Būlum Privacy Policy

1. The Būlum platform is keen to protect the privacy of its users and their personal data, and undertakes to process data in accordance with the laws, regulations, and instructions in force in the Kingdom of Saudi Arabia, and in a way that achieves the legitimate balance between:

1. Protecting the user's privacy and legal rights.
2. Enabling the platform to operate, develop, and improve its services.
3. Managing accounts, services, bookings, payments, and settlements.
4. Protecting users, service providers, and the platform from fraud, misuse, and circumvention.
5. Managing reports, disputes, and conflicts.
6. Complying with regulatory, security, and supervisory requirements.
7. Preserving rights and proving operations within the platform.

2. This policy is a binding regulatory document governing the manner of collecting, using, retaining, processing, sharing, and protecting the personal, operational, financial, and technical data associated with using the Būlum app, its website, its services, and its official channels.

3. This policy is an integral part of the platform's adopted regulatory framework, which includes, without limitation:

1. The Terms of Use.
2. The Financial & Regulatory Policy.
3. The Service Provider Agreement.
4. The Code of Conduct.
5. The Advertising Policy where it exists.
6. The Reports & Disputes Policy.
7. Any operational, financial, or technical policies, instructions, or annexes the platform adopts and announces to users.

4. By using the app, creating an account, browsing services, providing a service, requesting a service, making a booking, paying, communicating, uploading content, submitting a report or dispute, or using any feature within the platform, the user acknowledges that they have read, understood, and agreed to this policy, without prejudice to any rights established for them by law.

5. If the user does not agree to this policy, they must stop using the app and must not create an account or carry out any transaction through the platform.

6. This policy does not diminish any right established for the user under the laws in force in the Kingdom of Saudi Arabia, and it is interpreted so as to achieve data protection, regulatory compliance, and the stability of the platform's operation.

For the purposes of this policy, the following words and phrases have the meanings set out beside each of them, unless the context requires otherwise:

1. Būlum: the Būlum electronic app and platform, including the app, the website, the technical systems, the interfaces, the services, and its associated channels.
2. The platform / the app: all current or future Būlum interfaces, systems, and services, whether via the mobile app, the website, or any digital channel adopted by the platform.
3. The company / operating entity: the entity owning, operating, or licensed to manage and operate the Būlum platform, per the details announced within the app or the official website.
4. The user: every natural or legal person who uses the platform in any capacity, including the service seeker, service provider, visitor, browser, account holder, content publisher, advertiser, or any party interacting with the platform.
5. The service seeker: the user who books, requests, or pays for a service, appointment, interaction, or experience through the platform.
6. The service provider: the user who offers their services, appointments, interactions, or paid or free content through the platform in an independent service-provider capacity.
7. Personal data: any data, whatever its source or form, that leads to identifying the user directly or indirectly, such as the name, mobile number, email, account data, identity data upon verification, limited payment data, location data, device identifiers, and usage records.
8. Sensitive data: any data of a special or sensitive nature per the regulations, such as health, religious, political, biometric, or other data enjoying special legal protection, which the platform collects only where there is a clear legal justification or a specific operational necessity and to the extent needed.
9. Processing: any operation carried out on data, including collection, recording, retention, organization, modification, use, analysis, disclosure, transfer, deletion, concealment, anonymization, or any other action relating to data.
10. Controller: the entity that determines the purposes and means of processing personal data within the Būlum platform.
11. Processor: any external party that processes data on behalf of and for the account of the platform, such as the payment, hosting, messaging, notifications, analytics, protection, video or voice communication, technical support provider, or any other operational or technical provider.
12. Content: everything a user creates, uploads, sends, or displays within the platform, including texts, images, videos, audio clips, descriptions, appointments, prices, ratings, reports, messages, comments, posts, or any other digital material.
13. Services: all the services available within Būlum, including voice appointments, video appointments, direct text chats, full-day in-person meetings, travel trips, audio clips, video clips, handwritten cards, and any subsequent services the platform adds.
14. Operational data: the data necessary to manage operations within the platform, such as the booking state, booking time, service start, service end, session duration, acceptance, rejection, reason for rejection, payment, refund, dispute, report, rating, and support records.
15. Limited financial data: the data relating to payments, collection, and settlements, such as the transaction amount, payment state, transaction reference, platform fees, service or booking fee, settlement data, and the service provider's IBAN data when needed, without this meaning that full sensitive card data is stored with the platform whenever the payment provider processes it directly.
16. Anonymized or aggregated data: data processed so that it cannot reasonably be linked to a specific user, used for analysis, service improvement, internal reports, and general metrics.
17. Payment provider: any payment gateway, payment processor, bank, or financial or technical entity the platform adopts to process payments, collection, settlement, or financial verification.
18. The adopted policies: the Terms of Use, the Financial & Regulatory Policy, the Service Provider Agreement, the Code of Conduct, this policy, and any policies, instructions, or notices the platform adopts.

1. This policy applies to all Būlum users, whether they are:

1. Service providers.
2. Service seekers.
3. Registered users.
4. Visitors or browsers.
5. Users interacting with the platform via the app, the website, email, support, or any official channel.
6. Advertisers or users of the platform's promotion services where available.
7. Any party using any current or future service belonging to Būlum.

2. This policy covers the data collected or processed upon:

1. Creating an account.
2. Logging in.
3. Setting up the profile.
4. Offering services or appointments.
5. Making bookings.
6. Accepting or rejecting full-day in-person meeting or travel-trip requests.
7. Starting or ending the service.
8. Making a payment, refund, or settlement.
9. Submitting a report, dispute, or complaint.
10. Contacting support.
11. Using messages, calls, video, or text chat within the platform.
12. Using the advertising, promotion, or visibility features within the platform.
13. Uploading, publishing, or sharing any content.
14. Using any current or future service belonging to Būlum.

3. This policy does not apply to external websites, apps, or services not belonging to the platform, even if referenced or accessed through links within the app; their use is governed by their own privacy policies.

4. Būlum bears no responsibility for the privacy practices or data protection of any external party outside its control, while the platform remains committed to exercising appropriate care when selecting the providers necessary for its operation.

1. Būlum operates as a technology platform and an organized services marketplace that enables users to offer, request, and book services, interactions, and appointments per the adopted controls.

2. The platform processes data to the extent necessary to operate the platform, manage relationships between users, and provide the means of booking, payment, communication, reports, disputes, and settlements.

3. The platform's processing of data does not mean it is a direct party to the quality of the service provided between users, except within the limits of its role as a technical, organizing, and facilitating intermediary for payment and communication per the Terms of Use and the Financial & Regulatory Policy.

4. The platform reserves the right to process the data necessary to protect the platform's operational system, prevent fraud, verify compliance, manage disputes, and fulfill regulatory requirements.

5. In the platform's relationship with service providers, Būlum processes the data necessary to manage the service provider's account, verify, display services, receive bookings, process payments, settle entitlements, review reports, and apply the Service Provider Agreement.

6. In the platform's relationship with service seekers, Būlum processes the data necessary to create the account, browse services, book appointments, complete payment, communicate within the platform, submit reports or disputes, and protect the service seeker's rights.

7. The user acknowledges that data processing within Būlum is carried out to achieve operational, organizational, financial, security, and regulatory purposes necessary for the nature of the platform.

1. Būlum does not aim to collect sensitive or excessive data not necessary to operate the service, protect users, or comply with the regulations.

2. The user must not upload or send sensitive data, excessive personal information, or data belonging to others without a legal justification or valid consent from the relevant person.

3. If the user sends sensitive or unnecessary data via messages, reports, content, or support, the platform may be compelled to process it to the minimum extent necessary to handle the request, report, dispute, or regulatory compliance.

4. The platform may delete, block, or restrict any data or content containing sensitive, non-compliant, or unnecessary information or that violates others' privacy.

