OCTOPUS – House Cleaning Service

Customer Privacy Policy — Kingdom of Saudi Arabia

Effective Date: 07/07/2026

1. Introduction

This Privacy Policy ("Policy") explains how Company Mawjat Afkar LLC, a company registered in the Kingdom of Saudi Arabia. ("Octopus", "Mawjat Afkar", "we", "us", or "our") collects, uses, discloses, and protects the personal data of customers ("Customer", "you") who use the Octopus mobile application and website (the "Platform") to book home cleaning and domestic staffing services within the Kingdom of Saudi Arabia.

This Policy is issued in accordance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19/1443H, and its Implementing Regulations, as may be amended from time to time. By using the Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read together with our Terms and Conditions. In the event of any conflict between the two specifically regarding the handling of personal data, this Policy shall prevail.

2. Data We Collect

We collect the following categories of personal data, depending on how you interact with the Platform:

Identity and contact data: full name, mobile number, and, where required for verification or invoicing purposes, national ID or Iqama number.
Account data: login credentials, account preferences, and booking history.
Location data: your home or service address, and, where you grant permission, your device's real-time location, to enable accurate service delivery and Worker routing.
Payment data: payment method type and transaction confirmation details. Full card numbers and sensitive payment credentials are collected and processed directly by our licensed payment service providers and are not stored on Octopus's own systems.
Booking and service data: service type, schedule, special instructions, and communications with Partner Companies or Workers made through the Platform.
Technical data: device type, operating system, IP address, app usage data, and crash/diagnostic logs, collected automatically to maintain and improve the Platform.
Customer support data: records of your correspondence with our support team, including complaints, feedback, and ratings.

3. Purpose and Legal Basis for Processing

We process your personal data for the following purposes, and on the following legal bases recognized under the PDPL:

To create and manage your account, and to process and fulfil your Bookings — necessary for the performance of our contract with you.
To process payments through our licensed payment service providers — necessary for the performance of our contract with you.
To match your Booking with an appropriate Partner Company and Worker, and to share necessary details (such as your address and special instructions) with them for that purpose — necessary for the performance of our contract with you.
To communicate with you regarding your Bookings, respond to support requests, and send service-related notifications — necessary for the performance of our contract with you, or based on our legitimate interest in providing responsive customer service.
To send you promotional offers or marketing communications — based on your consent, which you may withdraw at any time.
To detect, investigate, and prevent fraud, abuse, or violations of our Terms and Conditions — based on our legitimate interest in protecting the security and integrity of the Platform.
To comply with applicable legal, regulatory, tax, or governmental requirements — necessary for compliance with a legal obligation.

4. How We Share Your Data

We share your personal data only as necessary for the purposes described in this Policy, and with the following categories of recipients:

Partner Companies and the Workers they assign to your Booking, to the extent necessary to enable them to deliver the Service (e.g., your address, requested service details, and contact number).
Licensed payment service providers, to process your payment in compliance with regulations of the Saudi Central Bank (SAMA).
Technology service providers who support our infrastructure, such as cloud hosting, analytics, and customer support tools, under contractual confidentiality and data protection obligations.
Government authorities or regulators, where disclosure is required by applicable KSA law, a valid legal process, or to protect the rights, safety, or property of Octopus, our Customers, or the public.
A successor entity in the event of a merger, acquisition, or sale of business assets, subject to that entity's assumption of obligations equivalent to those in this Policy.

We do not sell your personal data to third parties.

5. Cross-Border Data Transfers

Where any of our technology service providers process or store data outside the Kingdom of Saudi Arabia, we ensure that such transfers comply with the requirements of the PDPL and its Implementing Regulations, including verifying that the destination country provides an adequate level of protection, or by putting in place appropriate contractual safeguards, as required.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including to maintain your account, provide the Services, comply with applicable tax and legal record-keeping obligations, and resolve disputes. Where you close your account, we will delete or anonymize your personal data within a reasonable period, except where retention is required to comply with a legal obligation or to establish, exercise, or defend legal claims.

7. Your Rights

Under the PDPL, you have the right to:

Be informed of the legal basis and purpose of collecting your personal data.
Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete personal data.
Request destruction of your personal data where it is no longer required for the purpose for which it was collected, subject to applicable legal retention requirements.
Withdraw your consent at any time, where processing is based on consent (such as marketing communications), without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in Section 11 below. We will respond to your request within the timeframe required under the PDPL and its Implementing Regulations.

8. Data Security

We implement reasonable technical and organizational measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including access controls, encryption of sensitive data in transit, and contractual obligations on third-party service providers. No system can guarantee absolute security, and we encourage you to keep your account credentials confidential.

9. Children's Privacy

The Platform is intended for use by individuals who are at least 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that data.

10. Cookies and Similar Technologies

Our Platform may use cookies, SDKs, and similar technologies to remember your preferences, maintain your session, and understand how the Platform is used, so that we can improve its performance. You may control cookie preferences through your device or browser settings, though disabling certain cookies may affect the functionality of the Platform.

11. Contact Us

If you have questions about this Policy, or wish to exercise any of your rights under the PDPL, please contact us at: support@octopus.com.sa

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices or applicable law. Material changes will be notified to you through the Platform or by other reasonable means, and the 07/07/2026 at the top of this Policy will be updated accordingly. Continued use of the Platform after such notice constitutes acceptance of the revised Policy.