1. Who we are
Ula Capital (“Ula Capital”, “we”, “us” or “our”) is responsible for the personal data it collects through this website. This policy explains how we collect, use, retain, disclose and protect personal data when you visit our website, contact us, submit an enquiry, apply to engage with us, or subscribe to receive communications.
This policy is intended to support transparency under the Saudi Arabian Personal Data Protection Law (“PDPL”) and its implementing regulations, where applicable. It does not limit any rights that may be available to you under applicable law.
2. Personal data we may collect
Depending on how you interact with us, we may collect the following categories of personal data:
- Contact and identification data, such as your name, email address, company, role and any other details you provide through a form or correspondence.
- Enquiry and relationship data, such as whether you identify as an investor or startup, the message you send us, and documents or materials you choose to upload.
- Technical and usage data, such as device, browser, IP-address, pages viewed and interaction information generated through cookies or similar technologies, where used.
- Communication preferences, including whether you have opted in to receive marketing or updates and any withdrawal or unsubscribe request.
Please do not send sensitive personal data or confidential third-party information through this website unless it is necessary and you have an appropriate basis to do so.
3. Why and on what basis we use personal data
We use personal data only for clear, specific and proportionate purposes. These may include responding to an enquiry; assessing and managing a potential relationship with a startup, investor or other contact; operating, securing and improving our website; maintaining records; meeting legal or regulatory obligations; and, where you have chosen to receive them, sending relevant updates or marketing communications.
Where required by applicable law, we rely on your consent. We may also process personal data where it is necessary to take steps you request, to comply with a legal obligation, or for a legitimate interest that is permitted by applicable law and does not override your rights and interests. We do not use personal data for a materially incompatible purpose without providing the information or obtaining the consent required by law.
4. How we share personal data and international processing
We may share personal data with service providers that support our website, communications, technology, security, professional advisory or business operations. We require relevant providers to process personal data only for authorised purposes and to apply appropriate safeguards.
If personal data is transferred, disclosed or processed outside the Kingdom of Saudi Arabia, we will do so only where permitted by applicable law and with the safeguards required for the relevant transfer. We will limit the data involved to what is necessary for the stated purpose.
We may also disclose personal data where required or permitted by law, to protect rights, safety or security, or in connection with a corporate transaction, subject to applicable requirements.
5. Retention and security
We retain personal data only for as long as needed for the purpose for which it was collected, to meet applicable legal or regulatory requirements, to resolve disputes, or to establish, exercise or defend legal claims. When personal data is no longer required, we will delete, anonymise or otherwise dispose of it in accordance with applicable requirements.
We use reasonable organisational, administrative and technical measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No internet transmission or storage system is completely secure; please use appropriate care when sending information online.
6. Your privacy rights
Subject to applicable law and any lawful limitations, you may have the right to be informed about processing of your personal data; request access to it; request a readable copy; request correction, completion or updating; request destruction where the data is no longer needed or was unlawfully processed; and withdraw consent where consent is the basis for processing. You may also have rights relating to direct marketing communications.
We may need to verify your identity before completing a request. We aim to respond within the periods required by applicable law. Under the PDPL implementing regulation, controllers generally act on rights requests within 30 days, with a possible notified extension in limited circumstances.
7. Direct marketing
We will seek the consent required by applicable law before sending direct marketing communications using personal contact details. You can opt out at any time by using an unsubscribe option in a communication where available or by submitting a request through our Contact page. Withdrawing consent does not affect processing already carried out before withdrawal where it was lawful.
8. Cookies and similar technologies
Our use of cookies and similar technologies is described in our Cookie Policy. Where non-essential cookies are used and consent is required, we will provide an appropriate choice mechanism before placing or reading them.
9. Changes to this policy
We may update this policy from time to time to reflect changes in our website, processing activities or legal requirements. We will post the updated version on this page and revise the “Last updated” date.
10. Contact and privacy requests
To ask a privacy question or exercise a data-protection right, please use our Contact page and include “Privacy Request” in your message. Please provide enough detail for us to identify your request and respond appropriately.
You may also have a right to lodge a complaint with the competent authority where applicable. For information about Saudi data protection, visit the Saudi Data & AI Authority’s Data Protection page.