5. The user bears responsibility for any sensitive data or data belonging to others that they enter, send, or publish without justification.

1. The user acknowledges that some data they add to their account, profile, or services may appear to others within the platform, according to the nature of the service and the visibility settings.

2. Data such as the following may appear to service seekers or users:

1. The display name.
2. The account photo.
3. The personal or professional description.
4. The offered services.
5. The prices.
6. The available appointments.
7. The ratings.
8. The city or scope of availability.
9. The verification or badge status.
10. The public content the user uploads.
11. Any data the user chooses to make visible by the nature of the feature.

3. Limited data about the service seeker may appear to the service provider upon booking or requesting, such as:

1. The display name.
2. The booking data.
3. The type of service.
4. The date and time of the request.
5. The payment or booking-confirmation state to the extent needed.
6. Any data necessary to accept or reject the request or deliver the service.

4. No user may exploit the data visible within the platform to communicate outside the platform, harass, market without authorization, or violate others' privacy.

5. The user's sharing of their data within their public profile, via messages, or within the services is at their responsibility, while the platform retains the right to restrict or remove any data in breach of the law, the policy, or the Code of Conduct.

6. The service provider or service seeker may not copy, retain, or reuse the other party's data outside the scope of the service, booking, report, or legitimate right.

1. The platform provides internal means of communication between users according to the type of service, such as messages, text chats, voice calls, video calls, or any other communication means the platform adopts.

2. The user may not use the platform's communication means except for the purposes of the service, booking, legitimate coordination, or performing the relationship associated with Būlum's services.

3. The platform does not review the content of private messages or sessions by humans in a general or random manner.

4. The platform may conduct a human or automated review or processing of communication content or data in cases that warrant it, including without limitation:

1. The existence of a report from one of the parties.
2. The existence of a financial or operational dispute.
3. The existence of suspicion of fraud or misuse.
4. The existence of an attempt at circumvention or moving the dealing outside the platform.
5. The existence of content in breach of the laws, public decorum, or the Code of Conduct.
6. Protecting a user or a third party from potential harm.
7. The existence of a legal request from a competent authority.
8. A limited, justified security test or internal investigation.
9. Fixing a technical glitch or providing technical support requiring limited processing.
10. Protecting the rights of the platform, users, or service providers.

5. The platform may use automated tools to detect patterns of risk, fraud, abuse, and circumvention, without this meaning direct human reading of every content or session.

6. The platform does not use the content of private messages or sessions for targeted advertising purposes in a manner that reveals the substance of the private communication between users.

7. The user may not record, photograph, publish, or reuse any session, conversation, or private content belonging to another party without their express consent and without breaching the laws or adopted policies.

8. Any user is prohibited from using messages, calls, sessions, or conversations to exchange external means of communication, payment links, bank accounts, or any means intended to bypass the platform or deal outside it.

9. The user acknowledges that communication records and session data may be used when needed to prove the service state, examine reports or disputes, prevent fraud, or protect rights.

10. The platform reserves the right to take action against any user who violates another user's privacy, including restriction, suspension, banning, withholding entitlements, or taking any other measure per the adopted terms and policies.

1. Given the nature of full-day in-person meeting and travel-trip services, these services may require processing additional data associated with the appointment, day, trip, city, time range, request details, or the acceptance, rejection, payment, or communication state.

2. The service seeker uses the data available about the service provider to choose the suitable appointment, trip, or experience per the data visible within the platform.

3. When sending a full-day in-person meeting or travel-trip request, limited data about the service seeker and the request may reach the service provider — enough to review the request and accept or reject it per the platform's mechanism.

4. If the service provider rejects the request, the reason for rejection may be processed and displayed or sent to the service seeker to the extent needed to clarify the request state and manage the operational relationship.

5. The reason for rejection must be decent and must not contain any unnecessary personal data or abusive, discriminatory, or non-compliant phrases in breach of the laws, values, or adopted policies.

6. The platform may open a communication channel between the two parties after the booking is confirmed, before the appointment, or during the service duration, according to the type of service and the app's mechanism, for coordination and delivery purposes only.

7. No party may use the other party's data outside the scope of delivering the service, booking, or legitimate communication within the platform.

8. The service provider or service seeker may not retain, copy, publish, or reuse the other party's data or the meeting, trip, conversation, or private-arrangement details outside the platform without a legal justification or valid consent.

9. The platform bears no responsibility for any optional disclosure the user makes of their personal data to the other party outside the app or outside the adopted official channels.

10. The platform retains records of full-day in-person meeting and travel-trip services for the purposes of proving the booking, protecting rights, reviewing reports, managing financial settlements, preventing misuse, and complying with the regulations.

11. The user acknowledges that the nature of in-person meetings and travel trips may require a higher degree of personal responsibility, and that sharing any additional data between the parties is at the responsibility of the one who discloses it outside the scope of what the platform requests.

1. The platform may provide interactive services such as:

1. An audio clip.
2. A video clip.
3. A handwritten card.
4. Any custom content or output the service provider provides to the service seeker.

2. The user acknowledges that custom content may include personal data, names, phrases, occasions, or details the service seeker provides voluntarily for the purpose of delivering the service.

3. The service seeker must not provide the service provider with sensitive data, data belonging to others, or excessive information the service does not require, unless they have a legal justification or the consent of the relevant person.

4. The service provider remains responsible for not misusing any data, phrases, images, or materials that reach them from the service seeker for the purpose of delivering the interactive service.

5. The service provider may not use the custom content of the service seeker in marketing, publishing, public display, or reuse beyond the limits of fulfilling the request, except with the service seeker's express consent and in a manner not in breach of the laws and adopted policies.

6. The service provider may not include in the interactive output any data, images, phrases, or materials belonging to a third party without right, consent, or legitimate justification.

7. The platform may review the content or its data upon a report, violation, dispute, legal request, or suspicion of misuse or an infringement of privacy, intellectual property, or general values.

8. The user acknowledges that delivering the interactive content, retaining its records, or reviewing it upon a report is not an independent commercial use by the platform; rather, it is processing necessary to operate the service and protect rights.

9. The platform reserves the right to delete, restrict, or block any interactive content that breaches the laws, values, privacy, others' rights, or the platform's policies.

1. Būlum may share limited data with external service providers when needed to operate, improve, or protect the platform or to fulfill its obligations.

2. The parties with whom data may be shared include, without limitation:

1. Electronic payment providers.
2. Banks or settlement entities.
3. Verification providers.
4. Hosting and cloud-computing providers.
5. SMS providers.
6. Email and notification providers.
7. Voice and video communication providers.
8. Analytics and performance-monitoring providers.
9. Cybersecurity and protection providers.
10. Technical support providers.
11. Legal, financial, or accounting advisors when needed.
12. Any operational or technical provider necessary to provide or protect the service.

3. Data sharing with these parties is only to the extent necessary to fulfill the specific purpose, and in proportion to the nature of the service, transaction, report, or regulatory requirement.

4. The platform undertakes, as far as possible and according to the nature of the relationship, to bind service providers to the following:

1. Maintaining confidentiality.
2. Protecting data with appropriate measures.
3. Not using the data for purposes independent of the agreed purpose.
4. Not selling the data.
5. Not re-disclosing except with permission or a legal justification.
6. Restricting access to data as needed.
7. Applying appropriate security measures.
8. Deleting, returning, or restricting the data when the purpose ends, where possible and appropriate.

5. Sharing data with operating providers is not a sale of data; rather, it is processing necessary to provide the platform's services and operate payments, communication, verification, protection, and support.

6. Būlum bears no responsibility for any glitch, delay, or restriction from an external provider beyond its reasonable control, while remaining committed to exercising appropriate care in selecting and dealing with providers.

1. Būlum does not sell users' personal data.

2. Būlum does not rent, trade in, or grant personal data to advertisers or external parties as an independent product.

3. The platform does not grant any advertiser or commercial party a direct right to access the user's personal identity, mobile number, email, or private data merely because that party advertises within the platform.

