In line with the commitment of National Transport Safety Center — hereinafter referred to as the “Center” — to protecting and managing personal data as one of its institutional assets, this Privacy Notice has been prepared in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443 AH, as amended by Royal Decree No. (M/148) dated 05/09/1444 AH. This Notice aims to clarify the personal data collected by the Center, how such data is processed, the purposes for which it is used, and how it is protected in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia. It also explains the rights of Personal Data Subjects and how these rights may be exercised. What Is Personal Data? Any data, regardless of its source or form, that may specifically identify an individual or make it possible to identify an individual directly or indirectly. First: Contents of This Notice This Notice explains how personal data is collected, used, and processed, and clarifies the rights of Personal Data Subjects in accordance with the Personal Data Protection Law. Your use of the Center’s website or services constitutes acceptance of the provisions of this Notice in accordance with the Personal Data Protection Law and its Implementing Regulations. This includes adults, minors, persons lacking or having limited legal capacity, in accordance with the applicable laws and regulations. Second: Collection of Data The Center collects and processes the personal data of visitors to its website, as well as the personal data of applicants requesting the Center’s services or submitting reports. Third: How Data Is Collected Most of the data collected and processed by the Center is provided directly by the Personal Data Subject, through requesting one of its services. The Center may also obtain personal data indirectly from government or quasi-government entities, the private sector, service providers, or relevant parties, in accordance with the laws and policies governing data sharing. Fourth: Purpose of Collecting and Using Information The Center collects the minimum amount of personal data necessary to fulfill several purposes, including, but not limited to: Improving the provision of services and delivering an enhanced user experience. Enabling the Center to provide the services requested by the Personal Data Subject, such as training, consultations, reports, visits, and others. Fifth: How We Process Your Personal Data The Center processes the personal data collected and stored about you and others using systems designed to provide you with the best possible services. The Center uses appropriate technical means to analyze data, support decision-making, and improve the quality of services, in accordance with the provisions of the Law. Sixth: Legal Basis for Processing Personal Data The Center processes personal data pursuant to the Saudi Personal Data Protection Law, issued by Royal Decree No. (M/19) dated 09/02/1443 AH and its amendments and Implementing Regulations, as well as the relevant national laws and regulations, policies, and procedures. Seventh: Storage of Personal Data Personal data is stored and processed in secure technical environments subject to approved cybersecurity controls, in accordance with cybersecurity management policies and regulations issued by the National Cybersecurity Authority, to ensure the confidentiality, integrity, accuracy, and availability of data and to restrict access to it. Eighth: Destruction of Data Personal data shall be destroyed when the purpose for which it was collected has been fulfilled, or upon the request of the Personal Data Subject where permitted by applicable legal requirements. Secure destruction methods appropriate to the classification of the data shall be used. Where required, entities to which the data has been disclosed shall be notified to take the same action. However, the Center may retain such data after the purpose for which it was collected has ended if all information that specifically identifies the Personal Data Subject has been removed, in accordance with the controls prescribed by applicable laws and regulations. Ninth: Rights of Personal Data Subjects Without prejudice to the rights of others, and without disclosing personal data that identifies another individual, and without prejudice to the provisions of the Law, the Personal Data Subject has the right to exercise the following rights: The right to be informed. The right to access their personal data held by the Center. The right to request correction, completion, or updating of their personal data held by the Center. The right to request the destruction of their personal data held by the Center when there is no longer a need for such data. Other rights stipulated in the Law and specified by the Implementing Regulations. Tenth: Disclosure of Personal Data The Center discloses personal data in cases permitted by the Personal Data Protection Law, including the following: If the Personal Data Subject has consented to the disclosure in accordance with the provisions of the Law. If the personal data has been collected from a publicly available source. If the entity requesting disclosure is a public entity and the disclosure is for purposes of public interest, security purposes, enforcement of another law, or fulfillment of judicial requirements. If disclosure is necessary to protect public health or public safety, or to protect the life or health of a specific individual or individuals. If the disclosure is limited to subsequent processing in a manner that does not result in identifying the Personal Data Subject or any other individual specifically. Eleventh: Exercising the Rights of the Personal Data Subject Under the Personal Data Protection Law, the Personal Data Subject has the right to exercise the rights stipulated by the Law by contacting the Data Management Office at: DMO@ntsc.gov.sa The Center shall respond to any request concerning the rights referred to in Section Nine within 30 days. The Center may extend this period by no more than an additional 30 days, provided that the Personal Data Subject is notified in advance of the extension and the reasons for it. Twelfth: Contacting the Center’s Data Protection Officer For any complaint or inquiry related to this Privacy Notice, the handling of personal data, or a personal data breach report, please contact the Data Management Office via: DMO@ntsc.gov.sa Thirteenth: Updates to the Privacy Notice The Center may update this Privacy Notice whenever necessary. The updated version will be published on this page. Continued use of the Center’s services after the update has been published constitutes acceptance of the provisions contained therein.