Personal Data Protection Law (PDPL) — Saudi Arabia

Privacy Policy

Last updated: 2026 — preliminary draft pending approval by a licensed legal counsel before launch.

1. Data controller

The IN2WIN platform is operated by its owning/operating entity (THINK2DO and its authorized delegates). Your data is processed in accordance with the Saudi Personal Data Protection Law and its implementing regulations issued by the Saudi Data & AI Authority (SDAIA).

2. Data we collect

Mobile number or email (for sign-in), optional name, scan/points/draw history, device identifier and approximate location range (for fraud prevention only), and notification settings. We do not knowingly collect sensitive data or data from children under 18.

3. Basis and purposes of processing

We process your data based on your consent and to deliver the service: running the contest, calculating points, managing draws, sending service notifications, improving the experience, and protecting the platform. We do not make automated decisions with legal effect on you without human intervention.

4. Data sharing

Limited data is shared with participating merchants when you interact with them (such as completing a scan or using an offer), and with messaging and hosting providers as necessary. Any analytics shared are aggregated and anonymized (without personal identification). We do not sell your personal data.

5. Data storage location & transfer

We store personal data within the Kingdom of Saudi Arabia. Any transfer outside the Kingdom is subject to the controls of the law and its regulations, and Authority approvals where required.

6. Retention period

We retain data for as long as necessary to provide the service and meet regulatory obligations, after which it is deleted or de-identified.

7. Your rights

You have the right to: be informed, access your data and obtain a copy of it, correct it, delete it, and withdraw your consent. To exercise your rights or file a complaint: privacy@in2win.net. You also have the right to appeal to the Authority (SDAIA).

8. Security

We use encryption in transit, optional two-factor authentication, access controls, and monitoring to prevent fraud.

⚠️ This is a guidance draft prepared for working purposes and is not legal advice. It must be reviewed and approved by a licensed attorney in the Kingdom before publishing to users.