English Version

NEFAYA

Privacy Policy

Operated by Visible Twin Co.

Version 1.0 | Effective date: 1-july-2026

Contents

• 1. Introduction and Scope
• 2. Who We Are (Controller)
• 3. Personal Data We Collect
• 4. How We Collect Personal Data
• 5. How and Why We Use Personal Data, and Legal Basis
• 6. Location Data
• 7. How We Share Personal Data
• 8. International Transfers
• 9. Cookies and Similar Technologies
• 10. Data Retention
• 11. Security
• 12. Your Rights
• 13. Children's Data
• 14. Marketing and Communications
• 15. Automated Decision-Making
• 16. Third-Party Links and Services
• 17. Changes to this Policy
• 18. Contact and Complaints
• Annex — Notes for Counsel

1. Introduction and Scope

1.1 This Privacy Policy explains how Visible Twin Co. ("the Company", "we", "us", or

"our") collects, uses, shares, and protects personal data when you use the Nefaya

application, website, and related services (the "Platform").

1.2 It applies to Customers, Providers, their personnel, and visitors to the Platform. It should

be read together with our Terms and Conditions.

1.3 We process personal data in accordance with the Personal Data Protection Law of the

Kingdom of Saudi Arabia (the "PDPL") and its implementing regulations, which are

overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), and with other

data-protection laws applicable where we operate.

2. Who We Are (Controller)

2.1 Visible Twin Co., of 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia, is the controller responsible for your

personal data, except where we act as a processor on behalf of a Provider or other

business User.

2.2 For privacy queries or to exercise your rights, contact our data protection officer: Mostafa kamel, mkamel@nefaya.com, 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia.

3. Personal Data We Collect

3.1 Depending on how you use the Platform, we may collect the following categories of

personal data:

(a) Identity and account data — name, username, date of birth or age confirmation,

and profile details; and, for Providers, business name, commercial registration and

licence numbers, and authorised-representative details;

(b) Contact data — email address, telephone number, and billing and service

addresses;

(c) Booking and transaction data — Orders, Containers, locations, Hire Periods,

history, and communications relating to Orders;

(d) Payment data — payment-method details processed by our payment service

provider (we do not store full card numbers), billing records, and Provider payout

details;

(e) Location data — precise and/or approximate geolocation from your device (where

you grant permission) and the service addresses you provide, used for delivery,

collection, routing, and job tracking;

(f) Device and technical data — IP address, device identifiers, operating system, app

version, and log, diagnostic, cookie, and similar data;

(g) Usage data — information about how you interact with the Platform;

(h) Communications and content — in-app messages, ratings, reviews, photographs

(for example of waste, sites, or Containers), and support correspondence;

(i) Verification and compliance data — KYC, licence, and insurance documents

provided by Providers, and fraud-prevention signals; and

(j) Marketing preferences.

4. How We Collect Personal Data

4.1 We collect personal data: (a) directly from you, when you register, place or accept

Orders, communicate with us, or submit Content; (b) automatically, through your use of

the Platform and your device; and (c) from third parties, such as payment service

providers, identity- and licence-verification providers, analytics providers, and, for a

Provider's personnel, from the Provider.

5. How and Why We Use Personal Data, and Legal Basis

5.1 We use personal data for the following purposes, relying on the legal bases indicated

(terminology to be aligned by counsel with the PDPL implementing regulations):

(a) to create and manage your account — performance of a contract;

(b) to facilitate Orders and enable Customers and Providers to transact and

communicate — performance of a contract;

(c) to process payments and remit Provider payouts — performance of a contract and

compliance with a legal obligation;

(d) to provide location-based delivery, routing, and job tracking — performance of a

contract and, for device location, your consent;

(e) to verify Providers and prevent fraud — our legitimate interests and compliance

with a legal obligation;

(f) to provide support and handle disputes — performance of a contract and our

legitimate interests;

(g) to maintain, secure, and improve the Platform — our legitimate interests;

(h) to comply with legal, tax, environmental, and regulatory obligations — compliance

with a legal obligation; and

(i) to send marketing communications — your consent and/or our legitimate interests,

with an opt-out.

6. Location Data

6.1 With your permission, we collect device location to show nearby Providers, enable

accurate delivery and collection, route Providers, and, for Providers and drivers, track

jobs in progress.

6.2 You can control location permissions through your device settings. Disabling location

may limit the functionality of the Platform.

6.3 A Provider's or driver's location may be shared with the relevant Customer to the extent

needed to fulfil an Order, and a Customer's service location is shared with the assigned

Provider for the same purpose.

