Privacy Policy

The categories we process depend on whether you browse the public site, contact us, or complete institutional onboarding.

• Identity and organization data: legal name, role, authority documents, corporate registry extracts, and beneficial-owner information.
• Contact data: business email, phone, office address, and correspondence.
• Compliance data: KYC/AML files, source-of-wealth materials, sanctions-screening results, and tax residency documentation.
• Account and transaction data: holdings, orders, allocations, login events, device identifiers, and support tickets.
• Technical data: IP address, browser type, pages viewed, and approximate location derived from IP.
• Communications: emails, meeting notes, and recordings where we have notified participants.

• To evaluate applications and operate institutional accounts.
• To execute, settle, and report transactions you instruct.
• To meet anti-money-laundering, sanctions, tax, and record-keeping duties.
• To secure the platform, detect abuse, and investigate incidents.
• To communicate about onboarding, service changes, and support.
• To improve site performance and understand aggregate usage of public pages.

We do not sell personal data. We do not use onboarding or account data for unrelated consumer advertising.

Where GDPR or an equivalent regime applies, we rely on one or more of the following: performance of a contract or pre-contractual steps; compliance with legal obligations (including AML and sanctions law); legitimate interests such as securing our platform and communicating with professional counterparties; and consent where we ask for it (for example, optional cookies).

Under the PDPL, we process personal data for the purposes stated in this policy and do not process it contrary to those purposes without a lawful justification.

We share data only as needed to operate the services or as required by law.

• Custodians, brokers, trading venues, and payment or settlement banks that support your account.
• Identity-verification, screening, and cybersecurity vendors acting as processors under contract.
• Professional advisers (legal, audit, insurance) under confidentiality duties.
• Competent regulators, courts, or law-enforcement agencies when legally required.
• A successor entity in a reorganization, merger, or transfer of relevant business assets.

We are established in the Kingdom of Saudi Arabia, at 11th Floor of the West Wing, Al-Midra Tower (Building 3304), Dhahran, Saudi Arabia. Some vendors or venues may process data in the EU, UK, United States, or other countries. Where a destination does not provide an adequate level of protection, we use recognized transfer mechanisms such as standard contractual clauses and supplementary safeguards as appropriate.

We keep personal data only as long as needed for the purpose collected, including statutory retention. KYC and transaction records are typically retained for at least ten years after the end of the business relationship, or longer if a legal hold, investigation, or accounting requirement applies. Website logs are kept for a shorter operational period unless needed for security review.

We apply layered technical and organizational measures aligned with institutional custody and Saudi data-protection expectations. These include access control, encryption in transit, least-privilege administration, vendor due diligence, and incident-response procedures. No method of transmission or storage is perfectly secure; you must also protect your own credentials and devices.

Subject to legal limits (including AML record-keeping), you may request access, correction, deletion, restriction, or portability of personal data, and you may object to certain processing. Where processing is based on consent, you may withdraw it without affecting prior lawful processing.

Submit requests to privacy@aramcoinvestments.com. We may need to verify your identity and authority to act for an institution. You may also lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) or, if GDPR applies, your local supervisory authority.

The public website uses strictly necessary cookies to operate the service and may use limited analytics cookies to understand aggregate traffic. Where required, non-essential cookies are used only with consent. You can control cookies through your browser; blocking some cookies may affect site features.

The services are designed for institutional and professional counterparties. We do not knowingly collect personal data from children, and we do not target the platform at individuals under 18.

We may update this Privacy Policy from time to time. The revised date will appear at the top of this page. Material changes affecting active clients will be communicated through the account relationship where required.

Privacy inquiries: privacy@aramcoinvestments.com. Postal address: Aramco Investments, 11th Floor of the West Wing, Al-Midra Tower (Building 3304), Dhahran, Saudi Arabia.