How may Rihal collect your Personal Data?

Rihal may collect your Personal Data when you interact with the Website, such as when you use the Website, or contact us for support or other offerings. Other than Personal Data obtained directly from you, we may also obtain your Personal Data from external partners we deal with or are connected with, and from such other sources where you have given your consent for the disclosure of information relating to you, and/or where otherwise lawfully permitted or required.

How may Rihal use your Personal Data?

We may use your Personal Data for the following purposes:

• Contact you/respond to you regarding your requests, inquiries or complaints sent to Rihal in relation to the Website.
• Analyze, develop, improve, and optimize the use, function, and performance of the Website.
• Manage the security and operation of our sites, facilities, and networks and systems related to the Website.
• Keep you informed about our latest products, Websites and offers.
• Carry out any activity in connection with a legal, governmental, or regulatory requirement on us or in connection with legal proceedings, crime or fraud prevention, detection, or prosecution.
• Develop innovative and customized products and Websites by carrying out research and statistical analysis of customer use of the Website on an anonymous basis and Settling accounts with those who provide related Websites to us.
• Settling accounts with those who provide related Websites to us.

For the same purposes, we may also transfer your Personal Data outside the territory of the Sultanate of Oman, and you hereby grant us your consent for the same.

On what basis does Rihal process your Personal Data?

Rihal uses your Personal Data only when we have a valid legal basis to do so, and within the framework of transparency, honesty, and respect for human dignity. Rihal will rely on the consent provided by you for data processing activities, or the fact that processing is necessary to fulfill a contract with you, protect your vital interests or those of other persons, or to comply with applicable laws. We may also process your personal data where we believe it is in our or others’ legitimate interests, including to communicate adequately with you, to respond to your requests, to analyze, develop, improve, and optimize our sites, facilities, products, and Websites, and to maintain the security of our sites, networks and systems, or as legally required.

If you are a Data Subject providing your Personal Data to Rihal from within the European Union, UK, or other relevant jurisdictions, Rihal acknowledges that your data is being controlled and processed in line with the GDPR and other applicable laws, if you have questions about the legal basis, you can contact our Data Protection Officer at dpo@rihal.om

When and How Rihal may disclose your Personal Data?

As part of providing you with the Website and the management and/or operation of the same, we may be required or need to disclose your Personal Data to:

• Rihal’s affiliates, subsidiaries, contractors, or employees authorized to access your Personal Data only to the extent necessary to serve the applicable purpose(s) and to perform their job functions.
• Third-party Website providers (for example, payment processing Websites, e-mail delivery, auditing, and other similar Website providers) in order for those Website providers to perform business functions on behalf of Rihal.
• Relevant third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
• Law enforcement and Government agencies, such as to comply with applicable laws or legal process, or as requested by relevant governmental authorities, or for national security and/or law enforcement purposes.
• Other parties in respect of whom you have given your explicit consent.

When third parties are given access to Personal Data, we will take appropriate contractual, technical and organizational measures designed to ensure that Personal Data is processed only to the extent that such processing is necessary, consistent with this Privacy Policy, and in accordance with applicable laws.

How is your Personal Data protected and secured?

Rihal places utmost importance to implementing effective safeguards against data breach, enhancing data security, and limiting data transfer to what’s legally permissible.

We take reasonable industry standard efforts, including technical and organizational measures, to protect your Personal Data from misuse, unauthorized access or disclosure, and unlawful processing. However, considering that transmission of data over the Internet is not completely secure, we do not accept responsibility for any unauthorized access or loss of Personal Data that is beyond our commercially reasonable control.

In the event of a Personal Data breach, Rihal will report any data breaches within 72 hours of becoming aware of the breach to the relevant authority. If it is determined that a data breach may cause serious harm or poses a high risk to the rights or freedoms of Data Subjects, Rihal shall notify the Data Subjects within 72 hours of becoming aware of the breach.

Rihal will document all personal data breaches, state their causes and consequences of their occurrence, and the corrective measures or technical and organizational measures that have been taken. This record will be retained in accordance with the period stipulated by the relevant authority.