4. Advertisers do not obtain direct personal data about users except in cases the law permits, where the user interacts with them of their own will or consent, or where there is a clear operational justification associated with a service the user requested.

5. The platform may use anonymized, aggregated, or statistical data that does not identify the user for purposes of analysis, reports, service improvement, performance measurement, or general marketing of the platform.

6. Anonymized or aggregated data is not personal data whenever it cannot reasonably be linked to a specific user.

1. The platform may disclose the user's data if that is required or permitted by law.

2. Cases of legal disclosure include, without limitation:

1. The existence of a court order.
2. The existence of a request from a competent authority.
3. The existence of a legal or supervisory obligation.
4. Investigating fraud, abuse, threats, or a violation.
5. Protecting the rights of the platform, its users, or others.
6. Preventing actual or potential harm.
7. Enforcing the adopted policies or terms.
8. Combating money laundering, fraud, or prohibited activities where applicable.
9. Complying with any financial, security, or regulatory requirements.

3. Disclosure is, where possible, to the extent needed and connected to the legal, operational, or security purpose.

4. Disclosure to the competent authorities, advisors, or service providers when needed is not a breach of data confidentiality or a violation of this policy.

5. The platform may be unable to notify the user of the disclosure if notification is legally prohibited, conflicts with the investigation, causes harm, or breaches the requirements of a competent authority.

6. The platform reserves the right to document any legal disclosure, official request, or compliance procedure per its internal records.

1. Būlum may display advertisements, promotional content, or introductory campaigns within the app, the website, or the official channels.

2. The platform may use limited data to improve the relevance of the advertisement or promotional content, such as:

1. The city or region.
2. The age group.
3. Gender where available and where there is an appropriate justification.
4. The language.
5. General interests within the platform.
6. The type of services the user interacts with.
7. The non-sensitive interaction log.
8. Preference settings where the platform makes them available.

3. The advertiser is not provided with a list of users' names, numbers, email, or their direct personal data merely for advertising.

4. The advertiser may obtain general or aggregated statistics, such as the number of impressions, clicks, general category, or region, without enabling them to identify an individual user.

5. The platform does not use sensitive data for advertising purposes unless the law permits and with express consent when needed.

6. The user may manage some advertising preferences through the device or app settings where these options are available.

7. Advertisements or promotional content within the platform are not a disclosure of users' personal data to advertisers, unless the user agrees, interacts with the advertiser of their own will, or there is a legitimate justification.

1. The platform sends the user important operational notifications and messages associated with their use of the app, their account, and their services.

2. Operational notifications and messages include, without limitation:

1. The verification code.
2. Account-creation confirmation.
3. Booking confirmation.
4. Payment notification.
5. Request acceptance or rejection notification.
6. An appointment reminder.
7. Service start or end notification.
8. Report or dispute notification.
9. Refund, settlement, or payment-state notification.
10. Policy or terms change notification.
11. A security or administrative alert.
12. A verification or authentication notification.
13. A notification relating to restricting, suspending, or deactivating the account.
14. Any notification necessary for operation or protecting rights.

3. Operational messages are a core part of the service, and the user may not be able to disable them entirely without affecting the use of the platform or some of its features.

4. The platform may send marketing, introductory, or promotional messages, and the user may unsubscribe from marketing messages where available, without affecting the necessary operational messages.

5. Sending notifications to the contact data registered for the user, or publishing them within the app or the notifications tab, is a sufficient means of notification whenever the platform adopts that.

6. The user undertakes to update their contact data, and the platform bears no responsibility for the non-delivery of a notification due to an error in the data, device settings, the service provider, spam, or any reason beyond its reasonable control.

1. The platform may use cookies or similar technologies when using the website, the associated interfaces, or some app features, for operational, technical, analytical, and security purposes.

2. These technologies are used, as needed, for purposes such as:

1. Logging in.
2. Saving preferences.
3. Improving performance.
4. Analysis.
5. Security.
6. Measuring advertisements or interaction.
7. Preventing fraud.
8. Improving the user experience.
9. Detecting malfunctions.
10. Protecting sessions.

3. The user can control some of these technologies from the browser or device settings where they are controllable by them.

4. Disabling some cookies or technical identifiers may disable some platform features, reduce the quality of the experience, or affect security or login.

5. The platform does not use these technologies to sell the user's identity or grant it to advertisers as an independent product.

1. Būlum takes appropriate technical, organizational, and administrative measures to protect personal data from unauthorized access, loss, damage, leakage, modification, or unlawful use.

2. These measures include, according to need, capabilities, and the nature of the data:

1. Encrypting communication.
2. Protecting passwords.
3. Restricting permissions.
4. Separating permissions by role.
5. Access monitoring.
6. Access logs.
7. Periodic security review.
8. Backups.
9. Protecting operating environments.
10. Monitoring malfunctions and breaches.
11. Training or guiding staff and service providers when needed.
12. Contractual controls with processors.
13. Security-incident management.
14. Continuously testing and improving the security procedures.
15. Restricting internal access to data as needed.
16. Using technical tools to detect abnormal login attempts or high-risk patterns.

3. The user acknowledges that the internet and technical systems cannot have their security absolutely guaranteed, and that the platform does not provide an absolute guarantee against any security incident, but undertakes to take reasonable and appropriate measures per the regulations.

4. The platform bears no responsibility for any leak, loss, or data damage resulting from:

1. The user disclosing the password or verification code.
2. Using a compromised or insecure device.
3. Sharing the account with others.
4. Using insecure public networks.
5. Communicating outside the platform.
6. The user uploading sensitive data or data belonging to others without justification.
7. Errors or acts beyond the platform's reasonable control.
8. Force majeure or general attacks that cannot be fully prevented, within the limits the law permits.

5. The user undertakes to notify the platform immediately upon suspicion of a breach of their account, a leak of their login data, or unauthorized use of their account.

6. The platform reserves the right to take the necessary measures to protect accounts and data, including requesting verification, changing login data, suspending the account, or restricting certain features upon a security danger or legitimate suspicion.

1. Būlum adopts the need-to-know principle in granting permissions to access users' data.

2. No employee, contractor, supervisor, or technical-service provider is granted general or absolute access to users' data; rather, access is restricted according to the operational, technical, security, or regulatory need.

3. Data-access permissions are determined based on criteria that include, without limitation:

1. The nature of the role.
2. The operational need.
3. The type of data.
4. The sensitivity of the data.
5. The duration of the task.
6. The level of risk.
7. Security and compliance requirements.
8. The nature of the report, request, dispute, or financial operation being processed.

4. The platform may grant limited, temporary permissions to some of its staff, service providers, or advisors when needed to handle a report, technical support, financial review, security investigation, or a legal obligation.

5. The platform may log access, processing, modification, export, or review operations for purposes of accountability, security, internal investigation, and compliance.

6. Any person authorized to access data is prohibited from using it outside the scope of the specified purpose, or disclosing, copying, or sharing it without authorization.

7. Any unauthorized access or non-compliant use of data is a serious violation warranting the appropriate legal, contractual, or operational measures.

8. The platform is not obliged to disclose to the user the details of its internal permissions, the names of authorized persons, or the internal investigation mechanisms, whenever disclosure could harm security or privacy or reveal the protection or fraud-prevention mechanisms.

1. The platform may maintain an internal record of personal-data processing operations, for purposes of governance, compliance, review, and protecting rights.

2. The processing record may include, as needed:

1. The type of data.
2. The purpose of processing.
3. The basis for processing.
4. The category of users.
5. The parties with whom data is shared.
6. The retention period.
7. The protection measures.
8. Data transfer outside the Kingdom where it exists.
9. The relevant incidents or reports.
10. Any information necessary to prove compliance or improve data management.

