Privacy Policy

Version 1 — draft for review (‎2026-10-12) · Effective date: To be completed: effective date

1. Who we are and the scope of this policy

Ghuramaa is a technology platform on which bankruptcy procedures in the Kingdom of Saudi Arabia are managed: bankruptcy trustees and their offices manage their cases on it, creditors submit their claims on it, and debtors see what concerns their procedure on it. It is operated by To be completed: the Company's legal name, commercial registration no. To be completed: CR number, national address To be completed: national address ("the Company" or "we").

This policy applies to:

• Office users: the office owner, the trustees and the assistants.
• Creditors, their agents and their representatives.
• Debtors and their representatives.
• Visitors to the public pages: office pages and procedure announcements.
• Anyone whose data appears in a procedure case, even if they are not a user: such as a known creditor before they register, persons related to the debtor, owners, buyers and experts.

It has been prepared under the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and its amendments, and its Implementing Regulation (Art. 12 of the Law, and Art. 4 of the Regulation).

2. Our role in processing your data

The Law distinguishes between the "controller", which decides the purpose and manner of processing, and the "processor", which processes data for the controller and on its behalf (Art. 1, paragraphs 18 and 19). We have two roles on the Platform:

So any request or question about data in a procedure case goes to the office managing it, and we pass it on to that office if it reaches us (section 9).

3. The data we process and its sources

a. Office users

Name, email, mobile number, role in the office, the trustee's licence number and its dates, login and two-factor verification data, login times, and what the user does on the Platform (activity log). The source is the user themselves, or the office owner when inviting them.

b. Creditors and their agents

• Identity and contact: name; national ID, iqama or commercial registration number; national address; email and mobile number.
• The claim: its amount, currency, cause, supporting evidence, security and documents.
• For an agent: the power of attorney details, its number and the document itself.
• In the case: the replies and objections the creditor submits, their login log, and the verification codes sent to their email.

Sources: the creditor or their agent; or the office, from the list of creditors the debtor submits and the documents of the opening request, or from publicly available sources such as Bankruptcy Commission announcements.

c. Debtors and their representatives

The debtor's name, ID or commercial registration, legal form, address and contact details, their documents, reports and response to the claims, and the data of their representatives and the users of their portal. The source is the debtor, or the office from the opening judgment and the procedure documents.

d. Others whose data appears in the case

Such as persons related to the debtor, jointly liable owners, buyers, experts and members of the creditors' committee — as far as the procedure requires. The source is the office, from the procedure documents.

e. Visitors to the public pages

We do not ask them for any data. What appears in a procedure announcement is published by the office under the Bankruptcy Law and its Regulation.

f. Technical data

IP address, browser type and request time in the security logs, and the session identifier in the necessary cookies (section 11).

Mandatory and optional:

• What is needed to submit a claim, accept an invitation or run the account is marked as required in its form, and the step cannot be completed without it; everything else is optional.
• We do not ask for sensitive data, and a claim asks only for what is needed to prove it.

4. Purposes and legal basis

We do not process your data for a purpose other than the one it was collected for, except where the Law allows it (Art. 10), and we tell you before doing so (Art. 4, paragraph 6, of the Regulation).

5. Disclosure and sharing

We do not sell or rent data.

Inside the Platform, your data is seen by:

• The procedure's office: the trustee and the office's users, only for its own case — one office cannot see another office's cases.
• The parties to the procedure, as far as the Bankruptcy Law decides:
  • The debtor sees the claims submitted in their case, unless the trustee withholds some of them by a reasoned confidentiality decision under Art. 10 of the Implementing Regulation of the Bankruptcy Law.
  • Each creditor sees the approved list, without the ID numbers and contact details of the other creditors.
• The public: what the office publishes in the procedure announcement.

Outside the Platform, it is disclosed to:

• The court, the Bankruptcy Commission and the bankruptcy register: the office submits to them what the Bankruptcy Law requires. This is a disclosure by the office, and the Platform is its tool.
• Service providers we use to provide the Platform — hosting, email delivery and text messages — as sub-processors, under contracts that require them to protect data in line with the Law (Art. 8; and Art. 17 of the Regulation). Their list: To be completed: providers' names and processing locations.
• Public authorities when they request it for security purposes, to apply a law, or to meet judicial requirements (Art. 15, paragraph 3).
• What the office or the user connects themselves: the API, webhooks, the AI provider, and the assistant connected through the MCP connection. Data in these goes wherever the office or the user chooses, at their own responsibility (sections 6 and 7).

6. Where data is processed, and transfer outside the Kingdom

The Platform is hosted, and its data is stored, in data centres inside the Kingdom. We do not transfer personal data outside the Kingdom, or disclose it to a party outside it, except under Art. 29 of the Law and the Regulation on Personal Data Transfer outside the Kingdom.

