Effective date: 11 May 2026 Last updated: 11 May 2026

This Privacy Policy explains how TDG ("The Development Group", "we", "us", or "our") collects, uses, shares, and protects personal data when you interact with us, visit our website (the "Website"), or otherwise engage with our business.

It should be read alongside our Cookie Policy, which explains how we use cookies and similar technologies, and our Terms of Service, which govern your use of the Website.

We are committed to protecting your privacy and handling your personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, issued by Royal Decree M/19, and its implementing regulations.

1. Who we are

The Development Group is a real estate development company established in the Kingdom of Saudi Arabia. For the purposes of this policy, TDG is the data controller responsible for the personal data we collect and process.

If you have questions about this policy or wish to exercise your rights, please contact us at info@tdg.sa.

2. Personal data we collect

We collect personal data in the following ways:

2.1 Information you provide directly

This includes information you give us when you:

• Submit a contact form or enquiry through the Website

• Apply for a position with us through our careers channels

• Register for an event, briefing, or site visit

• Subscribe to updates or communications from us

• Correspond with us by email, telephone, or in person

• Enter into a commercial relationship with us as a customer, supplier, partner, or counterparty

The information may include your name, contact details, employer or company, job title, areas of interest, CV or professional history, and any other information you choose to share.

2.2 Information collected automatically

When you visit the Website, we automatically collect certain technical information, including IP address, device type, browser type, operating system, referring page, pages visited, time and duration of visit, and similar usage data. This is collected through cookies and similar technologies, as described in our Cookie Policy.

2.3 Information from third parties

We may receive personal data about you from third parties, such as business partners, recruitment agencies, professional service providers, public registries, or publicly available sources. We will only use such information for legitimate business purposes and in line with applicable law.

2.4 Sensitive personal data

We do not seek to collect sensitive personal data (such as health information or biometric data) through the Website. If we need to process sensitive personal data for a specific purpose, we will inform you and obtain your explicit consent where required by law.

3. How we use personal data

We use personal data for the following purposes:

• Responding to your enquiries and requests

• Processing job applications and recruitment activity

• Managing relationships with customers, suppliers, partners, and counterparties

• Conducting due diligence, compliance checks, and know-your-counterparty processes

• Operating, maintaining, and improving the Website

• Sending updates, project information, or other communications you have requested or consented to receive

• Producing aggregated insights and analytics about how the Website is used

• Complying with legal, regulatory, and contractual obligations

• Protecting our rights, property, and legitimate interests, and those of our employees, partners, and others

• Detecting, preventing, and responding to fraud, security incidents, and misuse of the Website

We process personal data only for the purposes for which it was collected, or for purposes that are compatible with those, unless we obtain your further consent or are required by law.

4. Legal basis for processing

We process personal data on one or more of the following legal bases:

• Consent, where you have given clear consent for a specific purpose, such as receiving marketing communications

• Performance of a contract, where processing is necessary to enter into or carry out a contract with you or your organisation

• Legal obligation, where processing is necessary to comply with a legal or regulatory requirement

• Legitimate interests, where processing is necessary for our legitimate business interests, provided these do not override your rights and interests

Where we rely on consent, you may withdraw it at any time by contacting us at info@tdg.sa. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Sharing personal data

We do not sell personal data. We may share personal data with the following categories of recipients:

• Group companies and affiliates, for the purposes described in this policy

• Service providers, such as IT, hosting, communications, analytics, recruitment, professional advisors, and similar providers who process personal data on our behalf

• Business partners and counterparties, where necessary for a specific transaction, project, or commercial relationship

• Regulators, courts, and authorities, where required by law or to protect our legal rights

• Acquirers or successors, in the event of a corporate transaction such as a merger, acquisition, or restructuring

We require all third parties that process personal data on our behalf to do so under written arrangements that protect the confidentiality and security of the data, and only for the purposes we specify.

6. International transfers

Most of our processing takes place within the Kingdom of Saudi Arabia. Where we transfer personal data outside the Kingdom, we do so only in accordance with the PDPL and its implementing regulations, and we put in place appropriate safeguards to protect the data. This may include obtaining your consent, transferring data to jurisdictions with adequate protection, or using contractual safeguards approved by the competent authority.

7. How long we keep personal data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, tax, accounting, or reporting requirements.

When personal data is no longer needed, we securely delete, anonymise, or archive it in accordance with our retention policies and applicable law. The retention period depends on the type of data, the purpose for which it was collected, and the applicable legal requirements.

8. How we protect personal data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include access controls, encryption where appropriate, secure storage, staff training, and regular review of our security practices.

No method of transmission over the internet or method of electronic storage is completely secure. While we work to protect personal data, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in harm to you, we will notify you and the competent authority in accordance with applicable law.

9. Your rights

Under the PDPL, you have the following rights in relation to your personal data:

• Right to be informed about how your personal data is collected and used

• Right of access to the personal data we hold about you

• Right to request correction of inaccurate or incomplete personal data

• Right to request deletion of your personal data, where the conditions in the law apply

• Right to request transfer of your personal data to you or to another controller, in a structured and commonly used format

• Right to withdraw consent, where processing is based on consent

• Right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA)

To exercise any of these rights, please contact us at info@tdg.sa. We will respond within the timeframes required by law. We may need to verify your identity before processing your request.

Some of these rights are subject to conditions and exceptions under the PDPL. We will explain if any apply to your request.

10. Children's data

The Website is not directed to children, and we do not knowingly collect personal data from individuals under the age of 18. If you believe a child has provided us with personal data, please contact us at info@tdg.sa and we will take appropriate steps to delete it.

11. Third-party websites

The Website may contain links to third-party websites. This policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated through the Website or by direct notice where appropriate. We encourage you to review this page periodically.

13. Contact us

For any questions about this Privacy Policy, or to exercise your rights, please contact us at: info@tdg.sa

If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).