3. The processing record is used for internal purposes including:

1. Compliance review.
2. Risk management.
3. Responding to the competent authorities.
4. Improving data-protection procedures.
5. Documenting processing procedures.
6. Security-incident management.
7. Protecting the rights of the platform and users.

4. The processing record is not a public document available to users, and it may not be accessed except within the limits the law or the competent authorities determine.

5. The platform's maintenance of an internal processing record does not prevent the user from exercising their rights relating to their data per this policy and the applicable laws.

1. The platform documents the user's acceptance of the relevant policies, terms, and agreements, whenever acceptance is required or necessary to prove the operational or legal relationship.

2. The documents and policies the platform may document the user's acceptance of include, without limitation:

1. The Privacy Policy.
2. The Terms of Use.
3. The Financial & Regulatory Policy.
4. The Service Provider Agreement where applicable.
5. The Code of Conduct.
6. Any subsequent material update.
7. Any special consent associated with a particular service, feature, or processing.

3. Acceptance records may include:

1. The date and time of acceptance.
2. The version of the accepted policy or document.
3. The method of acceptance within the app.
4. The IP address when available.
5. The device or session identifier when available.
6. The account status at the time of acceptance.
7. The language or interface used upon acceptance.
8. Any technical or operational record necessary to prove acceptance.

4. These records are used to prove consent, manage the relationship with the user, comply, protect rights, respond to disputes, and prove obligations within the platform.

5. The user may withdraw consent in cases where consent is the sole legal basis for processing, knowing that withdrawing consent may lead to disabling some services, closing the account, or the inability to continue providing the service or performing some obligations.

6. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not prevent the platform from continuing to process data whenever there is another legal, contractual, or operational basis, such as retaining financial records, handling disputes, complying with the regulations, or protecting rights.

1. The user can exercise their data-related rights through:

1. The account settings within the app where the feature is available.
2. The adopted official channels within the app.
3. The official email for app management, privacy, and support: support@bulumplatform.com

2. The request must include sufficient information to verify the requester's identity and identify the data or action requested.

3. The platform may request additional information to verify the user's identity before executing the request, to protect the data and prevent impersonation or unauthorized access.

4. The request is handled within a reasonable legal or operational period, according to the nature and complexity of the request, the account status, and the existence of any obligations, disputes, reports, or regulatory requirements.

5. The platform may refuse, restrict, or postpone the request in the following cases:

1. The inability to verify the requester's identity.
2. The request conflicting with a legal obligation.
3. The existence of an ongoing dispute, claim, or report.
4. The request conflicting with another user's rights.
5. The request being repeated, malicious, or unspecified.
6. The need to retain the data to prevent fraud, prove transactions, or comply.
7. The data being associated with an ongoing financial operation, booking, settlement, or dispute.
8. The existence of a legitimate security or operational reason.
9. Any other case the law permits.

6. Deleting some data does not lead to deleting anonymized or aggregated records, temporary backups, or records that must be retained by law or operationally.

7. If the request relates to data visible in the user's account, profile, or services, the platform may ask the user to modify it directly from within the account where the feature is available.

8. The platform is not obliged to execute any request submitted through an unofficial channel or by a person who does not prove their capacity or authority to represent the user.

1. The user may request the deletion or closure of their account per the mechanism the platform provides or through the adopted official channels.

2. Deleting the app from the user's device does not delete the account or the data from the platform's systems.

3. Upon a request to delete the account, the platform may, according to the case, do the following:

1. Deactivate the account.
2. Prevent access.
3. Hide the public profile.
4. Stop the display of services.
5. Delete or anonymize unnecessary data.
6. Retain the records necessary for the legal or operational periods.
7. Restrict access to some data instead of deleting it if that is necessary to protect rights or comply.

4. The account may not be deleted in a way that leads to concealing fraud, misuse, evading financial obligations, or an ongoing dispute, report, violation, or entitlements under review.

5. If the user has active bookings, entitlements, disputes, reports, or existing obligations, the platform may postpone deleting some data until the necessary purpose ends.

6. If the user is a service provider, the platform may retain additional data necessary to prove services, bookings, entitlements, settlements, reports, and the obligations associated with the Service Provider Agreement.

7. Some data may remain in secured backups until the backup cycle ends, then it is deleted, replaced, or restricted per the adopted operational procedures.

8. Deleting the account does not forfeit any prior right of the platform or users or any financial, legal, or operational obligation existing before the deletion.

9. The platform may retain limited data about the deleted account to prevent fraud, abusive re-registration, or circumventing ban or suspension decisions.

1. The platform retains data as long as that is necessary to achieve the purposes for which it was collected, or to comply with the regulations, protect rights, prove transactions, or manage disputes.

2. The retention period varies according to the type of data, the nature of its use, and the legal or operational basis for retaining it.

3. The general retention periods are, by way of guidance, as follows:

1. Active account data: for the duration of the account's activity.
2. Account data after deletion: for the period necessary to execute the deletion or anonymization, while retaining what is legally or operationally necessary.
3. Booking and service data: for the period necessary to prove transactions, manage disputes, comply, and protect rights.
4. Payment and settlement data: per the necessary legal, accounting, and financial periods.
5. Report and dispute data: until the report or dispute ends and for the period necessary to protect rights and prevent misuse.
6. Security and login logs: for the period necessary for protection, analysis, and fraud prevention.
7. Technical support data: for the period necessary to handle the request, improve the service, and protect rights.
8. Marketing data: until unsubscription or the end of the purpose, unless there is another justification for retention.
9. Anonymized and aggregated data: may be retained without a specified period whenever it no longer identifies the user.
10. Backups: per secure operational cycles the platform determines.
11. Verification and authentication data: for the period necessary to prove verification, prevent fraud, and comply.
12. Service providers' financial and bank data: for the period necessary for settlement, compliance, and protecting rights.

4. After the retention purpose ends, the platform deletes, anonymizes, isolates, or restricts access to the data in an appropriate manner.

5. The user may not demand the deletion of data that must be retained by law, or to protect the rights of the platform or users, prove transactions, review reports, or prevent fraud.

6. The platform reserves the right to extend the retention period upon a dispute, report, investigation, claim, request from a competent authority, or a legitimate reason to protect rights.

1. The platform may use data after anonymizing or aggregating it so that it is no longer reasonably associated with a specific user.

2. Anonymized or aggregated data is used for purposes including, without limitation:

1. Statistical analysis.
2. Service improvement.
3. Performance measurement.
4. Understanding usage trends.
5. Preparing internal reports.
6. Product development.
7. General marketing of the platform without revealing the user's identity.
8. Attracting partners, investors, or advertisers via general, non-personal metrics.
9. Assessing the performance of categories and services.
10. Improving safety and combating fraud.
11. Studying market and usage metrics within the platform.

3. Anonymized or aggregated data is not personal data whenever it cannot reasonably be linked to a specific user.

4. The user may not object to the use of anonymized or aggregated data that does not lead to identifying them directly or indirectly.

5. The platform undertakes not to attempt to re-identify the user from anonymized or aggregated data except where that is legally or security-necessary or to protect rights and as the regulations permit.

1. Some of Būlum's services or its technical providers may require processing, storing, or transferring data outside the Kingdom of Saudi Arabia.

2. Data is only transferred outside the Kingdom upon an operational, technical, contractual, or regulatory need, and in accordance with the applicable regulatory controls.

3. External transfer may include, when needed:

1. Cloud hosting.
2. Payment providers.
3. Voice or video communication providers.
4. Messaging or email providers.
5. Analytics or performance-monitoring tools.
6. Technical support or cybersecurity.
7. Verification or compliance providers.
8. Any operational or technical provider necessary to provide or protect the service.

