Privacy policy

Molak Marafeq is an AQRX platform operated by Njik Lababak Trading Company (شركة نجيك لبابك التجارية), unified entity number 7037580771. Address: 7389 Prince Majid Branch Street, Al Aziziyah, Jeddah 23442, additional number 2378, Saudi Arabia. Contact: info@njik.sa or +966 12 510 1189.

This policy covers owners, residents, building managers, delegates and other app users. The company determines the purposes of account operation, support and security processing. An owners association or its authorised manager may determine purposes for building-management records. Each party’s responsibilities depend on the actual purpose and service agreement, without reducing data subjects’ rights.

Data varies by your role and the features you use. Not every category is required from every user.

• Account and contact information: name, mobile number, email if provided, role and permissions, verification and terms-acceptance records.
• Buildings and units: name, address, selected location, association details, floors, units and areas, owner or resident status, managers and delegates.
• Financial records: dues, contributions, accounting balances and transactions, invoices, transfer receipts, bank name, account holder and IBAN when a building bank account is recorded.
• Operational content: maintenance requests and attachments, ratings, images, documents, announcements, polls, votes, decisions and approval records.
• Technical data: device and operating-system type, notification token, connection, operation and error logs necessary to deliver and protect the service.

We receive information from you through registration, features and support; from an authorised manager or owner who adds you to a building or unit; and from payment and maintenance providers about your transaction or request. Technical records may be generated during use.

Your mobile number and verification information are necessary for access. Building, unit and transaction details are required for their related features. Email, attachments and permissions are only necessary to the extent required by a specific feature; withholding necessary data may prevent that feature from working.

National ID or residence-permit uploads are not a general registration requirement. Avoid unrelated personal documents and redact other people’s details and card numbers where they are unnecessary.

We process data only to the extent needed for the stated purpose and under the legal ground applicable to that activity.

• Service delivery and performance of an agreement: creating and verifying accounts, linking users to buildings, managing permissions, records, dues and requests, operational updates and support.
• Legal obligations: retaining legally required records, handling official requests and claims, and fulfilling data-subject rights.
• Service security and misuse prevention: legitimate interests where their legal conditions are met and your interests and rights are considered, without unlawfully relying on this ground for sensitive data.
• Consent where required, including permission to use device location or the camera. Using the app is not blanket consent for every purpose. Direct marketing requires the necessary consent and a means to withdraw it.

Location permission is requested when using the building-location feature; you can also select a location manually on the map. The service does not require background tracking of your movements.

Camera, photo and file access supports attachments you choose, such as maintenance photos or payment receipts. Notifications provide building, request and dues updates. You can manage these permissions in device settings; disabling one may prevent the related feature from working.

Notification content may appear on your lock screen depending on your settings. You can hide previews to protect your privacy.

Sharing is based on the service purpose, role and need, not simply membership of the app.

• Building managers and delegates: contact, unit, dues and attachment information needed to manage the building and review payments and requests.
• Owners and residents: content and records they are authorised to access within their building, such as announcements, voting and information about their units. This policy does not permit disclosing others’ information or publicly shaming them over debts.
• Maintenance providers: contact details, location, request description and relevant attachments required for the job, not access to the full building record for that purpose.
• Technology providers: hosting, storage, verification messages, notifications and support within their tasks. Technologies used include Firebase for some attachments and Expo for notifications.
• Payment providers: such as Moyasar for available payments and Apple Pay when selected. Payment information is processed through the payment gateway; platform records include transaction information, status and reference.
• Competent authorities and advisers where there is a legal ground, limited to the request or claim. We do not sell personal data.

Data is processed in the operational systems, databases and storage services used to deliver Molak Marafeq. Some infrastructure and provider services may involve processing outside Saudi Arabia; this policy does not represent that all processing occurs within the Kingdom.

International transfers are subject to the Saudi Personal Data Protection Law and its transfer regulation, including a lawful ground, minimum necessary data, safeguards and risk assessment where required. Contact us for enquiries about the processing or transfer of your data.

Account and building information is retained while necessary for the service and related relationship. Retention depends on the record’s purpose and type, applicable legal and accounting requirements, and any dispute or claim requiring preservation.

When the purpose ends and no retention ground remains, data is destroyed or irreversibly anonymised, including processor-held copies and backups in accordance with legal requirements.

Request account and data deletion by emailing info@njik.sa with “Molak Marafeq — account deletion” and your registered mobile number for verification. Uninstalling the app does not delete the account. Some building or transaction records may need to remain to protect others’ rights or meet legal obligations; we will explain what cannot be deleted and why. Deletion does not cancel dues or other people’s rights.

Subject to the law, you may be informed about processing, access and obtain a readable copy of your data, request correction, completion, updating or destruction, and withdraw consent where it is the processing ground. Withdrawal does not invalidate earlier lawful processing and may affect a feature that depends on that consent.

Email info@njik.sa describing your request and providing your registered mobile number. We may verify identity by an appropriate method without requesting excessive data. Rights requests are handled within 30 days, extendable by up to 30 additional days in legally permitted cases with prior notice and reasons.

For records managed by an owners association, we coordinate with the party responsible for that processing. You may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform. Contacting us does not limit that right.

We take technical and organisational measures appropriate to the data and processing risks and work to restrict access by role. No electronic system is entirely risk-free. Where a breach meets legal reporting criteria, we address it and notify the competent authority and affected people as legally required.

Protect verification codes and access methods, update your phone number when it changes, and report unauthorised access. Managers and delegates must not share residents’ data outside authorised purposes or retain access after their authority ends.

The website may store language preferences locally in your browser and generate technical connection logs. You can remove local storage through browser settings. External websites and app stores have their own policies.

The app is intended for people with the capacity and authority to manage their building relationship, not to collect children’s data. Do not upload such data without a lawful necessity and appropriate authority.

Updates are published here with their date. Material changes to processing purposes receive appropriate notice, and fresh consent is requested before processing where legally required.