Privacy Policy and Notice

The General Authority for Military Industries (GAMI) is committed to protecting personal data by applying the necessary administrative controls and technical measures in accordance with the relevant laws, regulations, policies, and decisions.

Therefore, the Privacy Policy and Notice help personal data subjects understand the nature and type of data that the GAMI collects and processes and the purpose
for which it is processed and collected.

It is important that personal data subjects are aware of their rights regarding their personal data in
accordance with the relevant regulations and how GAMI and its partners use their personal data.
Your use of GAMI’s website means that you are acknowledge and informed to what is stated in the Privacy Policy and Notice. We also encourage you to review the Privacy Policy and Notice for any updates made to it.

Contact Information
Department: Data Management Office.
E-mail address: DMO@gami.gov.sa

Last update date

The last update on the Privacy Policy and Notice was on 05/February/2025

What personal data is collected?

We collect the necessary personal data to carry out the GAMI tasks in accordance with its regulations, and it includes the following:

• Account Data: This includes the essential data to create an account or profile, such as name, personal identification number, addresses, contact numbers, and email address.
• Financial Data: This includes account number, bank name, and payment details.
• Human Resources Data and Operations: This includes job-related and educational data.
• Technical Data: This includes data collected through website logs, cookie technologies, or similar technologies, including your Internet Protocol (IP) address used to connect your computer to the internet.
• Case Identification Data: This includes data about individuals benefiting from the services of the GAMI or its partners.
• Data Obtained from Other Parties to Complete GAMI Tasks and Procedures.
• Personal Data Provided to GAMI or its Partners.
• Data Related to Factories/Companies.
• Data Related to Investors.

The purpose of collecting personal data

In accordance with its regulations, GAMI collects personal data to provide services and meet the
requirements as well as respond to inquiries from beneficiaries of GAMI services while developing and improving the experience and ensuring the continuity of providing services with the required quality.

Methods of collecting the personal data

Some of the personal data we process is obtained either directly or indirectly using various methods, which include the following:

• Services: When registering on the GAMI official channels or those of its partners and using the products or services provided by the GAMI or its partners.
• Communication: When communicating with the GAMI or its partners through various electronic and non-electronic channels.
• Surveys: When conducting surveys, personal data may be collected and used for analysis, research, and the purpose of developing services provided by GAMI or its partners, as well as improving customer experience.
• We may request additional information to meet development requirements.
• Indirect Collection: Your personal data is collected indirectly through cookies when visiting GAMI’s website.
• Other Entities: As per regulations and legislation.

How do we use the personal data

GAMI uses personal data to provide its services in accordance to its regulations that includes but not
limited to the following:

• To ensure the provision of services by GAMI or its partners and fulfilling their requirements.
• To resolve inquiries and complaints from beneficiaries of GAMI services or its partners.
• To understand the preferences of beneficiaries and thereby improving services and customer
• experience.
• To analyze data and national statistics and create internal reports.
• To complete the internal procedures and internal operations within GAMI and external entities.

How do we store and destroy personal data

The personal data is securely stored in the GAMI databases by adhering to key national principles for protecting personal data within the geographical boundaries of the Kingdom of Saudi Arabia. This is to ensure the preservation of national sovereignty over this data unless there are cases of data transfer or processing outside the geographical boundaries of the Kingdom; provided that personal data is destroyed securely once the purpose of its collection is fulfilled, in a secure manner that prevents its loss, misuse, or unauthorized access, in accordance with relevant regulations and guidelines.

The personal data rights

Under personal data protection law and its regulations, the data subject have the following rights:

• The right to be informed about the legal basis and the purpose of the Collection of the
• Personal Data.
• The right to access the personal data held by GAMI, to review it.
• The right to request access to his personal data available in a legible and clear format.
• The right to request correcting, completing, or updating their Personal Data held by GAMI.
• The right to have the personal data destroyed unless there is a legal provision specifying a particular retention period or contractual requirements.
• The right to withdraw the consent for the processing of the personal data at any time unless there are legitimate purposes requiring otherwise

How do we share the personal data

Personal data is share for legitimate purposes based on legal grounds or a justified operational need aimed at serving the interests of the GAMI, without harming national interests, the activities of entities, individual privacy, or environmental safety.

We work closely with several trusted entities and partners with whom we may need to share your personal data, in accordance with regulations, including:

• Entities and companies within the military industries system.
• Financial entities.
• Entities that assist in managing our operations and providing services.
• Government entities related to the GAMI operations.

In all cases where we share your personal data, we implement all necessary technical, organizational, administrative, and security measures to protect your personal data. Only the minimum necessary data will be share to achieve the processing purposes outlined in the Privacy Policy and Notice, in compliance with legal foundations.

Personal data transfer outside the Kingdom
According to the regulations, the personal data will be securely stored and processed within the
geographical borders of the Kingdom of Saudi Arabia to ensure the preservation of the national
sovereignty of this data, unless it comes under the cases of transferring or processing data outside the geographical borders of the Kingdom as outlined in Article (29) of the Saudi personal data protection law.

Legal basis for collecting and processing the personal data:

The personal data is collected and processed based on the consent unless there is another legal basis.

The Data Subject Rights

Data subject can exercise his/her rights by communicating with Personal Data Protection Officer (Data Management Office via email : dmo@gami.gov.sa

Complaints and inquiries

If there are any inquiry, complaint, or observation about the Privacy Policy and Notice, you can contact
the Data Management Office at GAMI via the Contact Us  via email: DMO@gami.gov.sa
You will receive a response within thirty days without delay, and this period may be extended if
unexpected or unusual effort is required, or if multiple requests are submitted by you, provided that the
extension does not exceed an additional thirty days.