4. The platform undertakes, as far as possible and according to the nature of the relationship, to apply appropriate safeguards when transferring data, such as:

1. Contracting with trusted providers.
2. Restricting the purpose of processing.
3. Restricting access.
4. Confidentiality.
5. Appropriate security measures.
6. Compliance with the relevant Saudi regulations.
7. Minimizing the transferred data to what is necessary.
8. Monitoring the providers' level of compliance where appropriate and possible.

5. Transferring data outside the Kingdom does not mean waiving its confidentiality or granting the external party the right to use it for its independent purposes.

6. The user acknowledges that some technical, financial, or communication services may not work efficiently or may be unavailable if external providers cannot be used or data transferred to the extent necessary for operation.

1. The platform may use sub-processors to carry out some technical, operational, financial, or security functions.

2. Sub-processors may include, without limitation:

1. Hosting providers.
2. Messaging and notification providers.
3. Payment providers.
4. Verification providers.
5. Voice and video communication providers.
6. Cybersecurity and protection providers.
7. Analytics providers.
8. Technical support providers.
9. Advisors or professional entities necessary for operation or compliance.

3. Sub-processors undertake, where possible and according to the nature of the contract, to:

1. Process the data only based on the platform's instructions or per the specified purpose.
2. Not use the data for unauthorized independent purposes.
3. Not sell or share the data without permission or justification.
4. Protect the data with appropriate measures.
5. Report the relevant security incidents when needed.
6. Delete, return, or restrict the data when the relationship ends where possible.
7. Maintain confidentiality.
8. Restrict access to the data as needed.

4. The platform remains keen to select service providers with an appropriate level of security and reliability, without this meaning an absolute guarantee of the actions of external parties beyond the platform's reasonable control.

5. Using sub-processors is not a sale of data or an abandonment of the platform's commitment to protect users' data per this policy.

1. If the platform becomes aware of a security incident that may affect users' personal data, Būlum takes the appropriate measures according to the nature, scope, and severity of the incident.

2. The measures the platform may take upon a security incident include, without limitation:

1. Documenting the incident.
2. Containing the impact.
3. Identifying the scope of the affected data.
4. Assessing the severity level.
5. Addressing the technical or operational cause where possible.
6. Taking corrective measures.
7. Reviewing the relevant permissions or systems.
8. Notifying the competent authorities when necessary per the regulations.
9. Notifying the affected users when that is legally required or necessary to protect them.
10. Taking any measure necessary to reduce the impact of the incident and prevent its recurrence.

3. Notifying the user or the competent authority of a security incident is not an automatic admission by the platform of legal liability, unless liability is established per the applicable laws.

4. The user undertakes to notify the platform immediately upon suspicion of:

1. A breach of their account.
2. Unauthorized use of their account.
3. A leak of the password.
4. A leak of the verification code.
5. An unauthorized party accessing their account.
6. The existence of an operation, booking, payment, or message unknown to them.
7. Any abnormal activity relating to their account or data.

5. The user acknowledges that their delay in reporting any incident or security suspicion may increase the harm or make it impossible to fully address, and the user bears responsibility for any effect resulting from their negligence, delay, or disclosure of their login data.

6. Upon an incident or security suspicion, the platform may take precautionary measures including, without limitation:

1. Temporarily suspending the account.
2. Requesting re-verification.
3. Changing the password.
4. Disabling some features.
5. Suspending bookings or payments.
6. Restricting access.
7. Blocking active sessions.
8. Notifying the user or the competent authorities when needed.

7. The platform bears no responsibility for incidents arising from the user's breach of this policy or the Terms of Use, or from their negligence in protecting their account, device, or login data, within the limits the law permits.

1. Use of the Būlum platform is not permitted for anyone under thirteen (13) calendar years of age.

2. Those aged thirteen and above may use the platform per the controls the platform adopts, taking into account the relevant regulations and the rights of the guardian or custodian where necessary.

3. If the user is a minor per the applicable regulations, their use of the platform is under the responsibility of their guardian or legal custodian where necessary.

4. The platform may restrict some services or features from minor users or younger age groups, especially services that may require:

1. A financial dealing.
2. Direct communication.
3. In-person meetings.
4. Travel trips.
5. Custom content.
6. Sharing additional data.
7. Any service the platform deems to need age controls or additional protection.

5. The minor user undertakes to obtain the guardian's consent whenever that is legally or operationally required.

6. The guardian or custodian, whenever they permit the minor to use the platform, acknowledges that they are responsible for monitoring the minor's use of the app and for any data they provide, transactions they carry out, or communication they conduct within the platform, within the limits the law permits.

7. If the platform finds that an account was created in breach of the permitted age or with incorrect data, it may take any appropriate measure, including:

1. Suspending the account.
2. Restricting the service.
3. Deleting the account.
4. Cancelling or freezing some transactions.
5. Requesting additional verification.
6. Preventing the use of some features.
7. Taking any appropriate measure to protect the user and the platform.

8. The platform does not intend to collect data from those under the permitted age, and if it becomes aware of that, it will take the appropriate measure per the regulations and adopted policies.

9. No user may exploit the presence of a minor user within the platform, attempt to obtain their data, or communicate with them in a manner in breach of the laws, values, or the platform's policies.

10. The platform may adopt additional age controls, modify the eligibility limits, or restrict some features as it deems appropriate to protect users and comply with the regulations.

1. The user may not enter, upload, send, or publish data belonging to a third party unless they have a legal justification or valid consent from the data owner.

2. If the user provides the platform with third-party data, they acknowledge that they are authorized to do so and bear full responsibility for the accuracy of this acknowledgment.

3. Third-party data includes, without limitation:

1. Names.
2. Mobile numbers.
3. Email.
4. Images.
5. Audio or video clips.
6. Identity data.
7. Location data.
8. Conversations.
9. Any personal, private, or sensitive information relating to another person.

4. The user may not use Būlum's services to send third-party data to a service provider, service seeker, or the platform without an actual need, consent, or legitimate justification.

5. If the user's content, report, or request includes third-party data, this data must be limited, necessary, and proportionate to the legitimate purpose.

6. The platform may delete, restrict, or block any third-party data if it appears to have been sent without justification or to include a privacy violation or a breach of the laws or policies.

7. The user bears any claim, damage, or liability arising from their entering, publishing, or sending third-party data without right.

8. Būlum bears no responsibility for any third-party data the user uploads or sends on their own initiative, while the platform retains the right to process it to the extent necessary to handle the report, service, request, violation, or compliance.

1. Public content means all content the user publishes of their own will to appear to others within the platform or that is visible by the nature of the feature used.

2. Public content includes, without limitation:

1. The profile.
2. The account photo.
3. The personal or professional description.
4. The service descriptions.
5. The service images.
6. Public videos.
7. The prices.
8. The available appointments.
9. Public ratings and reviews.
10. The posts or materials the user chooses to make visible.

3. Private content means all content the user does not intend to publish to the public, such as:

1. Messages.
2. Reports.
3. Private booking details.
4. Payment data.
5. Documents sent to support.
6. Verification data.
7. Conversations associated with the service.
8. Any content that by its nature appears to specific parties only.

4. The system handles each type of content according to its nature, its visibility settings, and its purpose.

5. The user's publishing of public content within the platform means their consent to displaying it within the platform per its features, without this meaning the transfer of its ownership to the platform.

6. The user may not consider everything they place in their public profile, service, or rating to be confidential if it is visible by the nature of the feature.

7. No user may copy, republish, or exploit the public or private content of another user outside the platform in a manner in breach of the laws, policies, intellectual property rights, or privacy.

8. The platform reserves the right to restrict, delete, or hide any public or private content if it breaches the laws, values, privacy, others' rights, or the platform's policies.

1. The user retains their ownership of the content they create, upload, publish, or send within the platform, whenever they own this content or have the right to use it.

2. Upon the user uploading, publishing, sending, or making available any content within Būlum, they grant the platform a non-exclusive, non-ownership-transferring, worldwide license, usable for using, storing, processing, displaying, technically copying, formatting, and technically adapting, to the extent necessary to operate the platform, provide its services, protect its rights, and improve it.

