Privacy and Data protection

Introduction

The Small and Medium Enterprises Bank (“SME Bank”) was established pursuant to Council of Ministers Resolution No. (376) dated 04/07/1442H. Its purpose is to increase the financing available to the SME sector and close the financing gap, to strengthen the contribution of financial institutions in providing innovative financing solutions, and to achieve financial stability for this vital sector — so that it becomes a cornerstone of economic development in the Kingdom of Saudi Arabia and an enabler of Vision 2030.

SME Bank places the confidentiality of its users’ and visitors’ data and information at the top of its priorities, and the website administration makes every effort to deliver a high-quality service to all beneficiaries. The privacy and confidentiality practices set out below form part of the terms and conditions governing the use of the Bank’s website, in line with the terms and conditions applicable in the Kingdom of Saudi Arabia.

The data we collect and the purpose of collection

The personal data collected for the purpose of processing financing applications:

• Full name

• ID number

• Mobile number

• Email address

The Bank processes the personal data it obtains for the following purposes:

• Verifying users’ identities and data;

• Managing the relationship with users and financing entities;

• Credit advisory;

• Receiving, enquiring about, following up on and responding to applications;

• Receiving complaints;

• Enhancing the beneficiary experience.

Methods of data collection

Data is collected through the registration of the beneficiary (the data subject); no personal data is collected from any other parties.

Personal data is also collected indirectly through cookies gathered when visiting the Bank’s official website.

Use of personal data

Personal data is used to complete registration on the website and to submit financing applications, to provide credit advisory, and to enhance the beneficiary experience.

Storage and disposal of personal data

Personal data is stored on servers located within the Kingdom of Saudi Arabia. These servers are protected using leading technologies, in accordance with the policies and controls of the National Cybersecurity Authority and international standards, to prevent unauthorized access and mitigate cyber risks.

Legal basis for collecting and processing personal data

Personal data is collected and processed on the basis of the data subject’s consent. The data subject has the right to withdraw their consent to the collection and processing of their personal data at any time, unless another legal basis permits such processing. For any enquiry in this regard, the data subject may contact the Data Protection Officer at the Data Management Office of SME Bank at DPO@smebank.gov.sa

Rights of the data subject

In accordance with the provisions of the Personal Data Protection Law and its Implementing Regulations, the data subject has the following rights:

• Right to be informed — to know how their data is collected, the legal bases for its collection and processing, how it is processed, stored and disposed of, and with whom it will be shared.

• Right of access — to request a copy of their personal data in accordance with legal requirements, via the email specified in Clause 11; the copy is provided by email.

• Right to rectification — to amend or update their personal data if it is inaccurate, incorrect or incomplete, via DPO@smebank.gov.sa; the request and data are reviewed, updated and the data subject notified within thirty days.

• Right to erasure — to request the disposal of their personal data in accordance with statutory requirements, by contacting the Bank at the email specified in Clause 11.

• Right to withdraw consent — the data subject may withdraw consent to the processing of their personal data at any time, unless there are legitimate purposes that require processing to continue.

Sharing / exchange of personal data

Except as provided by the applicable statutory provisions, personal data collected through the Bank’s website is not shared or exchanged with any other parties.

External links

Links to other websites are provided on the SME Bank website to meet users’ needs. However, the Bank is not responsible for the contents of these websites or for any problems that may arise from their use. The user is responsible for their own conduct while using any websites accessed through the links available on the Bank’s website.

Exercising the rights of the data subject

The data subject may request access to, rectification of, or disposal of their data by contacting the Data Protection Officer at DPO@smebank.gov.sa or Dmo@smebank.gov.sa

Data Protection Officer

Name: Data Protection Officer

Email: DPO@smebank.gov.sa & Dmo@smebank.gov.sa

Complaints and enquiries

If you have any complaints or enquiries relating to the privacy policy or the management of personal data, you may contact the website administration at Smebankcare@smebank.gov.sa

If you do not receive a response within seven (7) working days, you may submit the complaint or enquiry to the Data Protection Officer at DPO@smebank.gov.sa or Dmo@smebank.gov.sa

Updates to the privacy policy

The privacy policy was last updated on 3 August 2026.

Website administration

The entity supervising the website: Small and Medium Enterprises Bank (SME Bank).