SCENE CINEMA PRIVACY NOTICE

SEVEN Saudi Entertainment Ventures referred to as " SEVEN," is a subsidiary owned by Qiddiya Investment Company (also denoted as “SEVEN”," us", "we", or "our”) is committed to respecting and protecting the data privacy of your personal or sensitive data in accordance with the applicable laws and regulations, including but not limited to the Kingdom of Saudi Arabia(the “Kingdom”) Personal Data Protection Law (“KSA PDPL”) and its Implementing Regulations (the “Regulations”).

At SEVEN, we want you to understand the information we collect, how we use it, and how we share it. Therefore, we encourage you to read our Privacy Notice to understand our practices regarding your personal data.

In this Privacy Notice, we explain how we collect, use, share, retain, and transfer personal data, as well as outline your rights. Each section includes helpful examples and simple language to make our practices easier to understand. For your convenience, we have divided the Notice into sections and will continue to make improvements.

If you have any concerns or questions about how we look after your personal data, contact our Data Protection Officer at the following email address [email protected]

The entity responsible for your personal data is SEVEN, whose registered office is located at Building S3, Riyadh Front 8942 – King Khalid International Airport, RIYADH – 13413 – 3670-Kingdom of Saudi Arabia, Tel: +966 11 219 6444. If you are interacting with a Qiddiya affiliate or subsidiary, that affiliate may also act as a controller or joint controller.

As a business entity operating in Saudi Arabia, we adhere to the laws of the Kingdom along with other applicable international laws and regulations.

Personal data means any information about an individual from which that person can be identified.

Individuals engaging with SEVEN Scene Cinema:

SEVEN may collect and obtain the following types of personal data when users directly interact with our website and register with us:

  1. Personal identifiers: such as your first and last name, email address, phone number, gender, date of birth, nationality.
  2. Location data: such as country, region, city, district, and localization data.
  3. Device and Technical data: such as your device category, device model, operating system and version, browser type, screen resolution, app version, platform, and language settings.
  4. Website Usage Information: such as pages viewed, average engagement time, scrolls, clicks, video engagement, events, session duration, traffic source exit page, conversion events, and traffic source.
  5. Preference and Interest Information: such as your interests, subscription information, and communication or reachability preferences.
  6. Transaction Information: such as transaction ID, cart activity, items purchased, and revenue-related information associated with your transactions.

Failure to provide the required personal data may limit our ability to respond to inquiries, manage website activities, provide requested information or support, and communicate effectively with you. It may also affect our ability to tailor our services and communications and provide relevant business activities.

We collect your personal data as follows:

• Information you give us: Directly from you when you:

  1. request or purchase products, services or information from us, register with us, call our service numbers, or otherwise interact with us.
  2. submit information by filling in online forms, by corresponding with us.

• Information collected automatically: Indirectly via:

  1. certain technologies, such as cookies, pixels, tags, APIs, including when you visit our websites and applications; or
  2. collect information using analytics tools, including when you visit our sites or use our applications.

If you provide SEVEN with Personal Data belonging to another individual, you are requested to inform that individual about this Privacy Notice and ensure they are aware of how their Personal Data may be processed by SEVEN.

At SEVEN, we may process the above types of personal data collected in connection with SEVEN’s Website according to the lawful basis for processing personal data, and we rely on your consent for the following activities:

  1. Direct marketing and advertising: when we promote SEVEN services to you based on your interests and behavior including marketing and promotional activities, targeted announcements relating to events, newsletters or alerts. You can ask us to stop sending you marketing communications at any time by contacting us at [email protected] or following the opt-out links in our marketing communications. If you opt-out of receiving marketing communications, you will still receive service-related communications that are necessary for customer service purposes.

If any activity has relied on your consent, you may withdraw that consent at any time. If you decline to provide personal data, we may be unable to provide you with the relevant service or offering as described above.

We rely on legitimate interests for the following activities:

  1. To administer, operate and maintain our business and our website.
  2. To manage and maintain user accounts and provide access to our platform and services.
  3. To operate, understand and enhance our services, maintaining our customer relationships and offering you better experience.
  4. To communicate with you in relation to your use of our services, including responding to inquiries and providing service-related updates.
  5. To ensure the security of our website and systems, we monitor access and usage to confirm proper platform use, as well as to detect, investigate, and prevent activities that may violate our policies, pose safety risks, or involve fraud or illegal behavior.

We will only process your personal data for the purposes for which it was originally collected, unless we reasonably consider that we need to process it for another reason and that reason is compatible with the original purpose. Should we need to use your personal data for an unrelated purpose, we will inform you accordingly and a clear explanation of the legal basis that permits such processing will be provided.

