Privacy Policy

1Introduction

Banque Saudi Fransi ("BSF", "we", "us", or "our") is committed to protecting the privacy and security of users of the Mutasil mobile application ("Mutasil").

This Privacy Policy explains how Mutasil collects, accesses, processes, uses, stores, and protects personal, technical, and usage information when authorized BSF employees use the application.

Mutasil is an internal employee application designed to provide authorized BSF employees with access to business and product information, learning content, internal communications, announcements, surveys, assessments, tools, calculators, documents, and other internal services and features.

2Application Owner and Contact Information

Mutasil is developed and managed on behalf of:

Banque Saudi Fransi (BSF)

For questions, concerns, or requests relating to privacy or the processing of personal information through Mutasil, please contact:

3Authorized Users

Mutasil is intended for authorized BSF employees and other users specifically authorized by BSF.

Mutasil does not provide public registration or allow users to independently create accounts.

User identity and authorization are verified through BSF's internal Identity and Access Management (IAM) environment.

4Authentication and Identity Verification

To access Mutasil, the employee provides their Employee ID, which is verified through BSF's internal Identity and Access Management (IAM) system.

Following successful verification, the employee information required by Mutasil is retrieved from BSF's authorized internal systems to establish the user's profile and provide the appropriate application access and experience.

The employee's registered mobile number is used to deliver a One-Time Password (OTP) as part of the authentication process.

Mutasil does not independently create public user accounts. Employee identity verification relies on BSF's authorized internal identity-management environment.

5Information We Collect and Process

Mutasil collects and processes information necessary to authenticate users, provide application functionality, maintain security, communicate with employees, monitor application performance, troubleshoot technical issues, and improve the service.

5.1 Employee Profile Information

Employee profile information is retrieved from BSF's authorized internal systems and may include:

• Employee ID
• Full name
• Department
• Business unit and organizational information
• Job title or designation
• Region or work location
• Registered mobile number
• Email address

This information is used to identify the employee, establish and maintain the employee's Mutasil profile, determine appropriate application access and content, and support relevant Mutasil functionality.

The employee's registered mobile number is also used to deliver the OTP required during authentication.

5.2 Device and Technical Information

Mutasil collects technical information relating to the device and application session, including:

• Device type
• Operating system
• Device ID / UUID
• IP address
• Push notification token
• Application version
• Technical and security logs

This information is used for application operation, security, access management, notifications, troubleshooting, technical support, and application performance monitoring.

5.3 Location Information

Mutasil collects the device's precise geographical location, including latitude and longitude, during designated application activities, including login and logout.

Location information is used for authorized security, access monitoring, compliance, and audit purposes.

Where required by the device operating system, Mutasil requests the applicable location permission before accessing precise location information.

5.4 Usage and Activity Information

Mutasil processes information generated through the employee's use of and interaction with the application, including, where applicable:

• Survey responses
• Ratings and feedback
• Notes
• Todo items
• Sticky notes
• Files and attachments submitted through Mutasil
• Learning and assessment activity
• Application feature usage
• Other information entered or generated by the employee while using Mutasil

This information is used to provide Mutasil functionality and support authorized internal business, learning, communication, knowledge-management, and service-improvement activities.

5.5 Analytics Information

Mutasil collects application analytics and usage information to understand how the application is used and to maintain and improve its functionality, reliability, performance, and user experience.

Analytics information may include:

• Application usage and interaction data
• Feature usage
• Session information
• Application performance information
• Technical diagnostic information

Analytics information is used for application performance monitoring, service improvement, troubleshooting, and understanding application usage patterns.

5.6 Crash Logs and Diagnostic Information

Mutasil collects crash logs and diagnostic information when technical errors, application failures, or performance issues occur.

This information may include:

• Device and operating system information
• Application version
• Application state
• Error and crash information
• Technical diagnostic information associated with the incident

Crash and diagnostic information is used to identify and resolve technical problems, improve application stability and performance, and enhance the overall user experience.

6How We Use Information

Information collected and processed through Mutasil is used for authorized business, operational, security, and application-related purposes, including:

• Verifying that users are authorized BSF employees.
• Authenticating users and providing secure access to Mutasil.
• Sending OTP codes to the employee's registered mobile number.
• Creating and maintaining employee profiles within Mutasil.
• Providing appropriate application access and content based on authorized employee profile information.
• Providing business and product information, learning materials, internal communications, announcements, surveys, assessments, tools, documents, and other Mutasil services.
• Sending push notifications, application alerts, and internal communications.
• Recording login, logout, and other authorized security and audit information.
• Supporting security monitoring and preventing or investigating unauthorized access or misuse.
• Monitoring application usage, reliability, and performance.
• Diagnosing crashes, errors, and other technical issues.
• Improving Mutasil's functionality, performance, stability, and user experience.
• Supporting applicable BSF internal policies, security requirements, and legal or regulatory obligations.

7Push Notifications

Mutasil uses push notification services to deliver application-related communications, including:

• Internal announcements
• Application alerts
• Learning and content notifications
• Operational communications
• Other Mutasil-related notifications

For this purpose, Mutasil processes a device push notification token.

8Data Sharing and Service Providers

BSF does not sell personal information collected or processed through Mutasil.

Information may be accessed, processed, or shared only where necessary with:

• Authorized BSF departments, personnel, and internal systems.
• Approved service providers supporting the development, operation, maintenance, hosting, security, analytics, notifications, troubleshooting, or technical support of Mutasil.
• Government, regulatory, judicial, or other competent authorities where disclosure is required by applicable law or regulation.

Approved service providers processing information on behalf of BSF are subject to applicable contractual, confidentiality, information-security, and data-protection requirements.

Access to information processed through Mutasil is restricted in accordance with applicable BSF authorization, access-control, information-security, and data-protection requirements.

9Data Security

BSF applies appropriate organizational, administrative, and technical security measures designed to protect personal, technical, and usage information processed through Mutasil against unauthorized access, disclosure, alteration, loss, destruction, or misuse.

Access to Mutasil and its underlying systems is restricted to authorized users and personnel in accordance with BSF's information-security and access-control requirements.

10Data Retention and Deletion

Information processed through Mutasil is retained only for as long as necessary to fulfill the purposes described in this Privacy Policy and in accordance with BSF's applicable data-retention policies, legal obligations, security requirements, and regulatory requirements.

Where applicable and legally permitted, users may request access to, correction of, or deletion of their personal information by contacting the BSF Data Privacy Office.

Requests will be handled in accordance with applicable laws and regulations and BSF's legal, regulatory, security, and record-retention obligations.

11Privacy Rights

Users may have rights regarding their personal information under the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations.

Privacy-related requests may be submitted to:

Such requests will be reviewed and handled in accordance with applicable legal and regulatory requirements.

12Accessibility of this Privacy Policy

This Privacy Policy is available through a publicly accessible web page and can be viewed using a standard web browser.

Access to this Privacy Policy does not require:

• Mutasil authentication
• Employee login
• BSF IAM authentication
• VPN access
• Access to BSF's internal network
• Any special application, plugin, or software

13Changes to this Privacy Policy

BSF may update this Privacy Policy when necessary to reflect changes to Mutasil, its functionality, data-processing practices, applicable laws and regulations, or BSF's privacy and security requirements.

The latest version of this Privacy Policy will be published on the designated public Privacy Policy page.

14Contact Us

For questions, concerns, complaints, or requests relating to this Privacy Policy or the processing of personal information through Mutasil, please contact: