ORYX ENERGY HOLDING

Scope of This Policy and the Data Controller

ORYX ENERGY HOLDING respects the privacy of visitors to its website and users of its electronic forms. We are committed to processing personal data responsibly and transparently in accordance with the Saudi Personal Data Protection Law, its Implementing Regulations, and other applicable laws and regulations in the Kingdom of Saudi Arabia.

This Policy explains the types of personal data we collect, how we collect it, the purposes and legal bases for processing it, and how it is used, retained, shared, protected, and securely disposed of. It also explains the rights available to data subjects when using the website or submitting a contact request or an application to join the Group.

ORYX ENERGY HOLDING is the Data Controller for personal data collected through this website. Certain data may be referred to a Group company to process a request based on the category selected by the user. The purpose of the referral and the receiving entity will be disclosed in accordance with this Policy.

Where a Group company acts as an independent Data Controller in a specific case, its identity and responsibilities will be disclosed to the user before their personal data is collected.

Privacy Requests and the Exercise of Rights

Privacy requests and requests to exercise data subject rights may be submitted through the dedicated Privacy Request form available on this website.

Personal Data We Collect and How We Collect It

Data Provided Directly by the User

Full name.
Organization name, when provided.
Mobile number and email address.
Contact category, request subject, and message content.
Files and attachments submitted through the contact form.
Join Us Application data, including city, academic qualification, major, years of experience, target professional field, and preferred company.
Curriculum vitae and professional profile link, when provided.
Other information included by the user in their message or attachments, to the extent necessary to process the request.

Data Collected Automatically

Internet Protocol (IP) address.
Device type, browser, and operating system.
Date and time of the visit and pages accessed.
Error logs, repeated attempts, and security events.
Cookies necessary for the operation of the website.
Analytical or non-essential cookie data, when used and after obtaining the required consent, in accordance with the Cookie Policy.

Methods of Data Collection

Completing the contact form or Join Us Application.
Uploading files and attachments.
Communicating through email or other officially published channels.
Technical use of the website, server logs, and security tools.
Cookies and similar technologies, according to the user’s settings.

Data Minimization

Please do not submit sensitive personal data or information that is not necessary to process your request—such as identification numbers, bank account details, or health information—unless specifically requested for a legitimate and defined purpose and after the legal basis for processing has been explained.

Purposes and Legal Bases of Processing

We process personal data for the following purposes:

Receiving, verifying, responding to, and following up on contact requests.
Directing requests to the relevant department or Group company based on the selected category.
Assessing investment and partnership opportunities and communicating regarding them.
Receiving and evaluating Join Us Applications and communicating with applicants.
Retaining Join Us Applications for consideration in future opportunities, where separate consent has been obtained.
Operating and protecting the website and monitoring errors and unauthorized attempts.
Improving website performance and user experience when approved analytics tools are used.
Fulfilling legal obligations, protecting legal rights, and responding to lawful or judicial requests issued by competent authorities.

Legal Bases

The consent of the data subject.
Performance of an agreement to which the data subject is a party.
Compliance with a legal obligation applicable to ORYX ENERGY HOLDING.
Pursuit of a legitimate interest of ORYX ENERGY HOLDING, following an appropriate assessment and provided that the rights and interests of the data subject are not adversely affected, to the extent permitted by law.
Security or judicial requirements, or the protection of vital interests, where applicable and permitted by law.

Separate Consent

Separate and explicit consent will be requested when analytical or non-essential cookies are used, when a Join Us Application is retained beyond its immediate purpose for consideration in future employment opportunities, or when personal data is used for a new and incompatible purpose whenever consent is required by law.

The data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn or processing based on another valid legal basis.

Data Sharing and Recipients

We do not sell or trade personal data. We may disclose or share personal data to the extent necessary for the specified purpose and based on a valid legal basis.

Relevant departments within ORYX ENERGY HOLDING, according to approved access permissions.
A Group company when the request relates to its business, after clarifying the purpose of the referral and the role of the receiving company.
Providers of hosting, email, cybersecurity, backup, and website operation services, according to each provider’s role and contractual and legal obligations.
Legal advisers, auditors, and other professional advisers, when necessary and within the scope of their responsibilities.
Competent government, regulatory, or judicial authorities where a lawful request or enforceable obligation applies.
Other entities where a legal basis for sharing exists, after informing the data subject and obtaining consent whenever consent is required.

Sharing Controls

Limit the data shared to what is necessary for the specified purpose.
Determine whether the recipient acts as a Data Processor or an independent Data Controller.
Verify that a valid legal basis exists for sharing.
Apply appropriate access, confidentiality, and security controls.
Enter into the necessary agreements with Data Processors and define processing and protection requirements.
Require Data Processors to follow ORYX ENERGY HOLDING’s instructions and the agreed purposes.
Document disclosures and referrals in accordance with applicable legal requirements.

Transfers Outside the Kingdom

Personal data will not be transferred outside the Kingdom of Saudi Arabia unless the applicable legal requirements for cross-border transfers have been satisfied, including identifying the purpose, recipient, destination country, and safeguards applied.

Data Retention Periods and Secure Disposal

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or for the period required by applicable laws. Personal data will not be retained after the purpose has ended without a valid legal basis.

Contact Requests: Until the request is closed, the required follow-up period has ended, and any legal need to retain its record has expired.
Investment and Partnership Requests: Throughout the assessment of the opportunity and related correspondence, followed by the approved legal or contractual retention period.
Join Us Applications Related to a Specific Opportunity: Until the evaluation process is completed and the purpose has ended, unless another valid legal basis requires retention.
Join Us Applications Retained for Future Opportunities: For the period specified in the separate consent notice.
Technical and Security Records: For the period necessary to protect the website, investigate incidents, and meet legal requirements.
Records of Consent, Amendments, and Disclosures: For the period necessary to demonstrate compliance and protect legal rights.

Secure Disposal and Backups

When the purpose or retention period ends, personal data will be securely disposed of in a manner that prevents access or recovery, or permanently and irreversibly anonymized.

Secure disposal may be suspended where a claim, dispute, investigation, or legal obligation requires continued retention. Backup copies remain protected, access-restricted, and subject to defined retention and disposal cycles.

Data Subject Rights and How to Exercise Them

Data subjects have the rights granted under the Saudi Personal Data Protection Law and its Implementing Regulations, subject to applicable legal restrictions and exceptions.

Right to be informed.
Right of access.
Right to obtain a copy.
Right to rectification, completion, and updating.
Right to request destruction where provided by law.
Right to withdraw consent.
Right to submit a complaint.
Right to claim compensation for material or moral damage in accordance with applicable legal procedures.

Exercising Your Rights

Requests may be submitted through the dedicated Privacy Request form available on this website. Additional information may be requested only as necessary to verify the identity of the applicant or their legal representative.

Rights may be exercised free of charge unless applicable laws permit otherwise. If a request cannot be fulfilled wholly or partially, the data subject will be informed of the reason and the available objection or complaint process to the extent permitted by law.

Data Protection and Security Measures

ORYX ENERGY HOLDING implements appropriate organizational and technical measures to protect personal data against unauthorized access, use, disclosure, alteration, loss, or unlawful destruction, taking into account the nature of the data and the level of risk.

No technical measure can guarantee absolute protection. Security controls are therefore reviewed and updated periodically in response to evolving risks, technologies, and legal requirements.

Defining roles and access permissions according to the principle of least privilege.
Separating content creation, review, approval, and publication responsibilities.
Using additional authentication measures for administrative and sensitive accounts.
Protecting communications, databases, files, and backup copies.
Scanning uploaded files and blocking executable or unauthorized file types.
Recording login, access, viewing, modification, referral, and disposal activities.
Updating systems, addressing vulnerabilities, and conducting periodic security testing.
Applying backup, recovery, and business continuity controls.
Reviewing service providers and training authorized users.
Implementing procedures for responding to personal data breach incidents.

Personal Data Breaches and Regulatory Notifications

ORYX ENERGY HOLDING manages personal data breaches according to approved procedures designed to contain the incident, limit its impact, address its causes, and prevent recurrence.

Containing the incident and protecting the affected systems and data.
Determining the time, source, scope, and causes of the incident.
Identifying the types of data and categories of affected data subjects.
Assessing potential harm and risks.
Documenting the incident and the actions and decisions taken.
Implementing corrective measures and cooperating with relevant parties.

Regulatory Notification and Data Subject Communication

The competent authority will be notified within no more than 72 hours from the time ORYX ENERGY HOLDING becomes aware of a breach whenever notification is legally required. Affected data subjects will be notified without undue delay whenever the breach may cause harm or adversely affect their rights or interests.

A security incident does not necessarily require notification. The decision is subject to a documented assessment, and records of all incidents will be retained together with the reasons for the decision.

Cookies and Similar Technologies

The website uses cookies and similar technologies to operate and protect the website, retain user preferences, and measure performance, according to the tools that are actually enabled.

Types of Cookies

Essential Cookies: Required to operate the website and protect forms and sessions.
Preference Cookies: Used to retain user choices when enabled.
Analytics and Performance Cookies: Activated only after obtaining the required consent.
Marketing or Third-Party Cookies: Used only after their purposes have been explained and the required consent has been obtained.

Managing Consent

Users may accept or reject non-essential cookies, select specific categories, modify their choices, or withdraw consent at any time. Non-essential tracking technologies will not be activated before the user’s choice has been recorded, and rejecting them will not affect the website’s essential functions.

Consent and user preferences will be recorded only to the extent necessary to demonstrate and manage them. Consent records will not be used for other incompatible purposes.

Complaints and Contacting the Data Controller

Data subjects may contact ORYX ENERGY HOLDING to inquire about the processing of their personal data, exercise their rights, or submit a complaint concerning the collection, use, sharing, retention, protection, or disposal of their data.

Submitting and Processing a Request

Provide the applicant’s name, contact details, a description of the request or complaint, and the information necessary to identify the relevant matter.
Generate a reference number and issue an acknowledgment of receipt.
Verify the applicant’s identity when necessary and refer the request to the relevant department.
Review the facts and records and notify the applicant of the outcome within the legally prescribed timeframe.
Document the handling process, decisions, and any escalation until the request is closed.

Escalation to the Competent Authority

If the data subject is dissatisfied with the handling of their complaint or believes that their legal rights have been violated, they may submit a complaint through the Complaints Service available on the Saudi National Data Governance Platform, in accordance with the applicable procedures and statutory timeframes.

Privacy Policy Updates and Effective Date

ORYX ENERGY HOLDING may update this Policy in response to changes in applicable laws and regulations, personal data processing practices, website services, technical infrastructure, or the entities with which personal data is shared.

Where a material update is made, ORYX ENERGY HOLDING will describe the changes, update the date of the latest revision, notify data subjects when necessary, obtain renewed consent where required, and retain a record of previous versions of the Policy.

The updated version will take effect on the date specified in it. Any update to this Policy will not affect the lawfulness of personal data processing carried out before the updated version became effective.

Effective Date: Upon publication on the official domain.

Last Updated: 6 October 2026.