Besla Privacy Policy Besla takes your personal data seriously and processes it in accordance with the applicable laws and regulations. Acting as the “Data Controller” (i.e., the responsible entity that determines how your personal data is processed), Besla has adopted this Privacy Policy to establish and maintain the privacy and security of your personal information. This Policy Is Based On the Following: By accepting this policy and subsequently providing us with any personal data, you consent to the collection, use, disclosure, and retention of such data in accordance with this Privacy Policy and as permitted or required by law. This policy: Specifies the types of personal data we collect about you; Explains how and why we collect and use your personal data; Describes the period for which we retain your personal data; Explains when, why, and with whom we share your personal data; Outlines your rights and choices regarding your personal data; Details the information security measures we implement to protect your personal data; Describes how we may contact you and how you can contact us. If you do not agree to these terms, please do not accept this policy and refrain from providing any personal data to us. Please note that we may be unable to respond to you, provide related services, or address your inquiries unless you supply the required personal data as indicated in this Privacy Policy — unless we expressly state that providing such data is optional. What Personal Data Do We Collect About You and How Do We Collect It? We collect content, communications, and other information you provide when using our services, including data submitted when registering for an account (where applicable) or when contacting us by any means, including email. This data includes your name, email address, phone number, store trade name (where applicable), location/country, and payment information (where applicable). We also collect additional and specific personal data depending on the products you use, as follows: A. For the Besla Product: We are required to verify customer information and identity, which involves collecting and processing the following information: Identity Verification: ID number, place of issuance, expiry date, and issuance date. Commercial Registration Verification: Commercial registration number, unified national entity number, entity name, issue date, expiry date, business activity type, place of issuance, owner’s name, and manager’s name. Other Information: Store name and address, contact person details, and any other information you may provide during the setup process. B. For the Besla Product (continued): The information we collect includes: Commercial Registration Information: (Commercial registration number, unified entity number, entity name, issue and expiry dates, business type, place of issuance, owner’s name, manager’s name – where applicable). Identity Information: ID number, place of issuance, expiry date, and issuance date (where applicable). VAT registration information; Session or meeting recordings; Any other information you provide. In addition, we collect the following types of personal data: (a) Usage Data: Information about how you use our services, including the time, frequency, and duration of your browsing activities and your use of specific features. (b) Device Information: Data about the devices you use, such as device model and type, operating system, hardware/software versions, and technical details (e.g., your IP address). (c) Feedback on Our Products and Services: Information you share to evaluate your experiences, satisfaction, or interactions with us. Cookies When you use our website, we use cookies to collect personal data from your device to help us improve our services and enhance your experience. For example, cookies allow you to use our services repeatedly on the same device without needing to log in or adjust preferences each time. We also automatically collect website statistics during your visit based on your IP address to help improve your online experience. Sources of Personal Data We collect your personal data directly from you—that is, from the information you provide when using our services or communicating with us. We also collect data through the deployment of cookies as described above. Additionally, we may collect personal data when you visit our offices (e.g., through CCTV footage). Besla is a cloud-based restaurant management solution that includes website and kiosk services. How and Why We Use Your Personal Data We use your personal data for the following purposes: To send you information about our products and services; To respond to your communications and requests; To manage our relationship with you or your organization; To manage our relationships with partners and third-party referrers; For billing and payments; To handle disputes; To provide our services to you; To verify your identity under “Know Your Customer (KYC)” and “Anti-Money Laundering (AML)” regulations and sanctions screening, and to conduct due diligence on the nature and source of transactions; For marketing purposes — including contacting you by email, post, or phone (including SMS) about Besla, third-party products, services, surveys, research studies, promotions, and events that may interest you or your organization, based on your consent as provided under this Privacy Policy and applicable laws. You will always have the option to opt out of marketing communications; To personalize the content and services we provide; To better understand your (and your organization’s) interests