Subject or their authorized representative.

Personal Data Collected Indirectly

Mora may also collect Personal Data indirectly through lawful and permitted means, including:

• Cookies and similar tracking technologies used on Mora’s websites and digital platforms;
• Log files and automatic collection of technical information, such as IP address, browser type, access times, and usage patterns;
• Website analytics and performance monitoring tools;

Interconnection and data exchange with government entities or authorized third parties, where legally permitted.

Use of Google Analytics

We use Google Analytics to collect and analyze information about how visitors interact with our website. This helps us understand website performance, improve user experience, identify commonly visited pages, and make our content and services more relevant and effective.

Google Analytics may collect information such as the pages you visit, the date and time of your visit, how long you spend on the website, the links or buttons you click, files you download, and how you navigate between pages. It may also collect technical information about your device and browser, such as device type, operating system, browser type, screen resolution, language settings, and general usage patterns.

Google Analytics may also help us understand how visitors reach our website, such as through search engines, online advertisements, social media platforms, referral websites, email campaigns, or direct visits. In addition, it may collect approximate geographic information, such as country, city, or region, based on your device or network information.

The information collected through Google Analytics is used for statistical and analytical purposes, including monitoring website traffic, measuring the effectiveness of our campaigns, improving website functionality, and enhancing the overall visitor experience. We do not use Google Analytics to directly identify individual visitors.

Google Analytics may process this information using cookies or similar technologies, subject to your cookie preferences and applicable privacy laws.

What Personal Data does Mora collect?

All data required for the execution and fulfillment of contracts, including but not limited to full name, ID number or residence number, place of residence, workplace, and financial and credit information. When using the Mora app, creating an account, applying for products, or contacting us. Mora collects only the Personal Data that is necessary, relevant, and proportionate to the purposes for which it is processed, in accordance with the law, such as:

• Account information: Email address, registered devices, account status, and age
• Device information: Data that can identify your device, such as the device’s serial number or other device-related information
• Contact information: Name, email address, physical address, phone number, or other contact details
• Payment information: Billing address and payment method details
• Financial information: Salary and income details
• Government identity data: National ID information, as legally required
• Other information: Interactions with customer support and contact through social media channels
• Data related to your products and transactions: Such as account activity and product usage
• Location and geolocation information: Your device location, where enabled and permitted, including geolocation data based on GPS, nearby Wi-Fi access points, and mobile networks, subject to your permission.

Fraud prevention and application security information: Technical and security-related data used to help detect, prevent, and respond to fraud, unauthorized access, automated activity, misuse of Mora’s services, and other security risks. This may include data related to the user’s device, browser or application information, network connection, user session, account activity, application events triggered by user actions, custom user attributes, unique device or session identifiers, and other technical indicators used to identify the application, user session, and device, and to detect signs of fraudulent or automated activity

How and Why Does Mora Use Your Personal Data?

Under the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL), we may only process your Personal Data where we have a valid legal basis to do so. Depending on the circumstances, this may include:

1. Contractual basis, where processing is necessary to enter into or perform a contract with you
2. Legal or regulatory obligation, where we are required to process Personal Data to comply with applicable laws or regulatory requirements, including those issued by the Saudi Central Bank (SAMA)
3. Legitimate interests, to the extent permitted under applicable law, where processing is necessary for our legitimate business interests and does not override your rights or involve Sensitive Data. Examples of our legitimate interests may include improving our products and services, supporting customer service, protecting our systems and networks, preventing fraud, and safeguarding our legal rights and business interests, in each case to the extent permitted under applicable law.
4. Consent, where you have provided your explicit consent

Actual interest, where processing is necessary to achieve a clear benefit for you and communication with you is impossible or difficult, in accordance with applicable law.

Sensitive and Special Categories of Personal Data

Certain categories of Personal Data processed by Mora may be classified as Sensitive Personal Data under the PDPL, including but not limited to government identification data, financial and credit information, location data, and authentication or verification data processed through government platforms.

Mora processes Sensitive Personal Data only where permitted under applicable laws and regulations and applies enhanced technical and organizational safeguards. Where required, such data is processed based on the explicit consent of the Data Subject or a legally recognized exception under the PDPL.

The Purposes of Collection and Usage of Your Personal Data

Mora collects data for the execution and fulfillment of contracts, including evaluating your application or fulfilling your instructions. Examples include:

• Compliance with legal and regulatory authorities.
• Providing products or services.
• Identity verification, application security, and fraud protection checks
• Improving products, services, and customer experience.
• Understanding customer needs and eligibility for products.

Mora processes Personal Data based on one or more of the following legal bases under the PDPL:

• Consent of the data subject.
• Performance of a contract.
• Compliance with legal or regulatory obligations.
• Legitimate interests, where applicable.
• Where processing is based on consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Legitimate interests are relied upon only where such interests do not override the rights of the Data Subject and are not used for processing Sensitive Personal Data unless permitted under applicable laws.