Any connection to a service outside the Kingdom that the office or the user decides on themselves — an AI provider that processes outside it, an assistant connected through the MCP connection, or a webhook address — is a transfer for which whoever decided on it is responsible (section 7).

7. Artificial intelligence and the MCP connection

Analysing claims with artificial intelligence is an optional feature:

• The office turns it on with its own account at the provider it chooses, and pays that provider directly.
• When an analysis is requested, the Platform sends that provider the claim data and documents, the debtor's response and the objections, and what was sent and its result are kept in the case.
• The provider may process the data outside the Kingdom. The office decides to turn it on as the controller, and is responsible for its legal basis and for the transfer.
• What the analysis produces is a draft that the trustee reviews, and no automated decisions are made on it.

The MCP connection:

• It lets an office user connect their AI assistant to the Platform, so that it can read what the user is allowed to read.
• What the assistant reads is processed by its provider — which may be outside the Kingdom — at the responsibility of whoever connected it.
• The assistant does not complete a binding action such as issuing a recommendation or submitting the list; the person entitled to it confirms it inside the Platform.

8. Retention period and destruction

• Procedure case data:
  • The office keeps it while the procedure lasts, then for at least five years after it ends. The trustee must keep a copy of the procedure records, correspondence and documents for this period (Art. 37 of the Rules Regulating the Work of Bankruptcy Trustees).
  • It is then destroyed or anonymised, except what must be kept for a pending case (Art. 18).
• Account data: while the account exists, then To be completed: the period after it is closed — unless it is linked to a procedure case that must be kept.
• Security and activity logs: To be completed: the period.
• Backups: renewed regularly, and destruction includes them (Art. 8, paragraph 2/c, of the Regulation).
• When an office's subscription ends: it receives its cases in a handover package, and they are then destroyed from the Platform in line with its agreement with us and the statutory retention periods.

9. Your rights and how to use them

Under Art. 4 of the Law, you have the right to:

1. Be informed of the legal basis and purpose of collecting your data — and this policy is part of that.
2. Access your data that we hold.
3. Obtain a copy of it in a readable and clear format.
4. Ask for it to be corrected, completed or updated.
5. Ask for the destruction of what is no longer needed.

You may also withdraw your consent where processing is based on consent alone, such as marketing messages (Art. 5, paragraph 2).

Limits on these rights, as set by the Law:

• Data that must be kept by law or for a pending case is not destroyed (Art. 18).
• Another individual's data is not disclosed, nor anything that would breach a professional obligation set by law or a judicial procedure or ruling (Art. 16; and Art. 5, paragraph 2, of the Regulation).
• Correcting what is in a procedure case — such as the claim amount or the trustee's recommendation — is done through the procedures of the Bankruptcy Law, not through a data correction request.

How to make a request:

• Send it by email to To be completed: data protection email, or to the Company's national address, or from your account page where this is available.
• We verify your identity before acting on it.
• We reply within thirty days. This may be extended by another thirty days if the request needs unusual effort, after we tell you of the extension and its reason (Art. 3, paragraph 1/a, of the Regulation).
• If it concerns data in a procedure case, we pass it to the office managing that case as the controller, and we tell you so.

Complaints: you may complain to the competent authority — the Saudi Data and AI Authority (SDAIA) — within ninety days of the incident or of when you learned of it (Art. 34 of the Law; and Art. 37, paragraph 1, of the Regulation).

10. Data security and breaches

Protection measures:

• Hosting inside the Kingdom.
• Encrypted connections to the Platform, and encryption of stored keys and secrets.
• Two-factor verification for office users, and a code sent by email for creditor login.
• Role-based permissions, and separation between the data of each office and between the parties to a case.
• An activity log that cannot be edited.
• Following the controls of the National Cybersecurity Authority (Art. 23 of the Regulation).

If a breach happens:

• Where we are the controller: we notify the competent authority within seventy-two hours of learning of it, if the breach could harm the data or its owners, and we notify those affected without undue delay (Art. 20 of the Law; and Art. 24 of the Regulation).
• Where we process data for an office: we notify the office without delay, so that it can take the steps it must take as the controller (Art. 17, paragraph 1/d, of the Regulation).

11. Cookies

We use only the cookies needed to run the Platform: to keep your session after login, to protect against request forgery, and to remember your login if you choose that. We do not use tracking, advertising or third-party analytics cookies.

12. Persons lacking legal capacity

The Platform is not aimed at persons who lack full legal capacity or have none. If the debtor or a creditor is such a person, their guardian exercises their rights on their behalf (Art. 3, paragraph 3, of the Regulation).

13. Updates to this policy

We publish each version with its effective date. We tell users of any material change before it takes effect, by email or inside the Platform.

14. Contact

• The Company: To be completed: legal name and national address
• Data protection email: To be completed: email
• Personal data protection officer, if appointed: To be completed: name and contact details