3. The content-use license includes the following purposes, without limitation:

1. Operating the platform.
2. Displaying the content per the user's settings and the nature of the feature.
3. Displaying services and profiles.
4. Enabling booking or delivering the service.
5. Sending the content to the intended party upon the service.
6. Retaining the necessary records.
7. Handling reports and disputes.
8. Protecting rights.
9. Improving performance.
10. Internal analysis.
11. Preventing fraud and circumvention.
12. Complying with the law.
13. Arranging results, recommendations, and visibility within the platform.
14. Testing and improving technical features.
15. Featuring public content within the platform's interfaces, pages, or services.

4. For public content published within the platform or intended for public display — such as the profile, service descriptions, service images, public videos, ratings, and public content — the platform may use, display, re-feature, arrange, or embed it within the platform's interfaces or its introductory, marketing, or promotional materials associated with the platform, without any independent financial consideration for the user, unless expressly agreed otherwise.

5. For private content, such as messages, reports, documents, verification data, and payment data, the platform's use of it is limited to operational, security, financial, and regulatory purposes, such as delivering the service, handling reports, protecting users, complying with the regulations, and improving safety.

6. This license does not mean:

1. Transferring ownership of the content to the platform.
2. Selling the user's content as an independent product.
3. Using private content in an independent external advertisement without justification or consent where required.
4. Revealing private content to the public contrary to the platform's settings or the law.
5. Forfeiting the user's legal rights relating to their data and content.

7. The platform may make the technical modifications necessary to the content to conform to display, storage, formatting, and operation requirements, such as changing the size, format, quality, or manner of display, without this being a distortion or a violation of the user's ownership.

8. The user may not upload content they do not own or that includes an infringement of others' privacy, intellectual property, or reputation.

9. The user acknowledges that deleting the account or deleting content may not lead to deleting all technical copies, records, backups, or data necessary for compliance, protecting rights, handling disputes, or preventing fraud.

10. The user bears any claim, damage, or liability arising from their content or from the platform's use of that content per the license granted by this policy.

1. The platform processes rating, report, and dispute data as a core part of protecting the quality of the platform's operational environment and managing trust between users.

2. Rating, report, and dispute data may include:

1. The name or identifier of the reporter or rater.
2. The other party associated with the report or rating.
3. The type of service or booking.
4. The service time.
5. The description of the incident.
6. The attached documents or evidence.
7. The communication log associated with the service.
8. The platform's decisions or measures.
9. Any operational, financial, or technical data necessary to examine the case.

3. A limited part of the report or dispute may be shared with the other party to the extent necessary to respond, investigate, or settle, without disclosing unnecessary data.

4. The platform may hide, delete, or restrict the rating, report, or any associated content if it is:

1. Abusive.
2. Malicious.
3. Containing unnecessary personal data.
4. Containing insults, slander, or defamation.
5. In breach of the Code of Conduct.
6. In breach of the laws or public decorum.
7. Unrelated to the service.
8. Containing an attempt at extortion, pressure, or circumvention.
9. Containing confidential information or third-party data without justification.

5. The platform is not obliged to disclose the full details of the internal review procedures if that would harm security or privacy, reveal fraud-prevention mechanisms, or harm the rights of another party.

6. The platform may retain report and dispute records even after the account is deleted, if they are necessary to protect rights, prove transactions, prevent recurrence, or comply.

7. The platform's retention of report and dispute data is not a breach of the right to deletion whenever the retention is necessary to protect rights, comply, or manage disputes.

8. The user is prohibited from filing malicious or fabricated reports or using reports and ratings to harm others, circumvent, or obtain an undeserved benefit.

1. The platform may use automated, algorithmic, or analytical tools for operational, security, and improvement purposes.

2. The uses of automated tools and technical analyses include, without limitation:

1. Arranging results.
2. Recommendations.
3. Fraud detection.
4. Security monitoring.
5. Performance measurement.
6. Improving the user experience.
7. Detecting conduct in breach.
8. Preventing fake accounts or abusive use.
9. Analyzing service quality.
10. Detecting attempts at circumvention or off-platform dealing.
11. Identifying operational or financial risks.
12. Improving advertising and personalization within the platform.

3. Using automated tools does not always mean making final decisions without human review, especially in cases that have a material effect on the user, whenever the law or the platform's policy requires that.

4. The user may contact the platform to object to a decision affecting their account, entitlements, or services, per the report, support, and adopted official channels.

5. The platform is not obliged to disclose its technical secrets, algorithms, fraud-prevention mechanisms, or detailed risk criteria in a way that would weaken its security or facilitate circumvention.

6. The results of analysis, ranking, or recommendation are not a guarantee of a service provider's quality, a service's suitability, or a specific outcome; rather, they are operational tools to improve and organize the platform experience.

1. The platform observes the principle of privacy by design and by default settings, to the extent appropriate to the nature of the platform, its resources, its services, and the operation requirements.

2. Observing privacy in design and operation includes, without limitation:

1. Minimizing the collection of unnecessary data.
2. Restricting access to data.
3. Designing permissions according to need.
4. Protecting data during operation stages.
5. Testing new features from a privacy angle.
6. Reviewing risks when adding new services.
7. Restricting the use of sensitive data.
8. Controlling data sharing with service providers.
9. Enabling the user to manage some of their data where the feature is available.
10. Retaining the records necessary to protect rights without unnecessary expansion.

3. When adding features with a higher privacy impact, the platform may update the policy, add notices, or request additional consents according to need and the regulations.

4. The privacy-by-design principle does not mean the platform collects only the absolute minimum of data; rather, it collects and processes what is necessary to operate its service, financial, security, and regulatory model and to protect users.

5. The platform undertakes to review its practices when needed in line with the development of services, regulations, and risks.

1. Būlum may conduct internal assessments of privacy and data-protection risks, especially upon changes, services, or operations with a higher data impact.

2. The cases that may warrant an internal risk assessment include, without limitation:

1. Launching a new service.
2. Adding a new technical provider.
3. Processing sensitive data.
4. Expanding advertising or analytics.
5. A material change in payment or communication flows.
6. Transferring data outside the Kingdom.
7. The occurrence of a security incident.
8. Adding new verification or authentication mechanisms.
9. Launching in-person meeting, travel-trip, or extended services with a higher impact.
10. A material change in the report, dispute, or settlement mechanisms.

3. Risk assessments aim to:

1. Reduce risks.
2. Improve compliance.
3. Protect users.
4. Protect the platform.
5. Improve security measures.
6. Control access and sharing.
7. Determine corrective measures.
8. Improve the design of services.

4. Internal risk assessments are not public documents or available to users, unless the law requires otherwise.

5. Not publishing the risk assessments does not prevent the platform's commitment to protecting data or cooperating with the competent authorities per the applicable regulations.

6. The platform may modify its procedures based on the results of the risk assessment, including restricting some features, modifying the manner of data collection, changing a service provider, or updating this policy.

1. The service provider undertakes to maintain the confidentiality of any data or information about the service seeker that reaches them through the platform or by reason of a service, booking, request, or communication that arose via Būlum.

2. The service seeker's data the service provider undertakes to protect includes, without limitation:

1. The name or display name.
2. The mobile number when it appears or reaches them lawfully.
3. The email when it appears or reaches them lawfully.
4. The booking data.
5. The service details.
6. The request details.
7. Conversations.
8. The images, files, or clips the service seeker sends.
9. Location, city, or trip data when necessary for the service.
10. Any personal or private information the service provider becomes aware of while delivering the service.

