Privacy Policy — Baytiy

1. Data Controller

The entity responsible for processing your personal data is:

2. Scope of This Policy

This Policy applies to all users who interact with the Baytiy platform, including: licensed real estate brokers, brokerage offices, real estate developers, and visitors and users of the site. It does not apply to third-party websites or services to which the platform may link.

3. Personal Data We Collect

a. Identity & Contact Data

• Full name
• Mobile phone number
• Email address
• Nationality and country

b. Professional Account Data (Agents, Offices, Developers)

• REGA FAL license number
• VAT number / Commercial Registration number
• Company or office name
• Profile photographs
• Supporting documents for account activation

c. Listing & Property Data

• Property address and GPS coordinates (latitude / longitude)
• Property photographs and descriptions
• Pricing and area details
• Ownership documents and tenancy contracts
• REGA ad license number (as required by Saudi real estate advertising regulations)

d. Technical & Usage Data

Automatically collected when you use the platform:

• IP address and approximate geographic location
• Browser type, device, and operating system
• Pages visited and navigation sequence
• Session duration and interaction patterns
• Cookies and tracking identifiers
• Traffic source (paid ad, organic search, social media)

e. Data You Provide Voluntarily

• Search preferences and filter criteria
• Messages sent to agents
• Complaints and support correspondence
• Property reviews and agent ratings

4. Legal Basis for Processing

In accordance with Article 6 of the PDPL, we process your personal data only on the basis of one of the following lawful grounds:

We will not use your data for purposes incompatible with those for which it was originally collected without providing you prior notice.

5. How We Use Your Data

Core Services

• Creating accounts and verifying the identity of agents and developers
• Publishing and managing property listings
• Connecting prospective buyers and renters with the relevant agent
• Operating the built-in CRM dashboard for agents and offices
• Processing complaints and support requests

Platform Improvement

• Analyzing usage patterns to improve performance and interface design
• Testing new features and generating personalized property recommendations
• Detecting security vulnerabilities and maintaining platform integrity

Communications & Marketing

• Sending platform notifications (account confirmation, new leads, listing updates)
• Sending marketing communications to users who have given explicit consent
• Reminding agents of their FAL license renewal dates

6. Data Retention Periods

We retain personal data for the period necessary to fulfill the purposes described in this Policy or to comply with applicable legal requirements. The following retention periods apply:

Upon expiry of the applicable retention period, data is securely deleted or anonymized unless retention is required by a valid court order or regulatory obligation.

7. Disclosure & Sharing of Personal Data

We do not sell or rent your personal data to any third party. We may disclose it only in the following circumstances:

a. Service Providers

We engage third-party service providers to operate the platform, including: database hosting (MongoDB Atlas, Supabase), SMS processing (Twilio), email delivery (Resend), usage analytics (Google Analytics 4), and error monitoring (Sentry). All service providers are contractually required to maintain strict data protection standards.

b. Platform Agents

When you submit an inquiry through a property listing, your name and phone number are forwarded to the relevant agent or developer to enable direct communication. Your contact details are not shared with any party other than the direct listing owner.

c. Government & Judicial Authorities

We may disclose data in response to court orders or official requests from competent Saudi regulatory bodies, including REGA, SDAIA, and the Public Prosecution, following applicable legal procedures.

d. Corporate Restructuring or Merger

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will provide prior notice and offer you the option to delete your data.

8. International Data Transfers

Parts of our technical infrastructure store data on servers outside the Kingdom of Saudi Arabia. Specifically:

• MongoDB Atlas — production databases on AWS servers in the United States
• Supabase — image and file storage on servers in the United States
• Render — application servers and hosting in the United States

These transfers occur on the basis of legitimate technical necessity. We are working to document data protection guarantees with these providers in compliance with Article 30 of the PDPL governing cross-border data transfers. If you have objections to this transfer, please contact us at privacy@baytiy.com to discuss available options.

9. Cookies & Tracking Technologies

We use cookies for the following purposes:

You may disable non-essential cookies via your browser settings, although this may affect certain platform features.

10. Data Security

We implement technical and organizational safeguards to protect your personal data, including:

• Communication encryption using TLS 1.2 or higher
• Hashing of passwords and OTP codes using bcrypt
• Internal access restrictions based on the principle of least privilege
• Continuous exception and error monitoring via Sentry
• Regular encrypted backups
• Periodic security reviews of the source code

In the event of a security breach that poses a material risk to your rights and freedoms, we will notify you and report to the relevant regulatory authorities within the timeframe prescribed by law.

11. Your Rights Under the PDPL

The Saudi Personal Data Protection Law (1443H) grants you the following rights, exercisable by contacting us at privacy@baytiy.com:

Certain rights may be subject to exceptions in cases of legal obligations or ongoing regulatory requirements. We will explain the basis for any full or partial refusal.

12. Automated Decision-Making & Recommendations

The platform may use automated recommendation systems to display relevant property listings based on your browsing behavior and recorded preferences. These recommendations do not produce legal effects or similarly significantly affect your rights. You may disregard recommendations at any time or request a manual review.

13. Third-Party Links & Services

Our platform may include links to external websites or services such as Google Maps and social media advertising tools. These sites operate under their own independent privacy policies and Baytiy is not responsible for their practices. We encourage you to review their privacy policies before sharing any personal data.

14. Children's Privacy

Baytiy's services are directed exclusively to users aged 18 years and above. We do not knowingly collect personal data from minors. If we become aware that a user under 18 has created an account, we will suspend the account and delete the related personal data without delay.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy periodically to reflect operational or regulatory changes. For material changes, we will notify you by email or by a prominent notice within the platform at least 14 days before the change takes effect. Your continued use of the platform after that notice constitutes acceptance of the updated Policy.

16. Contact & How to Complain

a. Contact Baytiy

We are committed to responding to all privacy requests within 30 days of receipt. This period may be extended by a further 30 days in complex cases, with notification provided within the original deadline.

b. Right to Lodge a Complaint with the Supervisory Authority

If you are not satisfied with our response to your privacy request, you have the right to lodge a complaint with the competent Saudi supervisory authority: