Last updated: 07 October 2026

1. Who we are and what this policy covers

This Privacy Policy explains how Morood Capital Company (“Morood“, “we“, “us“) collects, uses, discloses, stores and destroys personal data when you visit www.moroodcapital.com (the “Website“) or contact us through it.

It is issued under the Personal Data Protection Law promulgated by Royal Decree No. (M/19) dated 9/2/1443H, as amended by Royal Decree No. (M/148) dated 5/9/1444H (the “PDPL“), its Implementing Regulations, and the Regulations on Personal Data Transfer outside the Geographical Boundaries of the Kingdom.

Morood is the data controller for the personal data described here. Our details:

Legal name	Morood Capital Company
Commercial Registration No.	7054207233, with license number 25331-12 issued by the Capital Market Authority
Address	2391 Prince Mohammed Bin Salman Road, 7988, Hiteen District, Riyadh, 12314 Saudi Arabia
Privacy contact	info@moroodcapital.com
Telephone	+966 11 270 4338

This policy covers the Website only: browsing, contact and enquiry forms, newsletter sign-ups, and job applications submitted online.

Personal data we process when onboarding or servicing investors and clients (for example, identity verification and anti-money-laundering checks) is covered by a separate client privacy notice provided at the start of that relationship.

Please read this policy before giving us any personal data.

2. Personal data we collect and how

We collect only what we need for the purposes in Section 3. We do not intentionally collect sensitive data (such as health, religious or criminal-record data); please do not include it in messages to us.

Category	Examples	How we collect it	Required?
Contact and enquiry data	Name, email, phone, company, job title, country, message	Contact or investor-enquiry form; email	Name and email required; rest optional
Newsletter and updates data	Email address, name, content preferences	Website sign-up	Email required
Job applicant data	Name, contact details, CV, qualifications, employment history, nationality, references	Careers page	Required
Technical data	IP address, browser, device, operating system, time zone, referring page	Automatically, by our servers and cookies	Automatic; see Section 4
Usage data	Pages viewed, time on page, links clicked, approximate location (city level)	Automatically, through analytics cookies	Only with your cookie consent
Communications records	Correspondence with us and our replies	When you contact us	Kept automatically as part of our reply

If you do not provide required data, we may be unable to respond, send updates or consider your application; there is no other consequence.

Data from third parties. We may receive limited data from recruitment agencies and referral partners. Unless a PDPL exception applies, we will tell you within 30 days, including the source.

3. Why we use your data and our legal basis

Each use below has a specific, clear purpose, and a legal basis recognized by the PDPL. We will not use your data for a new, unrelated purpose without telling you and, where required, obtaining your consent.

Purpose	Legal basis under the PDPL
Responding to your enquiries and requests	Legitimate interest in answering people who contact us
Send newsletters, market updates and event invitations	Your consent, which you can withdraw at any time
Assess job applications and recruit	Legitimate interest in evaluating candidates and managing recruitment. Where sensitive personal data is processed, we rely on an appropriate lawful basis, including explicit consent where required.
Operate, secure and maintain the Website	Legitimate interest in keeping the Website functional and secure
Understand how the Website is used and improve it	Your consent (through our cookie banner)
Comply with laws, regulatory requests and court orders (including Capital Market Authority rules where applicable), and establish, exercise or defend legal claims	Compliance with a legal obligation; legitimate interest in establishing or defending legal claims

Legitimate interest. We never rely on legitimate interest to process sensitive data.

Consent. You can withdraw consent at any time through the unsubscribe link, our cookie settings or by contacting us. This does not affect earlier processing.

4. Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. We use essential cookies to make the Website work and, only with your consent, other cookies (such as analytics) to understand how the Website is used and improve it.

You can change your choices at any time through our cookie settings or your browser. Blocking essential cookies may stop parts of the Website from working.

5. Who we share your data with

We do not sell your personal data. We share it only with the parties below, and only as far as needed.

Recipient	Why
Website hosting and IT providers	Host the Website and store form submissions
Email and newsletter provider	Send newsletters and manage subscriptions
Analytics provider	Measure Website usage
Recruitment platform	Receive and manage job applications
Morood group companies	Only where necessary to route or respond to your enquiry regarding a specific Morood entity or fund, subject to applicable confidentiality and data-protection requirements.
Professional advisers	Legal, audit and compliance advice
Government and regulatory authorities	When required by law

Our service providers may use your data only on our instructions and must protect it in line with the PDPL. If Morood is involved in a merger or restructuring, your data may pass to the new owner, who must protect it under the PDPL.

6. Transfers outside the Kingdom

Some of our service providers in Section 5 store or process data outside Saudi Arabia, depending on where those providers or their servers are located.

We transfer personal data outside the Kingdom only as the PDPL allows, and only the minimum needed.

Each transfer relies on the destination country’s adequate level of protection, appropriate safeguards (such as SDAIA’s standard contractual clauses), or the need to reach an agreement with you. You may ask us which mechanism applies to a specific transfer.

7. How long we keep your data and how we destroy it

We keep personal data only as long as needed for the purpose we collected it for, or longer where the law requires or where it is needed for a legal claim. We then securely destroy it or anonymize it.

8. How we protect your data

We apply organizational, administrative, and technical measures to protect personal data against unauthorized access, loss, alteration, or disclosure.

We maintain procedures for identifying, assessing, managing and reporting personal data breaches. If a personal data breach occurs that may cause harm to you or otherwise requires notification under applicable laws and regulations, we will take the necessary actions and make the required notifications in accordance with the PDPL and its Implementing Regulations.

9. Your rights and how to use them

Under the PDPL you have the following rights, free of charge:

Right	What it means
Right to be informed	To know how and why we process your data.
Right of access	To access the personal data we hold about you.
Right to a copy	To receive a copy of your data in a readable format.
Right to correction	To have inaccurate or incomplete data corrected.
Right to destruction	To have your data destroyed when it is no longer needed, unless the law requires us to keep it.
Right to withdraw consent	To withdraw consent at any time where we rely on it.

How to make a request. Email: info@moroodcapital.com or write to us at the address in Section 1. We may need to verify your identity first.

When we will respond. We will respond within 30 days. In some cases, we may extend this by up to 30 more days and will tell you why. We may decline a request where the PDPL permits and will explain the reason.

10. Other important information

Children. The Website is not directed at persons under 18 or persons lacking full legal capacity. We do not knowingly collect their personal data without the consent of their legal guardian and will destroy any such data of which we become aware.

Marketing. We send marketing and awareness communications only with your prior consent. Each communication identifies Morood as the sender and provides a means to unsubscribe.

Links to other websites. The Website may contain links to third-party websites. Morood is not responsible for their privacy practices.

Changes to this policy. We may amend this policy from time to time, including to reflect changes in applicable law or our practices. The amended policy will be posted on the Website with a revised “Last updated” date and, where changes are material, we will notify you by appropriate means.

Complaints. You may submit any complaints to us at support@moroodcapital.com. You also have the right to lodge a complaint with SDAIA in accordance with the PDPL, through sdaia.gov.sa. You may also seek compensation before the competent court for any damage resulting from a breach of the PDPL.

Contact us. Morood Capital Company, 2391 Prince Mohammed Bin Salman Road, 7988, Hiteen District, Riyadh 12314, Kingdom of Saudi Arabia, Email: info@moroodcapital.com, Tel: +96611 2704338.

Governing Law: This policy is governed by the laws of the Kingdom of Saudi Arabia.