and needs to improve our services; For analysis, research, and reporting related to service usage; For training, archiving, and service security; To comply with applicable laws and regulations; To establish, exercise, or defend our legal rights; To prevent or detect crimes and fraud; To protect health, safety, and security; To fulfill contractual requirements; and To perform internal business operations, such as corporate transactions, audits, and data analysis. Retention of Personal Data The retention period for your personal data depends on the purpose for which it was collected and used and/or as required by applicable law. Once the data is no longer needed, we will take reasonable steps to delete it from our systems and ensure it is deleted from any external systems processing it on our behalf. Sharing Your Personal Data We may share your personal data with: Group Companies: Within our corporate group to process your data as described herein. New Owners: If ownership of Besla or part of its services changes, we may transfer your data to the new owner. Third-Party Service Providers and Partners: Including IT providers and developers, to: Improve and deliver our services; Develop and present products and services that may be of interest to you; Process payments. We will limit such sharing to what is necessary and ensure that recipients are bound by confidentiality and data protection obligations in compliance with applicable laws. Government Authorities: We may share your data with government authorities in response to inquiries or as required for operations and compliance. Legal Compliance: We may share data in response to legal procedures, to establish or enforce our rights (including terms and conditions), protect our property, or defend against claims. Employees, Agents, Consultants, and Contractors: Only as necessary and under obligations to protect your data. Banks and Payment Providers: For the Besla Pay product: With banks: Basic data such as merchant name, address, city, national ID/unified number, and payment terminal ID to configure merchant systems. With POS device vendors: Basic merchant and terminal information to set up payment devices. With Amex (if requested by merchant): Similar data to enable service. With the Saudi Central Bank (SAMA): Regulatory reports containing merchant, terminal, transaction, and complaint data. By accepting this Privacy Policy, you consent to the sharing and disclosure of your personal data as described above, as permitted by applicable law. Third-Party Links and Features Our website may contain links to third-party sites (e.g., social media) and may integrate third-party features. If you choose to use such sites or features, your data may be shared not only with those third parties but also with their users and the public, depending on how their services operate. Besla is not responsible for the content or privacy practices of such sites or services. Your data collection and processing in these cases will be governed by the privacy policies of those third parties, not this policy. We encourage you to read their privacy and security policies carefully. Data Storage and International Transfers By accepting this Privacy Policy, you agree that your information will be stored within the Kingdom of Saudi Arabia. Besla may subcontract data processing or share data with third-party service providers located within the Kingdom. These providers may assist in providing goods or services, processing payments, or offering support services. All such transfers or processing will comply with applicable data protection laws. Data Security and Protection The confidentiality, security, and protection of your personal data are matters of utmost importance to Besla. We apply a variety of technical, administrative, and physical safeguards to prevent unauthorized disclosure or access. However, please note that no method of transmission or storage over the internet is completely secure, and absolute security cannot be guaranteed. Changes to This Policy We may review and update our privacy practices from time to time. Any change, update, or modification will become effective immediately upon posting on our website or upon notifying you via email. You must review and accept the updated policy each time; otherwise, continued use of our services will not be permitted. Your Rights You have specific rights under applicable laws and regulations, including: (a) Right to be Informed: You have the right to know the legal and practical reasons for collecting your personal data, the purposes of collection, and assurance that your data will not be processed for purposes inconsistent with those stated herein. (b) Right of Access: You have the right to access and obtain a copy of your personal data. (c) Right to Rectification: You may request correction, completion, or updating of your personal data controlled by Besla. (d) Right to Deletion: You may request deletion of your personal data when Besla no longer needs it for the purposes collected. (e) Right to Withdraw Consent: You may withdraw your consent at any time, in cases where processing is based on your consent. However, doing so may affect our ability to provide services to you. You can exercise your rights listed above by contacting us through the communication channels provided below. Please note that exercising these rights is subject to exceptions permitted under applicable laws and to the protection of other individuals’ rights. We may request an official document to verify your identity before processing any such requests.