GoPay Personal Data Protection Policy

Principle One - AccountabilityThe privacy policy of the controlling entity must be defined and documented, approved by the entity's chief executive (or their delegate), and published to all parties involved in its implementation.

Principle Two - TransparencyA notice regarding the privacy policy and procedures of the controlling entity must be prepared, clearly and explicitly stating the specific purposes for which personal data is processed.

Principle Three - Choice and ConsentAll possible options for the personal data subject must be identified, and consent (express or implicit) obtained regarding the collection, use, or disclosure of their data.

Principle Four - Data Collection LimitationThe collection of personal data should be limited to the minimum necessary to achieve the purposes specified in the privacy notice.

Principle Five - Limitation of Data Use, Retention, and DisposalThe processing of personal data must be restricted to the purposes specified in the privacy notice for which the data subject gave their implicit or explicit consent, and it must be retained only as long as necessary to achieve the specified purposes or as required by applicable laws, regulations, and policies in the Kingdom, and disposed of in a secure manner that prevents leakage, loss, embezzlement, misuse, or unauthorized access.

Principle Six - Data AccessMeans must be identified and provided for data subjects to access their personal data for review, updating, and correction.

Principle Seven - Limitation of Data DisclosureData disclosure must be limited to parties specified in the privacy notice for which the data subject gave consent.

Principle Eight - Data SecurityPersonal data must be protected from leakage, damage, loss, embezzlement, misuse, modification, or unauthorized access, in accordance with National Cybersecurity Authority guidelines.

Principle Nine - Data QualityPersonal data must be kept accurate, complete, and directly relevant to the specified purposes.

Principle Ten - Monitoring and ComplianceCompliance with privacy policies and procedures must be monitored, and inquiries, complaints, and privacy-related disputes must be handled.