Where processing is required to comply with legal or regulatory obligations, consent is not required and processing may continue notwithstanding withdrawal of consent.

Change of Purpose

Mora will only use your data for the purpose it was collected unless it is needed for a compatible purpose. Mora may use your data to promote new products, with your consent. Where required by law, Mora will notify the Data Subject and obtain consent before processing Personal Data for a new or incompatible purpose.

Disclosure of Your Personal Data

Your personal data may be disclosed to third parties only where permitted under applicable laws and regulations. Subject to applicable laws and regulations, Mora may disclose Personal Data to the following categories of entities inside or outside the Kingdom, for clearly defined and legitimate purposes:

• Government and Regulatory Authorities (inside the Kingdom), such as Saudi Data and Artificial Intelligence Authority (SDAIA), Saudi Central Bank, and authorized government platforms (e.g., Elm, Yakeen, Nafath, SIMH), for identity verification, regulatory compliance, and legal obligations (disclosure may be one-time or recurring, as required by law).
• Licensed Financial, Insurance, and Debt Collection Service Providers (inside or outside the Kingdom), such as licensed banks, insurance companies, credit bureaus, and authorized debt collection entities, for service delivery, credit assessment, risk management, and contractual obligations (disclosure may be one-time or recurring, depending on the service).
• IT, Cloud, Analytics, Fraud Prevention, Cybersecurity, and Technology Service Providers (inside or outside the Kingdom), such as hosting providers, system integrators, cybersecurity service providers, and analytics platforms, for system operation, security monitoring, data hosting, analytics, and service improvement (disclosure is generally recurring).
• Affiliated or Group Companies (inside or outside the Kingdom), where applicable and legally permitted, for operational support, service enhancement, and internal administrative purposes (disclosure may be recurring).

Mora ensures that all third-party disclosures are subject to appropriate contractual, technical, and organizational safeguards in accordance with the PDPL. Mora ensures that Data Subjects are informed of the nature of third-party disclosures, the types of entities involved, the purposes of disclosure, and whether such disclosures occur on a one-time or ongoing basis, in accordance with PDPL requirements.

Cross-Border Transfer of Personal Data

Cross-border transfers are conducted only where necessary and in accordance with PDPL requirements. Further, Mora ensures such transfers are conducted in accordance with PDPL requirements, including SDAIA-approved transfer mechanisms, adequacy decisions, or other legally recognized safeguards, and subject to appropriate contractual, technical, and organizational measures.

How Does Mora Protect Your Personal Data?

Mora ensures your data is appropriately protected using physical, technical, administrative, and procedural measures to prevent unauthorized access, use, disclosure, alteration, or loss. Technical data processed for fraud prevention and application security purposes is protected through appropriate safeguards, which may include secure transmission channels, encryption, hashing, access controls, and security monitoring, where applicable. However, note that the internet is not completely secure.

Certain processing activities, such as eligibility assessments or fraud detection, may involve automated processing. Where such processing produces legal or significant effects, Mora applies appropriate safeguards, including the right of the Data Subject to request human intervention, express their point of view, and contest the decision, in accordance with the PDPL.

Data Storage

Personal Data is retained as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, contractual, and supervisory requirements.

Your Data Protection Rights

You have the following rights:

• Right to be Informed
• Right of Access
• Right to Rectification
• Right to Restrict Processing
• Right to Object to Processing
• Right to Erasure (Right to Be Forgotten)
• Right to Withdraw Consent
• Right to File a Complaint
• Right Not to be Subject to Automated Decision Making

You can exercise your rights by contacting the call center, writing to the DPO, or visiting the Branch. The exercise of these rights is subject to the conditions, limitations, and exceptions provided under applicable laws and regulations. Mora may decline or restrict a request were permitted by law, including where processing is required to comply with legal or regulatory obligations.

Contact Information

For any inquiries related to this Privacy Notice or your personal data, please contact Mora’s appointed Data Protection Officer (DPO) for the Kingdom of Saudi Arabia at dataoffice@ijarah.sa

If you are not satisfied with the outcome of your complaint, you may also raise your concern with the Saudi Data and Artificial Intelligence Authority (SDAIA) or Saudi Central Bank (SAMA) for personal data protection in the Kingdom of Saudi Arabia.

Changes to the Privacy Notice

Mora reserves the right to amend this Privacy Notice at any time.
Effective date: 1 September 2024
Last updated: 7 ـJuly 2026
Version: 2.0

Disclaimer

This Privacy Notice does not replace or limit any rights granted to Data Subjects under KSA laws and regulations. It ceases to apply upon accessing third-party websites, for which Mora is not responsible.