3. The service provider may not:

1. Copy the service seeker's data beyond the scope of need.
2. Retain it after the legitimate purpose ends.
3. Share it with any third party.
4. Use it to communicate outside the platform.
5. Use it for marketing or re-targeting.
6. Use it for nuisance or harassment.
7. Publish or defame it.
8. Exploit it financially, personally, or socially.
9. Use it for pressure, threats, or extortion.
10. Use it for any purpose unrelated to the booking or service within Būlum.

4. The service provider undertakes to use the service seeker's data only within the limits of delivering the booked service within the platform and per the Terms of Use, the Service Provider Agreement, and the adopted policies.

5. If the service provider needs additional data from the service seeker to deliver the service, the requested data must be necessary and proportionate to the nature of the service and not in breach of the laws or privacy.

6. The service provider may not request sensitive or excessive data from the service seeker except upon a clear necessity, a legitimate justification, and valid consent where required.

7. The service provider remains responsible for any misuse of the service seekers' data that reaches them by reason of using the platform.

8. The service provider's obligation of confidentiality and protecting the service seekers' data continues even after the service ends, the account is closed or suspended, or the service-provider status is ended.

9. The platform may suspend or ban the service provider, hold or deduct their entitlements, or take any appropriate measure if they breach the confidentiality or privacy obligation, per the Terms of Use, the Financial & Regulatory Policy, and the Service Provider Agreement.

10. The service provider bears full responsibility for any claim, damage, penalty, or obligation arising from their disclosure, misuse, or unlawful retention of the service seekers' data.

1. The service seeker undertakes not to misuse the service provider's data, appointments, prices, content, images, clips, or information visible within the platform.

2. The service seeker may not use the service provider's data except within the limits of browsing, booking, or delivering the service, submitting a report, or exercising a legitimate right within the platform.

3. The service seeker is prohibited from:

1. Harassing the service provider.
2. Publishing the service provider's data outside the platform.
3. Attempting to communicate with them outside the platform in breach of the terms.
4. Photographing or recording the service without legitimate authorization or valid consent.
5. Republishing their content without right.
6. Using their images, clips, or description for commercial or abusive purposes.
7. Extorting, threatening, or defaming them.
8. Using their data for an unlawful purpose.
9. Attempting to access information not visible or not intended for them.
10. Using the service provider's information to circumvent the platform or deal outside it.

4. The service seeker may not copy, retain, share, or reuse the service provider's data or content except to the extent the laws, policies, and the nature of the service permit.

5. If the service seeker obtains data or information about the service provider during an in-person meeting, travel trip, conversation, voice or video appointment, or interactive service, they must use it only for the purpose of the service and not exploit it after it ends.

6. The platform may take the appropriate measures upon the service seeker's breach of this Article, including restricting or suspending the account, deleting the content, banning the user, or taking any appropriate operational or legal measure.

7. The service seeker bears any claim, damage, or liability arising from their misuse of the service provider's data, content, or information.

1. The platform may contain external links, integrations, or services necessary for or supporting the operation of some features or the provision of some services.

2. External links or services include, without limitation:

1. Payment gateways.
2. Third-party login services.
3. Map or location services.
4. Voice or video communication services.
5. Messaging or email services.
6. Informational or operational links.
7. Support, verification, or protection tools.
8. Any external technical, financial, or operational service the platform adopts.

3. Būlum bears no responsibility for the privacy policies or data-protection practices of external websites, apps, or services not belonging to it.

4. The user is responsible for reading the privacy policies and terms of any external service they use or move to.

5. The existence of a link or integration within the platform does not mean a full endorsement of the external party's privacy practices, unless the platform expressly states that.

6. When using an external provider necessary to operate a service within Būlum, limited data may be shared with them per this policy and to the extent necessary to provide the service.

7. Būlum bears no responsibility for any data the user provides directly to an external party outside the platform's channels or outside the adopted operational purpose.

8. If the user chooses to leave the platform or deal with an external party outside Būlum, that is at their personal responsibility, and that processing is not subject to this policy except within the limits the platform controls.

1. Payments are processed via licensed or adopted payment providers, banks, and financial entities as the platform adopts.

2. The platform does not usually retain full sensitive card data if the payment provider processes it directly.

3. The platform may retain limited financial data necessary for operation, such as:

1. The transaction reference.
2. The transaction amount.
3. The transaction state.
4. The general payment method.
5. The payment time.
6. The payment result.
7. The refund state.
8. The bank-chargeback state.
9. Settlement data.
10. The fees or deductions associated with the transaction.
11. Any operational data necessary to prove or process the transaction.

4. The use of payment methods is subject to the payment provider's terms and the relevant financial regulations.

5. The user undertakes not to use a payment method they do not own or have no right to use.

6. The user may not use payment methods in a fraudulent, unlawful manner or in breach of the regulations or the platform's policies.

7. The platform may share limited financial data with the payment provider, the bank, the settlement entity, or the competent authorities to the extent necessary to process the payment, refund, dispute, settlement, compliance, or fraud prevention.

8. The platform bears no responsibility for any glitch, rejection, delay, or restriction from the payment provider, the bank, or the financial entity beyond its reasonable control.

9. The user acknowledges that some payment, refund, or settlement operations may be subject to reviews, restrictions, or time periods imposed by the payment provider, the bank, or the regulations.

10. The platform retains payment records to the extent necessary to prove transactions, protect rights, and comply financially, accounting-wise, and legally.

1. The platform may request the service provider to provide bank-account or IBAN data or any financial data necessary to receive entitlements, verify, or comply.

2. The service provider's bank-account data is used for the following purposes:

1. Verification.
2. Settlement.
3. Transferring entitlements.
4. Handling financial errors.
5. Matching the account holder's name.
6. Complying with regulatory or financial requirements.
7. Preventing fraud or misuse.
8. Handling financial reports, disputes, or conflicts.

3. The bank data the platform may request includes, without limitation:

1. The IBAN.
2. The bank name.
3. The account holder's name.
4. The identity or registration data associated with the account.
5. The verification or matching status.
6. Any other data the payment provider, bank, or compliance requirements request.

4. The service provider bears responsibility for the accuracy, currency, and matching of their bank data.

5. The platform bears no responsibility for the delay, error, or failure of the transfer resulting from providing incorrect, incomplete, or mismatched bank data.

6. The platform may share this data with payment providers, banks, or financial entities to the extent necessary for execution, verification, or compliance.

7. The platform may suspend the entitlements, delay the settlement, or request additional verification if it finds incorrect, incomplete, suspicious, or mismatched bank data.

8. The service provider may not use a bank account that does not belong to them or that they have no right to use to receive entitlements, unless the platform expressly permits that per the controls it adopts.

9. The platform retains bank-account data and settlement records to the extent necessary for financial and accounting compliance, protecting rights, and proving operations.

1. Būlum undertakes to exercise reasonable and professional care to protect data per the regulations and the standards appropriate to the nature of the platform, its services, its resources, and the processing risks.

2. The platform does not provide an absolute guarantee against any error, breach, glitch, technical incident, or unauthorized access, given the nature of the internet, technical systems, and external service providers.

3. The platform, within the limits the law permits, bears no responsibility for any damage, loss, disclosure, leak, or misuse of data arising from:

1. The user's errors.
2. The user sharing their data outside the platform.
3. The user using an insecure device.
4. The user disclosing access codes or the password.
5. Sharing the account with others.
6. The actions of other users beyond the platform's control.
7. Malfunctions or errors of external service providers.
8. General cyberattacks or force majeure.
9. The user's breach of this policy, the Terms of Use, or the adopted policies.
10. Communication, payment, or agreement outside the platform.
11. The user uploading sensitive data or data belonging to others without justification.
12. Using public networks, apps, or insecure tools.

4. This Article does not prejudice any liability established against the platform under a ruling or an applicable law.

5. The platform's taking of a security, operational, or precautionary measure is not an admission by it of responsibility for the origin of the incident.

6. The platform bears no responsibility for the data the user chooses to make public within their profile, service, or public content, whenever its appearance is a result of their choice or the nature of the feature used.

