First: Introduction:
The Communications, Space & Technology Commission (CST) was established pursuant to the esteemed Council of Ministers Resolution No. (74) dated 05/03/1422 AH, as amended by Council of Ministers Resolution No. (133) dated 21/05/1424 AH, further amended by Resolution No. (120) dated 21/02/1440 AH, and most recently amended by Resolution No. (430) dated 23/06/1446 AH. CST is vested with legal personality and financial and administrative independence to fulfill its objectives.
CST is committed to protecting the privacy and confidentiality of the personal data of users of its official website, digital services and platforms, and affiliated mobile applications. Recognizing the paramount importance of data and protecting Data Subjects' privacy, this Policy has been developed to enable Data Subjects to understand the nature of personal data collected, their rights concerning such data, and the means by which these rights may be exercised.
The use of CST’s website or any of its related official channels shall be deemed as the user’s acceptance of this Policy.
Second: Contact Data:
- Address: Al-Nakheel District – Intersection of Prince Turki bin Abdulaziz Al Awwal Road and Imam Saud bin Abdulaziz Bin Mohammed Road.
- Email: Info@cst.gov.sa
- Telephone No. 19966
- P.O. Box: 75606 -Riyadh 11588
Third: Privacy Policy Updates:
- The Privacy Policy was last updated on July 13, 2025.
- CST reserves the right to amend this Privacy Policy, whether in part or in whole, at any time and without prior notice. Such amendments shall become effective upon their publication on CST’s official website or any of its related official channels.
Fourth: Personal Data Collected:
CST collects personal data through the following means:
- Direct Data Collection: Personal data provided directly by User when utilizing CST’s digital services and platforms. This includes, but not limited to: Full Name, National ID Number, Nationality, Full Address, Contact Numbers, and Email Address, in addition to other data of a personal nature.
- Indirect Data Collection: Personal data may also be collected indirectly through the use of cookies when visiting CST’s website.
The right to access User data and information is strictly limited to authorized personnel within CST and shall be used solely for the purposes and uses defined by CST’s regulations and relevant applicable laws.
Fifth: Use of Personal Data:
Personal data is used for the purpose of completing the registration process, enabling access to the services provided by CST, verifying the identity of the User benefiting from such services, and enhancing overall User experience.
Sixth: Legal Justifications for Collecting and Processing Personal Data:
CST relies on legal justifications, as stipulated in the applicable laws and regulations, for the collection and processing of personal data. These justifications include, but not limited to, the explicit consent of the Data Subject, compliance with legal or contractual obligations, protection of vital or public interests, or the pursuit of legitimate interests or objectives.
Seventh: Personal Data Processing:
Personal data processing is strictly limited to the purpose for which it was collected.
Eighth: Data Storage:
CST stores personal data within the Kingdom of Saudi Arabia in a secure and reliable environment, in compliance with the regulations of the National Cybersecurity Authority and other applicable national laws. Data is retained in accordance with the statutory procedures.
Ninth: Data Disposal:
Data shall be destroyed once the purpose for which it was collected has been fulfilled, by using:
- Digital Data: Secure deletion techniques, such as encryption followed by deletion, or data overwriting.
- Paper-Based Data: Shredding using shredding machines.
Tenth: Disclosure of Personal Data:
Some personal data may be disclosed to third parties in accordance with the applicable regulations in the Kingdom, for the purpose of enhancing the quality of services provided to users or to entities authorized by law.
Eleventh: Rights of Personal Data Subjects:
Right to Be Informed:
- Data Subjects have the right to be informed about how their personal data is collected, the legal basis for its collection and processing, the methods used for processing, storage, and disposal, and the parties with whom their data may be shared. Full details are provided in this Privacy Policy, and you may also contact us via the communication channels specified herein.
Right to Access Personal Data:
- Data Subjects have the right to request a copy of their personal data.
Right to Data Portability:
- Data Subjects have the right to receive a copy of their personal data in a clear, readable, and structured format.
Right to Rectify Personal Data:
- Data Subjects have the right to request the correction of their personal data that they deem inaccurate, incorrect, or incomplete.
Right to Erasure:
- Data Subjects have the right to request the destruction of their personal data under certain circumstances, unless a legal provision specifies a particular retention period or contractual requirements.
Right to Withdraw Consent for Processing Personal Data:
- Data Subjects have the right to withdraw their consent for the processing of their personal data at any time, unless there are legal justifications that require otherwise.
Twelfth: Exercising the Rights of the Personal Data Subject:
For more information regarding the processing of personal data and how to exercise the aforementioned rights, you may contact us via email at: Info@cst.gov.sa
Thirteenth: Security procedures:
CST implements stringent security measures to protect data from unauthorized access, including:
- Regularly updates of security procedures.
- Utilization of advanced encryption systems.
- Continuous monitoring of systems.
Fourteenth: Complaints and Inquiries:
If you have any complaints or inquiries related to the Privacy Policy or the processing of personal data, please contact us at the following email address: Info@cst.gov.sa.
Fifteenth: General Provisions:
- CST is committed to protecting personal data in accordance with the policies and procedures approved by the National Data Management Office (NDMO), adhering to the principles of transparency, data minimization, specified purpose, data security, and protecting the rights of Data Subjects. Data shall be collected and processed based on clear and declared legal grounds.
- The laws of the Kingdom shall exclusively govern all disputes or complaints that may arise from the use of the website or any of CST’s official channels.
- Arabic shall be the official language for the application of these terms and conditions. In case of any dispute regarding the interpretation of any provision stated in another language, the Arabic text shall prevail.