We take our responsibility to protect your personal data very seriously. Although we do our best to protect your personal data, we cannot guarantee the security of your information transmitted through the Website, over email or any other digital channel; any transmission is at your own risk.

Additionally, third parties processing your personal data do so only under our instructions and are contractually obligated to treat your data confidentially and maintain its security.

SEVEN will retain your Personal Data for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

The retention period for each category of personal data depends on the nature of the information, the activities involved, the jurisdictions in which we operate, and the relevant legal or regulatory requirements. When Personal Data is no longer required, we securely dispose of, anonymize, or de-identify it.

We may retain your data longer to meet legal or regulatory requirements, such as for audits, handling complaints, legal proceedings, or regulatory requests. In exceptional cases, this retention period may be extended further due to court orders, investigations, or official directives to preserve necessary evidence or documentation.

We may disclose your personal data to third parties for the purposes set out above, including to the following third parties:

  1. With our subsidiaries, affiliates, and entities within the Qiddiya corporate family, where necessary for the purposes described in this Privacy Notice.
  2. With our service providers performing services on our behalf. These companies are prohibited from using your personal data for purposes other than those requested by us or as required by law.
  3. With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
  4. With third parties to ensure the safety and security of our customers and third parties, to protect our rights and property and the rights and property of our customers and third parties, to comply with legal processes, or in other cases if we believe in good faith that disclosure is required by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

The data that we collect from you may be accessed from, transferred to, and stored and used in countries outside the Kingdom, by us and by our third-party service providers or partners. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice.

Where legally required under the KSA PDPL and Regulations, transfers of personal data outside the Kingdom will take place to jurisdictions deemed to provide an adequate level of protection for personal data by the relevant competent authority in the Kingdom or alternatively will take place on the basis of an appropriate safeguard or exception.

It is important for SEVEN that the personal data that we hold about you is accurate and up to date. Please notify us promptly if any of your personal data changes during your relationship with us.

You have the following rights in relation to your personal data, under the KSA Personal Data Protection Law (PDPL) and its Implementing Regulations:

  1. The right to be informed: You have the right to be provided with information about how we use your personal data, and about your rights.
  2. The right to access: You have the right to access your personal data held by us.
  3. The right to obtain a copy: You have the right to obtain a copy of your personal data held by us.
  4. The right to request rectification: You can request the correction or update of any incomplete, inaccurate, or outdated personal data that SEVEN has collected.
  5. The right to request erasure: You have the right to request the deletion of your personal data collected by SEVEN, including any data shared with third parties. However, please note that SEVEN may retain such information in accordance with applicable laws and regulations.
  6. The right to withdraw consent: You have the right to withdraw your consent to the processing of your personal data by SEVEN – at any time – except if there are legitimate purposes that require otherwise.
  7. The right to file a complaint: You have the right to file complaint to the competent authority when you feel that your rights have not been met.

Unless required by law, you will not incur any fees for exercising this right.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We will try to respond to all legitimate requests within 30 days of receiving it, however, it may take us longer if your request is particularly complex.

You can exercise any of these rights, ask questions about how we use personal data, or complain by contacting us as follows:

You may submit a request to exercise your rights by filling out the Data Subject Request Form online or by emailing [email protected] with the same information requested in the Data Subject Request Form

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. Your rights may also depend on the jurisdiction in which you reside.

TIn accordance with applicable laws, we may process the Personal Data of data subjects who fully or partially lack legal capacity, such as minors under the age of 18 and persons deemed incompetent under the laws of the Kingdom of Saudi Arabia, only with the verified explicit consent of their legal guardian. We will take appropriate steps to verify the identity and legal authority of the guardian. The legal guardian may exercise the rights of the minor or incompetent person under the PDPL and its Implementing Regulations, ensuring that this process does not harm their interests and that they can exercise their rights upon attaining legal capacity themselves.

Furthermore, recognizing the need for additional privacy protections for children, if we collect personal data of a child under 18 through our website, we will process such data solely to directly respond to the user’s request and will not use it for any other purposes. The child’s data will not be processed without notifying the child’s parent or guardian of the request, except where there is a legal justification for processing specified by applicable law, regulations, or for security reasons.

While we take reasonable steps to protect your personal data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access to your personal data you may be aware of.

We may use your phone number only to send messages related to park updates, ticket purchases, and account notifications. We do not share or sell your phone number or consent data to third parties or affiliates for marketing. You can opt out anytime by replying STOP or text HELP for help.

From time to time, we may modify or update this Privacy Notice, including reflecting changes in our privacy practices and legal obligations or in accordance with applicable data protection laws and regulations. We will note on our website when our Privacy Policy has been updated. Please check the Website regularly for notices of changes to our Privacy Policy.

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Policy, the English language version will prevail.

This is version 1.2 of the SEVEN Website Privacy Notice, published DD-MM-YYY.