7. The user bears responsibility for their decisions relating to sharing their data with other users inside or outside the platform.

1. The platform is not obliged to disclose to the user its internal mechanisms or the details of its systems or technical tools whenever disclosure could harm the security of the platform or users or facilitate circumvention or misuse.

2. The internal mechanisms and information the platform is not obliged to disclose include, without limitation:

1. The details of the anti-fraud systems.
2. The internal risk rules.
3. The algorithmic ranking criteria.
4. The internal investigation procedures.
5. The internal access logs.
6. The detailed security mechanisms.
7. The risk assessments.
8. The analysis or classification models.
9. The mechanisms for detecting circumvention or off-platform dealing.
10. The technical-monitoring settings.
11. The details of the technical or security infrastructure.
12. The confidential verification procedures or suspicion indicators.

3. This restriction aims to protect the security of the platform and users, prevent circumvention, and preserve the integrity of the systems.

4. This does not prevent the user from exercising their legal rights relating to their data per this policy and the regulations.

5. The platform may provide the user with general or appropriate information about decisions affecting them, without being obliged to reveal technical, security, or operational details that could harm the platform or others.

6. The user may not object to the platform's non-disclosure of its technical secrets or internal mechanisms whenever the non-disclosure is justified by protecting security, privacy, rights, or preventing misuse.

1. Suspending the account, banning it, deleting the app, ending the relationship, or the user stopping using the platform does not lead to deleting all data immediately.

2. The platform may retain limited or necessary data after suspension, banning, deletion, or ending for purposes including, without limitation:

1. Establishing violations.
2. Preventing the return of abusive accounts.
3. Protecting users.
4. Protecting the platform's rights.
5. Handling disputes.
6. Retaining financial records.
7. Complying with the regulations.
8. Preventing fraud.
9. Managing reports and disputes.
10. Proving bookings, payments, or settlements.
11. Preventing circumvention of ban or suspension decisions.
12. Cooperating with the competent authorities when needed.

3. Some data may be anonymized or access to it restricted instead of fully deleting it, if that is more appropriate to protect rights, comply, and reduce risks.

4. If the suspended or banned account belongs to a service provider, the platform may retain additional data necessary to prove the services, entitlements, bookings, reports, and the service provider's obligations.

5. The user may not use a deletion or account-closure request to conceal a violation, evade a financial obligation, or prevent the review of an ongoing report, dispute, or claim.

6. The effect of the obligations relating to confidentiality, data protection, and not misusing others' data continues after suspension, banning, or ending.

1. Būlum undertakes to cooperate with the competent authorities within the Kingdom of Saudi Arabia in accordance with the laws, regulations, and instructions in force.

2. The requested data or information is provided to the competent authorities to the extent necessary and within the scope of the legal request, supervisory requirement, or legal obligation.

3. Cooperation with the competent authorities is not a breach of this policy or a violation of data confidentiality.

4. Cooperation with the competent authorities may include, without limitation:

1. Responding to official requests.
2. Providing certain records upon a legal request.
3. Cooperating in cases of fraud, abuse, threats, or cybercrime.
4. Cooperating in financial, tax, or regulatory requirements.
5. Executing orders or decisions issued by a competent authority.
6. Retaining or preventing the deletion of certain data upon a legal request.
7. Providing what is necessary to protect users, rights, or public order.

5. The platform maintains appropriate records to prove compliance and legal cooperation when needed.

6. The platform may be unable to notify the user of the cooperation or disclosure if notification is legally prohibited, harms the investigation, or conflicts with the request of the competent authority.

1. This policy is interpreted in integration with the Terms of Use, the Financial & Regulatory Policy, the Service Provider Agreement, the Code of Conduct, and any other adopted policies.

2. If the text relates to data privacy, its protection, its processing, and the user's related rights, this policy is the primary reference, unless another document provides higher protection or a more specific detail that does not conflict with the regulations.

3. If the text relates to payment, fees, refund, settlement, entitlements, the dispute window, or financial holds, the Financial & Regulatory Policy applies.

4. If the text relates to the service provider's obligations or their responsibility for service seekers' data, their services, or their entitlements, the Service Provider Agreement applies alongside this policy.

5. If the text relates to users' conduct, content, violations, communication etiquette, or preventing abuse or circumvention, the Terms of Use and the Code of Conduct apply alongside this policy.

6. If there is an apparent conflict between the documents, the texts are interpreted so as to achieve:

1. Protecting personal data.
2. Preserving users' rights.
3. Protecting the platform.
4. Preventing misuse.
5. Preventing circumvention and off-platform dealing.
6. Complying with the Saudi regulations.
7. The stability of financial and operational operations.
8. Not making Būlum responsible for delivering the service or its quality beyond the limits of its role as an organized technology platform.

7. In all cases, the binding laws and regulations in force in the Kingdom of Saudi Arabia prevail where there is an irreconcilable conflict.

1. The Arabic version of this policy is the original and authoritative version.

2. Any translation of this policy into another language is for facilitation purposes only.

3. Where there is a difference in interpretation between the Arabic version and any translation, the Arabic version prevails.

4. No translation, summary, or explanation of this policy is treated as a substitute for the adopted Arabic text, unless Būlum expressly declares otherwise.

1. If any provision of this policy is found invalid or unenforceable, that does not affect the remaining provisions.

2. The invalid or unenforceable provision is replaced with a valid provision that achieves the nearest possible legal and operational purpose to its original intent.

3. The remaining provisions of this policy remain effective and binding to the maximum extent permitted by the regulations.

4. The invalidity or unenforceability of any provision does not disable the rights of the platform or users or the other obligations set out in this policy or the adopted policies.

1. Būlum's failure to exercise any right or power under this policy is not a waiver of that right or power.

2. The platform's delay in taking action against a violation, incident, request, content, or processing is not an acceptance of it or a waiver of its right to take subsequent action.

3. Any waiver of a platform right is valid only if it is written, express, and issued by an authorized entity.

4. The platform retains the right to exercise its rights at any time, unless there is a legal impediment.

1. Būlum may amend or update this policy from time to time in line with the regulations, operation requirements, data protection, and the development of the platform's services.

2. The reasons for amendment or update may include, without limitation:

1. Regulatory changes.
2. Technical changes.
3. Adding new services.
4. Improving privacy procedures.
5. Requirements of the competent authorities.
6. Changes to operation, payment, or communication.
7. Adding new service providers.
8. Developing report or dispute mechanisms.
9. Modifying the types of data being processed.
10. Improving security or governance measures.
11. Updating the relationship with the other policies.

3. Users are notified of material amendments via the app, the notifications tab, email, or any appropriate channel the platform adopts.

4. Publishing the updated policy within the app, the website, or the platform's official channels is sufficient to prove its availability to users, unless the law or the nature of the amendment requires express acceptance.

5. Continued use of the platform after the update or notice is published is deemed acceptance of the updated policy, without prejudice to the user's legal rights.

6. The platform may request a new acceptance upon a material amendment requiring express consent.

7. If the user does not agree to the updates, they must stop using the platform and request the closure of the account per the adopted mechanism, while the obligations and records that must be retained legally or operationally remain.

1. For any inquiry, request, or complaint relating to privacy, personal data, the app, the account, services, reports, or support, contact us through the adopted official channels within the app or the following email:

2. The user's request must include sufficient information to enable the platform to understand the request, verify the requester's identity, and handle it correctly.

3. The platform may request additional information to verify the requester's identity, capacity, or authority before processing the request.

4. The platform undertakes to handle requests seriously and within an appropriate period according to the nature of the request and its legal and operational requirements.

5. The platform is not obliged to execute any request received through an unadopted channel or from a person who does not prove their capacity or authority to represent the user.

6. The channels published within the app, the official website, or this policy are the adopted channels for communication, and the platform may update them whenever needed.