Rihal shall ensure before transferring any personal data outside the territory of the Sultanate of Oman to

1. Obtain explicit consent from data subjects.
2. Ensure that such transfer does not entail any activity threatening national security or state interests.
3. Ensure that the external processing party has an adequate degree of protection for personal data that is not less than the level of protection established under the PDPL.
4. Assess the level of protection provided by the external processing party and the risks of transferring the personal data.
5. Submit the evaluation report to the supervising ministry in the Sultanate of Oman if and when requested. Rihal’s international transfer of Personal Data collected in the European Economic Area, the United Kingdom, and Switzerland is governed contractually.

What are your rights as a data subject?

Rihal aims to ensure that data subjects can exercise their rights effectively and transparently in accordance with applicable laws. Data subjects have the following rights, subject to applicable jurisdiction, in respect of the processing of their Personal Data:

• Right to Access:

  you have the right to request access to your processed Personal Data. Upon request, we will provide information about the purposes of processing, categories of personal data processed, recipients of the data, and any other relevant details.

• Right to Rectification:

  you have the right to request the rectification of inaccurate or incomplete Personal Data. We will promptly correct any inaccuracies and ensure that the data is updated accordingly.

• Right to Erasure:

  you have the right to request the erasure of your Personal Data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or processed. However, in other circumstances Rihal may not be able to grant your request such as where Rihal is obligated to keep a record of your Personal Data to comply with applicable laws, protect its security concerns, protect privacy of others. (Please note that the exercise of this right may hinder your use of the Website as erasing your Personal Data relating to your account or payment details may render your use of the Website invalid)

• Right to Withdraw Consent:

  Where the processing of Personal Data is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Please note that the exercise of this right may hinder your use of the Website as withdrawing your Consent to process Personal Data relating to your account or payment details may render your use of the Website inoperable).

• Right to raise a Complaint:

  you have the right to file a complaint with the relevant supervisory authority if you believe that your rights under applicable laws have been infringed.

Sensitive and Children Personal Data

Sensitive Personal Data refers to Personal data relating to genetic data, biometric data, health data, ethnic origins, sexual life, political or religious opinions or beliefs, criminal conviction or security measures. Data processing of Sensitive Personal Data requires a special permit from relevant authorities. In case you are providing any sensitive information or uploading it though your use of or access to the Website, you are responsible for notifying us of such use and shall indemnify Rihal against any liability arising from or related to your use of any Sensitive Personal Data through the Website.

Children’s Personal Data refers to Personal Data relating to individuals under the age of 18, or as specified by law in their jurisdiction. Our Website does not address anyone under the age of 18, and we do not knowingly collect Children’s Personal Data. If You are a parent or guardian and you became aware that we have collected Personal Data from anyone under the age of 18 without parental consent, please contact us.

How long will Rihal retain your Personal Data?

Rihal will retain your Personal Data only for so long as necessary to fulfill the purposes for which it was collected as stated in this Privacy Policy, as may be required by law, or as otherwise communicated with you. Your Personal Data may be retained for a period after this time as necessary and relevant to our legitimate interests, our Terms of Use, and applicable laws, otherwise it will be deleted in accordance with applicable laws.

We may need to keep certain information after account disclosure for an additional period for legal and legitimate business purposes. For example, we may retain personal information such as your contact information (e.g., name, email address, physical address) and any invoices that Rihal has sent to you for tax and accounting purposes. If applicable, Rihal may also retain records of communications with you, as well as relevant logs for dispute resolution purposes. We further may keep records for preventing fraud and ensuring security, for example in case of misuse of our Websites or violation of our terms.

Changes and Updates to the Privacy Policy

By using the Website, you agree to the terms and conditions contained in this Privacy Policy and Terms of Use and/or any other agreement that we might have with you. Rihal reserves the right to modify or revise this Privacy Policy at any time in its sole discretion, for a variety of reasons including to reflect any changes to applicable laws, new regulatory requirements, or improvements and enhancements made to the Website. Any such modifications shall take effect immediately upon posting the revised Privacy Policy on the Website and shall apply and supersede any and all previous versions. You are responsible for reviewing the modified Terms periodically. It is your responsibility to periodically review the revised Privacy Policy. By continuing to use the Website after the revised Privacy Policy comes into effect, you agree to be bound by it.

Complaints, Questions and Additional Information

To express a concern, raise a question, make a complaint, or to obtain additional information about the processing of your Personal Data by Rihal in relation to the Website, the concerned individual should kindly contact Rihal’s Data Protection Officer:

• E-mail:

  dpo@rihal.om

• Address:

  Rihal HQ, Muscat, Oman.