First: Introduction:
The Communications, Space & Technology Commission (CST) was established pursuant to the esteemed Council of
Ministers Resolution No. (74) dated 05/03/1422 AH, as amended by Council of Ministers Resolution No. (133) dated
21/05/1424 AH, further amended by Resolution No. (120) dated 21/02/1440 AH, and most recently amended by
Resolution
No. (430) dated 23/06/1446 AH. CST is vested with legal personality and financial and administrative
independence to
fulfill its objectives.
CST is committed to protecting the privacy and confidentiality of the personal data of users of its official
website, digital services and platforms, and affiliated mobile applications. Recognizing the paramount
importance of
data and protecting Data Subjects' privacy, this Policy has been developed to enable Data Subjects to understand
the
nature of personal data collected, their rights concerning such data, and the means by which these rights may be
exercised.
The use of CST’s website or any of its related official channels shall be deemed as the user’s acceptance of
this
Policy.
Second: Contact Data:
- Address: Al-Nakheel District – Intersection of Prince Turki bin Abdulaziz Al Awwal Road and Imam Saud bin
Abdulaziz Bin Mohammed Road.
- Email: Info@cst.gov.sa
- Telephone No. 19966
- P.O. Box: 75606 -Riyadh 11588
Third: Privacy Policy Updates:
- The Privacy Policy was last updated on July 13, 2025.
- CST reserves the right to amend this Privacy Policy, whether in part or in whole, at any time and without
prior
notice. Such amendments shall become effective upon their publication on CST’s official website or any of
its
related official channels.
Fourth: Personal Data Collected:
CST collects personal data through the following means:
- Direct Data Collection: Personal data provided directly by User when utilizing CST’s digital services
and
platforms. This includes, but not limited to: Full Name, National ID Number, Nationality, Full Address,
Contact
Numbers, and Email Address, in addition to other data of a personal nature.
- Indirect Data Collection: Personal data may also be collected indirectly through the use of cookies
when
visiting CST’s website.
The right to access User data and information is strictly limited to authorized personnel within CST and shall
be
used solely for the purposes and uses defined by CST’s regulations and relevant applicable laws.
Fifth: Use of Personal Data:
Personal data is used for the purpose of completing the registration process, enabling access to the services
provided by CST, verifying the identity of the User benefiting from such services, and enhancing overall User
experience.
Sixth: Legal Justifications for Collecting and Processing Personal
Data:
CST relies on legal justifications, as stipulated in the applicable laws and regulations, for the collection and
processing of personal data. These justifications include, but not limited to, the explicit consent of the Data
Subject, compliance with legal or contractual obligations, protection of vital or public interests, or the
pursuit
of legitimate interests or objectives.
Seventh: Personal Data Processing:
Personal data processing is strictly limited to the purpose for which it was collected.
Eighth: Data Storage:
CST stores personal data within the Kingdom of Saudi Arabia in a secure and reliable environment, in compliance
with
the regulations of the National Cybersecurity Authority and other applicable national laws. Data is retained in
accordance with the statutory procedures.
Ninth: Data Disposal:
Data shall be destroyed once the purpose for which it was collected has been fulfilled, by using:
- Digital Data: Secure deletion techniques, such as encryption followed by deletion,
or
data overwriting.
- Paper-Based Data: Shredding using shredding machines.
Tenth: Disclosure of Personal Data:
Some personal data may be disclosed to third parties in accordance with the applicable regulations in the
Kingdom,
for the purpose of enhancing the quality of services provided to users or to entities authorized by law.
Eleventh: Rights of Personal Data Subjects:
Right to Be Informed:
- Data Subjects have the right to be informed about how their personal data is collected, the legal basis for
its
collection and processing, the methods used for processing, storage, and disposal, and the parties with whom
their data may be shared. Full details are provided in this Privacy Policy, and you may also contact us via
the
communication channels specified herein.
Right to Access Personal Data:
- Data Subjects have the right to request a copy of their personal data.
Right to Data Portability:
- Data Subjects have the right to receive a copy of their personal data in a clear, readable, and structured
format.
Right to Rectify Personal Data:
- Data Subjects have the right to request the correction of their personal data that they deem inaccurate,
incorrect, or incomplete.
Right to Erasure:
- Data Subjects have the right to request the destruction of their personal data under certain circumstances,
unless a legal provision specifies a particular retention period or contractual requirements.
Right to Withdraw Consent for Processing Personal Data:
- Data Subjects have the right to withdraw their consent for the processing of their personal data at any
time,
unless there are legal justifications that require otherwise.
Twelfth: Exercising the Rights of the Personal Data Subject:
For more information regarding the processing of personal data and how to exercise the aforementioned rights,
you
may contact us via email at: Info@cst.gov.sa
Thirteenth: Security procedures:
CST implements stringent security measures to protect data from unauthorized access, including:
- Regularly updates of security procedures.
- Utilization of advanced encryption systems.
- Continuous monitoring of systems.
Fourteenth: Complaints and Inquiries:
If you have any complaints or inquiries related to the Privacy Policy or the processing of personal data, please
contact us at the following email address: Info@cst.gov.sa.
Fifteenth: General Provisions:
- CST is committed to protecting personal data in accordance with the policies and procedures approved by the
National Data Management Office (NDMO), adhering to the principles of transparency, data minimization,
specified
purpose, data security, and protecting the rights of Data Subjects. Data shall be collected and processed
based
on clear and declared legal grounds.
- The laws of the Kingdom shall exclusively govern all disputes or complaints that may arise from the use of
the
website or any of CST’s official channels.
- Arabic shall be the official language for the application of these terms and conditions. In case of any
dispute
regarding the interpretation of any provision stated in another language, the Arabic text shall prevail.