Privacy Policy and Notice

The General Authority for Military Industries (GAMI) is committed to protecting personal data by
applying the necessary administrative controls and technical measures in accordance with the relevant
laws, regulations, policies, and decisions.

Therefore, the Privacy Policy and Notice help personal data subjects understand the nature and type of data that the GAMI collects and processes and the purpose
for which it is processed and collected.

It is important that personal data subjects are aware of their rights regarding their personal data in
accordance with the relevant regulations and how GAMI and its partners use their personal data.
Your use of GAMI’s website means that you are informed and agree to what is stated in the Privacy
Policy and Notice and the continuous amendments made to it. We also encourage you to review the
Privacy Policy and Notice for any updates made to it.

Contact Information
Department: Data Management Office.
E-mail address: DMO@gami.gov.sa

Last update date
The last update on the Privacy Policy and Notice was on 14/05/2024.

What personal data is collected?
GAMI collects personal data to provide its services in accordance with its regulations including but not
limited to the following
• Account data: This may include login details such as usernames, and passwords and contact data such
as phone numbers, email addresses, and residential addresses.
• Technical data: This may include data collected through website logs, cookie files, or similar
technologies, including the Internet Protocol (IP) address used to connect the personal computer to the
Internet.
• Status identification data: This may include data about individuals benefiting from the services of
GAMI or its partners.
• Data electronically sent by other government entities to complete the authority’s procedures.
• Personal data provided to GAMI or its partners by other parties.
• Factory/company data.
• Investors’ data.

The purpose of collecting personal data
In accordance with its regulations, GAMI collects personal data to provide services and meet the
requirements as well as respond to inquiries from beneficiaries of GAMI services while developing and
improving the experience and ensuring the continuity of providing services with the required quality.

Methods of collecting the personal data
Some of the personal data we process obtained directly or indirectly through various means, which may
include:
• Services: When registering in the official channels of GAMI or its partners and using products or
services provided by GAMI or its partners.
• Communication: When communicating with GAMI or its partners through various electronic and non-
electronic channels.
• Surveys: When conducting surveys, personal data may be collected for analysis and research purposes,
to develop the services provided by GAMI or its partners and enhance customer experience. We may
request additional information to meet developmental requirements.
• The personal data is collected indirectly through cookies when visiting GAMI’s website.
• Other entities in accordance with regulations and compliance with the law.

How do we use the personal data
GAMI uses personal data to provide its services in accordance to its regulations that includes but not
limited to the following:
• To ensure the provision of services by GAMI or its partners and fulfilling their requirements.
• To resolve inquiries and complaints from beneficiaries of GAMI services or its partners.
• To understand the preferences of beneficiaries and thereby improving services and customer
experience.
• To analyze data and national statistics and create internal reports.
• To complete the internal procedures and internal operations within GAMI and external entities.

How do we store and destroy personal data
The personal data is stored securely by adhering to key national principles for protecting personal data
within the geographical boundaries of the Kingdom of Saudi Arabia. This is to ensure the preservation of
national sovereignty over this data unless there are cases of data transfer or processing outside the
geographical boundaries of the Kingdom; provided that personal data is destroyed securely once the
purpose of its collection is fulfilled, in a secure manner that prevents its loss, misuse, or unauthorized
access, in accordance with relevant regulations and guidelines.
Legal basis for collecting and processing the personal data
The personal data is collected and processed based on the consent unless there is another legal basis.

The personal data rights
Under personal data protection law and its regulations, the data subject have the following rights:
• The right to be informed about the legal basis and the purpose of the Collection of the
• Personal Data.
• The right to access the personal data held by GAMI, to review it.
• The right to request access to his personal data available in a legible and clear format.
• The right to request correcting, completing, or updating their Personal Data held by GAMI.
• The right to have the personal data destroyed unless there is a legal provision specifying a particular
retention period or contractual requirements.
• The right to withdraw the consent for the processing of the personal data at any time unless there are
legitimate purposes requiring otherwise.

How do we share the personal data
The personal data may be shared for legitimate purposes based on legal grounds or practical needs
aimed at achieving GAMI interests or public interests without causing harm to national interests, the
activities of entities, individual privacy, or environmental safety—excluding data and entities excluded
by royal orders.

Personal data transfer outside the Kingdom
According to the regulations, the personal data will be securely stored and processed within the
geographical borders of the Kingdom of Saudi Arabia to ensure the preservation of the national
sovereignty of this data, unless it comes under the cases of transferring or processing data outside the
geographical borders of the Kingdom as outlined in Article (29) of the Saudi personal data protection
law.

The Data Subject Rights
Data subject can exercise his/her rights by communicating with Data Management Office via email:
dmo@gami.gov.sa.

Personal Data Protection Officer
Data Management Office at GAMI
Email: dmo@gami.gov.sa

Complaints and inquiries
If there are any inquiry, complaint, or observation about the Privacy Policy and Notice, you can contact
the Data Management Office at GAMI via the contact form or via email: DMO@gami.gov.sa
You will receive a response within thirty days without delay, and this period may be extended if
unexpected or unusual effort is required, or if multiple requests are submitted by you, provided that the
extension does not exceed an additional thirty days.