Privacy Policy

D&I — Diyarah Development & Investment ("Diyarah", "we", "us") is a Saudi real-estate developer based in Riyadh, working across residential and commercial development and hospitality, and also operating the interior design studio D&I Design. This website and its design section belong to a single legal entity, and this policy covers both.

We are the Controller of the personal data collected through or because of this website. We process your data in accordance with the Personal Data Protection Law issued by Royal Decree No. M/19 dated 09/02/1443H (16 September 2021), as amended by Royal Decree No. M/147 dated 05/09/1444H (27 March 2023), together with its Implementing Regulations and related instruments (the "Law").

This is an informational website: it has no account registration, no input forms and no payment processing. The data we collect is therefore limited to the three categories below.

• Enquiry data — whatever you choose to send us by email, WhatsApp or telephone: your name, your contact details, the content of your enquiry, and any details you give about the project or unit you are asking about. You create this data in your own mail or WhatsApp client; we receive it only when you send it.
• Technical data collected automatically — as you browse: IP address, device, browser type and language, operating system, the pages you view and how long you spend on them, approximate city-level location, and the referring site. This comes from Google Analytics and from our host's server logs.
• Server logs — a record of the requests your browser makes to the site (pages and files, including brochures, unit imagery, floor plans and the 360° tours), together with the timestamp, request type and status, for operational and security purposes.

Is providing data mandatory? No. There is no required field anywhere on this site. Contacting us is entirely optional, and the only consequence of not doing so is that we cannot answer your enquiry. Technical data, however, is necessary to operate, secure and measure the site — and you can limit it by controlling cookies, as set out in section 4.

We collect data in two ways: directly from you, when you message us from your own email, WhatsApp or telephone; and indirectly and automatically, through analytics cookies and server logs while you browse. In both cases we apply data minimisation — we collect only what the stated purpose requires.

We will not subsequently process your data in a manner inconsistent with the purpose for which it was collected. If a different purpose arises, we will tell you and obtain your consent where the Law requires it.

We use Google Analytics 4 (measurement ID G-P6CV62C0GG) to understand visitor numbers and which pages are read most, so we can improve the site. Google Analytics sets cookies and collects the technical data described in section 2 in aggregated form, with partial IP masking where available. We retain this data for no longer than fourteen (14) months — the ceiling Google Analytics 4 allows for standard properties — after which Google deletes it automatically from its servers. We do not link that data to your identity and do not use it to build advertising profiles.

We place no advertising cookies, use no social-media tracking pixels, and serve no retargeted advertising. Our web fonts and the 360° tour viewer are self-hosted, so no third-party requests are made when a page opens other than to Google Analytics.

Your control options:

• From your browser: delete or block cookies entirely (Chrome: Settings → Privacy and security → Cookies; Safari: Preferences → Privacy).
• From Google: install the Google Analytics Opt-out Browser Add-on, which stops your activity being shared with Google Analytics on any site.
• By browsing in private or incognito mode, so no cookies persist after you close the session.

We disclose your data to the following recipients, each only as necessary:

We may also disclose your data to a party that acquires or merges with our business or assets, in which case we will notify you through this policy. All of our processors are contractually bound to protect your data and to process it only on our instructions.

Some of our providers — specifically Google (analytics), Meta/WhatsApp (messaging) and Cloudflare (hosting) — process data on infrastructure located outside the Kingdom of Saudi Arabia, generally in the United States. That means your technical data, and any message you send us over WhatsApp, may be processed or stored outside the Kingdom.

Any transfer or disclosure outside the Kingdom complies with Article 29 of the Law and with SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, and relies on the appropriate safeguards it sets out — the providers' data-processing terms, standard contractual clauses and binding common rules where applicable. We transfer only the minimum data necessary for the purpose, and we transfer no sensitive data.

This website is hosted on Cloudflare Pages, and your correspondence is stored in our approved mail and customer-relationship systems. Data travels over the internet encrypted with TLS across every part of the site.

• Access to your data is restricted to authorised staff who need it for their role, on a least-privilege basis.
• We apply organisational, administrative and technical measures against unauthorised access, alteration, disclosure or loss.
• We keep your data no longer than the purpose requires or the statutory retention period, whichever ends first.
• On destruction we permanently delete or de-identify the data so it cannot be reconstructed or retrieved, including from backups as they cycle.

No transmission over the internet is completely secure. We therefore recommend that you do not send national ID numbers or financial documents by email or WhatsApp unless we have expressly asked for them within an existing contractual relationship.

Under Article 4 of the Law you have the following rights over your personal data. Exercise them by writing to info@diyarah.sa, free of charge, and we will respond within thirty (30) days of receipt. We may ask you to verify your identity first, and we may decline a particular request where it conflicts with an existing legal obligation — in which case we will tell you why.

• Right to be informed — to know how your data is collected, the legal basis, how it is processed, stored, destroyed and to whom disclosed. This policy is that notice.
• Right of access — to request to see the personal data we hold about you.
• Right to request a copy — in a clear, readable and commonly used format where technically feasible, or as a printed copy.
• Right to correction — to ask us to correct, complete or update your data, which we will do and then confirm to you.
• Right to destruction — to ask us to destroy your data once it is no longer needed for the purpose collected.
• Right to withdraw consent — at any time, without affecting the lawfulness of earlier processing and without losing any service that the processing is not strictly needed for.
• Right to complain — to the competent authority, the Saudi Data & Artificial Intelligence Authority (SDAIA).
• Right to compensation — for material or moral damage suffered as a result of a breach of the Law.

If you object to how we process your data, or we fail to meet your request within the stated period, writing to info@diyarah.sa is the first step. We log the complaint and respond within thirty (30) days with the outcome.

If you are not satisfied with how we handled your complaint, or we do not respond within thirty (30) days, you may complain to the competent authority:

• Saudi Data & Artificial Intelligence Authority (SDAIA) — Digital City, Riyadh 12382, Kingdom of Saudi Arabia.
• Website: sdaia.gov.sa — Telephone: 8001221111.
• National Data Governance Platform: dgp.sdaia.gov.sa.

This website is intended for adults, and we do not knowingly collect personal data from anyone under eighteen. If you are under that age and have sent us data, we will delete it; a parent or guardian should contact info@diyarah.sa to let us know.

We review this policy periodically. Any amendment is published on this page with the "last updated" date and version number above revised. Where a change is material and affects your rights, we will notify you by an appropriate means before it takes effect. Continuing to use the site after publication constitutes awareness of the updated policy.

• Version 1.0 — 21 September 2026: first publication of this policy.

Related documents: our website Terms & Conditions, and the text of the Personal Data Protection Law and its Implementing Regulations published by SDAIA (sdaia.gov.sa).