7. How We Share Personal Data

7.1 We share personal data with:

(a) the other party to an Order — Customers and Providers receive the information

needed to perform the Provider Services, such as name, contact details, address,

location, and Order details;

(b) payment service providers, for payment processing and payouts;

(c) service providers and processors — including cloud hosting, IT, analytics,

communications, customer support, and identity- and licence-verification providers,

under appropriate contracts;

(d) professional advisers — including legal, accounting, and insurance advisers;

(e) authorities and regulators — where required by law, or to establish, exercise, or

defend legal rights, or to protect safety and property;

(f) acquirers and investors — in connection with a merger, acquisition, financing, or

sale of assets; and

(g) members of our group.

7.2 We do not sell personal data.

8. International Transfers

8.1 Where we transfer personal data outside the Kingdom of Saudi Arabia, we do so in

accordance with the PDPL and its rules on cross-border transfer, applying appropriate

safeguards and relying on consent or another lawful basis where required.

9. Cookies and Similar Technologies

9.1 We and our partners use cookies, software development kits (SDKs), pixels, local storage, and similar technologies (together, "Cookies") on our website and within the Platform.

9.2 We use the following categories of Cookies:

(a) Strictly necessary — required to operate the Platform, authenticate you, maintain your session, and keep it secure; these cannot be switched off;

(b) Functional — remember your preferences, such as language and display settings;

(c) Analytics and performance — help us understand how the Platform is used so we can improve it; and

(d) Marketing — used, where you consent, to measure and personalise communications and advertising.

9.3 Strictly necessary Cookies are set on the basis of our legitimate interest in operating a secure Platform. Cookies that are not strictly necessary are set only where consent is required and you have given it.

9.4 You can manage non-essential Cookies at any time through your browser or device settings. Disabling some Cookies may affect the functionality of the Platform.

9.5 The Platform does not currently operate a cookie consent banner. The website uses only storage that is strictly necessary to serve the site, and the mobile apps use device storage rather than cookies. We do not use advertising, analytics, or tracking cookies.

10. Data Retention

10.1 We retain personal data only for as long as necessary for the purposes set out in this

Policy, including to provide the Platform, to comply with legal, tax, accounting, and

regulatory obligations, to resolve disputes, and to enforce our agreements. Retention

criteria include the nature of the data, applicable legal requirements, and limitation

periods. We then securely delete or anonymise the data.

11. Security

11.1 We implement appropriate technical and organisational measures to protect personal

data, including encryption in transit, access controls, and monitoring. No method of

transmission or storage is completely secure. We maintain procedures to address

suspected personal-data breaches and will notify you and the competent authority where

required by law.

12. Your Rights

12.1 Subject to the PDPL and applicable law, you have the right to: be informed about how we

process your personal data; access your personal data; request the correction of

inaccurate or incomplete data; request the deletion of your data in certain circumstances;

withdraw consent where processing is based on consent; and, where applicable, request

that we transfer certain data to you or another party.

12.2 To exercise your rights, contact us at myprivacy@nefaya.com. We will respond within the period

required by applicable law. If you are not satisfied, you may lodge a complaint with the

competent authority (SDAIA).

13. Children's Data

13.1 The Platform is not directed to children, and you must be at least 18 years old to use it.

We do not knowingly collect the personal data of children. If we become aware that we

have collected such data, we will delete it.

14. Marketing and Communications

14.1 We may send you service messages that are necessary to operate the Platform. We

send marketing communications only where permitted, and you can opt out at any time

using the unsubscribe link in the message, or by turning off notifications in Settings inside the Nefaya app.

15. Automated Decision-Making

15.1 We do not make decisions producing legal or similarly significant effects about you based

solely on automated processing without a lawful basis and appropriate safeguards.

Where we use automated tools (for example, for fraud detection or matching), human

review is available where required by law.

16. Third-Party Links and Services

16.1 The Platform may link to or rely on third-party services (for example, payment service

providers and mapping services). Their processing of personal data is governed by their

own privacy policies, and we are not responsible for their practices.

17. Changes to this Policy

17.1 We may update this Policy from time to time. The "Effective date" indicates the latest

version, and we will notify you of material changes through the Platform or by other

reasonable means.

18. Contact and Complaints

18.1 Visible Twin Co., 15b, Ash Shulah Dist.1, Dammam, Saudi Arabia. Privacy contact / data protection officer:

Mostafa Kamel, mkamel@nefaya.com. The competent supervisory authority is the Saudi Data and

Artificial Intelligence Authority (SDAIA).

Annex — Notes for Counsel

Confirm or adjust the following before publication:

• Align all legal-basis terminology in clause 5 with the PDPL and its implementing

regulations.

• Confirm whether a Data Protection Officer must be appointed and named.
• Confirm the cookie-consent approach and whether a separate Cookie Policy is required.
• Confirm the data-localisation position and the lawful mechanism for any cross-border

transfer (clause 8).

• Confirm the minimum age and any parental-consent requirements (clause 13).
• Confirm breach-notification timeframes and the controller/processor split where the

Company processes on behalf of business Users.

• Issue in English and Arabic, and confirm which language prevails.
• Complete all bracketed contact, retention, and security details.