Draft for legal review, July 2026. This notice has been prepared to mirror the equivalent Olayan Group notice and adapted to this website. It has not yet been approved by Olayan legal and is not the final published wording. Passages in square brackets are values Olayan legal is to supply.
We respect your right to privacy. This Privacy Notice explains who we are, and how we collect, use, share and look after personal information about you in connection with the Al Bustan Business Park website.
What does this Privacy Notice cover?
This notice covers personal information we collect about two groups of people: visitors, meaning anyone who browses this website; and enquirers, meaning anyone who contacts us through the site about leasing space, a partnership or a supplier relationship at the park.
In this notice, “we”, “us” and “our” mean [controller legal entity and registered address to be supplied], the organisation responsible for this website and for the personal information described here. “You” means the individual the information is about, and “personal information” means information from which you can be identified.
This notice describes the processing carried out through this website. Where your information is also handled by the wider Olayan Group — for example if your enquiry is passed to a group company — the Olayan Group Privacy Notice applies to that handling and is incorporated into this notice by reference.
What is Al Bustan Business Park?
Al Bustan Business Park is a business park development in Riyadh, Kingdom of Saudi Arabia, comprising five office buildings together with food and beverage, retail, fitness, childcare and landscaped amenities. This website presents the development and provides a way to enquire about space and partnership opportunities. It is part of the Olayan Group, a multinational enterprise whose parent company is based in Riyadh.
What personal information do we collect, why, and what is our legal basis for processing it?
Under the Saudi Personal Data Protection Law we must have a lawful basis for each use of your personal information. Where the General Data Protection Regulation also applies — for instance if you contact us from the European Economic Area or the United Kingdom — we rely on the equivalent basis under that regulation.
Information we collect about visitors
When you browse the site, our hosting and analytics services collect the following automatically:
- your IP address, and the approximate region it indicates
- the type of device, operating system and browser you are using
- the pages you view, how long you spend on them, and the site or search that referred you
- the language you chose to read the site in
We use this to keep the site secure and available, to diagnose faults, and — only where you have allowed analytics cookies — to understand which parts of the site are useful so we can improve them. Our legal basis is our legitimate interest in running a secure, working website, and for analytics it is your consent, which you may withdraw at any time. Our Cookie Notice sets out exactly which cookies are involved.
Information we collect about enquirers
When you submit the enquiry form, we collect what you choose to give us:
- your name
- your email address and, if you provide it, your telephone number
- your preferred method of contact
- the details of your enquiry, including any company or organisation you mention and the space or opportunity you are interested in
We use this information to respond to your enquiry, to discuss leasing, partnership and supplier opportunities at the park with you, and to keep a record of our dealings. Our legal basis is your consent in submitting the form, together with our legitimate interest in responding to enquiries about the development and in keeping accurate business records; where discussions progress to an agreement, we also process what is necessary to perform that contract.
If we need to carry out identity, credit or compliance checks before entering into an agreement with you or the organisation you represent, we will tell you at the time and explain what that involves. Our legal basis for those checks is compliance with our legal obligations and our legitimate interest in preventing fraud.
We do not sell your personal information, and we do not use it to make automated decisions about you.
With whom do we share your personal information?
We share personal information only where there is a reason to, and only with:
- other Olayan Group companies, where they are involved in the development, leasing or management of the park
- the leasing agents, property managers and professional advisers acting for the park, who may need to respond to your enquiry on our behalf
- service providers who run parts of this website and our correspondence for us — hosting, email, form handling, spam protection and website analytics — and who may only act on our instructions
- law enforcement, regulators, courts and other authorities, where we are required to disclose information by law or where disclosure is necessary to establish or defend legal rights or to protect someone’s vital interests
- anyone else, where you have asked us to or agreed that we may
Cookies and similar tracking technology
This website uses cookies and similar technologies. Our Cookie Notice explains which ones, what each is for, how long it lasts, and how you can change or withdraw your consent at any time.
How do we keep your personal information secure?
We maintain technical and organisational measures designed to give a level of security appropriate to the risk — including encryption of the site in transit, restricted access to the systems that hold enquiries, and spam and abuse protection on our forms. No transmission over the internet can be guaranteed completely secure, so please do not send us sensitive information through the enquiry form.
International transfers of personal information
This website and the systems that receive your enquiry are hosted in [hosting region to be confirmed]. Some of the service providers we rely on — in particular Google, for form protection and website analytics — process information outside the Kingdom of Saudi Arabia.
The Personal Data Protection Law restricts transfers of personal data outside the Kingdom. Where we make such a transfer, we do so on one of the bases the law permits, and we put appropriate safeguards in place with the recipient. Where the General Data Protection Regulation also applies to a transfer, we rely on an adequacy decision or on standard contractual clauses. You can ask us for details of the safeguards applying to a particular transfer.
How long do we keep your personal information?
We keep personal information only for as long as we have a legitimate business need for it. Enquiries that do not lead to a relationship are kept for [retention period to be confirmed] and then deleted; where a leasing, partnership or supplier relationship follows, we keep records for as long as that relationship lasts and afterwards for the period our legal, tax and accounting obligations require. Where information no longer needs to be identifiable, we anonymise it instead of deleting it.
Your data protection rights
Under the Personal Data Protection Law you have the right to:
- be informed of the legal basis and purpose for collecting your personal information
- access the personal information we hold about you
- obtain a copy of your personal information in a readable, clear format
- ask us to correct, complete or update your personal information
- ask us to destroy personal information we no longer need
You may also withdraw any consent you have given us at any time. Withdrawing consent does not affect the lawfulness of anything we did with your information beforehand. Where the General Data Protection Regulation applies to you, you additionally have the right to object to processing, to ask us to restrict it, and to ask us to transfer your information to another organisation.
To exercise any of these rights, please contact us using the details below. We will respond within the time the law allows. If you are not satisfied with our response, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), which supervises the Personal Data Protection Law, or — where the General Data Protection Regulation applies — to the data protection authority in your country.
Updates to this Privacy Notice
We may update this notice from time to time, for instance when what we do with personal information changes or when the law or regulatory guidance changes. The date at the top of this notice tells you when it was last revised. Where a change materially affects you, we will take appropriate steps to bring it to your attention.
How to contact us
To ask a question about this notice, to exercise any of your rights, or to raise a concern about how your personal information is handled, please get in touch through the contact page or write to us at [privacy contact address to be supplied].