About The Authority
Board of Directors
FAQs
History
Centers
Departments
Organizational ChartAbout the Authority and Its Activities
The Saudi Red Crescent Authority (SRCA) is a Saudi government entity that provides emergency medical services to citizens and residents across the Kingdom of Saudi Arabia, both under normal circumstances and during disasters and emergencies. The Authority also contributes to raising health awareness within the community. Established in 1353 AH, the Authority has continuously worked to provide high-quality emergency medical services in accordance with the highest international standards
What Personal Data Do We Collect?
The Authority collects personal data relating to website visitors and users of its services, platforms, and applications, either directly or indirectly. The personal data collected may include the following:
- Internet and Website Usage Dat
The user’s Internet Protocol (IP) address, the date and time of the visit, and the URL of any website from which the user was referred to the Authority’s website.
- Personal Data Provided Directly by the Data Subject
Personal data provided by the data subject to the Authority when accessing or using its services, creating a user profile, applying for employment opportunities, or applying for training programs. Such data may include: name, national identification number, address, contact numbers, email address, educational qualifications, bank account details, credit card information, photographs, and other information of a personal nature.
- Personal Data Received from Other Entities
The Authority may obtain or request personal data from other entities, including relevant government entities, where necessary for the provision of its services or the fulfillment of its functions.
- Personal Data Obtained from Other Authority Systems
The Authority may obtain personal data from its other internal systems, including employee systems, volunteer systems, and visitor management systems, for the purpose of supporting and enabling data subjects to access and benefit from the Authority’s electronic services.
How Is Your Personal Data Collected and What Is the Purpose of Its Collection?
Some of the personal data we process is collected directly from the data subject when it is provided to the Authority. And we may also collect certain personal data indirectly by retrieving data from the Absher Platform. Personal data is collected for the following purposes:
No. | Personal Data | Purpose | Processing Requirement |
|---|---|---|---|
4 | Personal data obtained from other systems of the Authority | To support and enable data subjects to access and benefit from electronic services. | Mandatory | 1 | User’s Internet Protocol (IP) address | To retrieve user information when needed in connection with other visits. | Optional |
2 | Personal data provided by the data subject to the Authority | To communicate with data subjects and respond to inquiries, feedback, and comments. | Mandatory |
3 | Personal data obtained from other entities | To provide the Authority’s services or meet any applicable security or criminal investigation requirements. | Mandatory |
How will we use your Personal Data?
We use personal data collected directly or indirectly solely for the purposes outlined above. Access to personal data is restricted to authorized employees whose roles and responsibilities require such access, to ensure the protection of personal data against unauthorized access.
Disclosure of Personal Data
SRCA has the right to disclose personal data collected directly or indirectly to the following entities:
- To other public entities for the purposes of public interest, security purposes, implementing another system, fulfilling judicial requirements, protecting public health, public safety, protecting the life of an individual or specific individual, or protecting their health.
- To the data processing entities of SRCA, in order to achieve a legitimate interest of SRCA without disrupting the rights of the data owner or conflicting with their interests.
- To any entities inside or outside the Kingdom of Saudi Arabia, in the implementation of any local or international agreements that serve any legitimate interest of SRCA or any public interest without violating the system’s regulations.
Legal Justifications
Based on personal data protection system and its implementing regulations, the fundamental legal justifications on which SRCA depend on for processing your personal data is:
In accordance with the Personal Data Protection Law (PDPL) and its Implementing Regulations, the primary legal bases relied upon by the Authority when processing your personal data include:
- The consent of the personal data subject .
- The Labor Law, issued by Royal Decree No. (M/51), dated 23 Sha’ban 1426 AH.
- The Social Insurance Law, issued by Royal Decree No. (M/33), dated 3 Ramadan 1421 AH.
- The Social Insurance Law, issued by Royal Decree No. (M/273), dated 26 Dhu al-Hijjah 1445 AH.
- The Voluntary Work Law, issued by Royal Decree No. (M/70), dated 27 Jumada al-Awwal 1441 AH.
- The Authority’s Rules and Regulations for Voluntary Work, issued in 1444 AH / 2022.
In addition to the legal bases set out above, the Authority may process personal data on the following grounds:
- Achieving the public interest without conflicting with the rights of personal data owners.
- Fulfilling the legal or regulatory requirements.
- Implementing an obligation in which the data owner was a party.
- Protecting vital and realized interests or preventing vital damages.
- Protecting public health or national security.
SRCA may process personal data for additional purposes other than those for which it was collected, whenever necessary and in accordance with the law’s regulations.
How Do We Store Your Personal Data?
SRCA securely stores your personal data either at its premises or with data processors contracted by SRCA to provide technical services on its behalf.
We retain your personal data for the periods specified in the table below. Upon expiry of the applicable retention period, the data will be securely disposed of using methods that prevent unauthorized access, retrieval, or recovery.
No. | Personal Data | Retention Period |
|---|---|---|
4 | Personal data obtained from other SRCA systems | 5 years | 1 | User’s Internet Protocol (IP) address | 6 months |
2 | Personal data provided directly by the data subject to SRCA | 5 years |
3 | Personal data obtained from other entities | 5 years |
Your Rights Regarding the Processing of Your Personal Data
SRCA provides the necessary care and efforts to provide high-quality services to all data subject, ensuring their rights as stipulated in the regulations, which are:
- Right to Be Informed: the legal justification for collecting their personal data, the purpose of the collection, the identity and reference address of the data collector, the entities to which the personal data may be disclosed, and their capacity; whether the personal data will be transferred, disclosed, or processed outside the Kingdom, the potential risks and consequences of not completing the data collection process, and the rights of the data subject. This Privacy Policy provides you with all such information in accordance with the applicable laws and regulations.
- Right to Access Your Personal Data: You may access and view your personal data directly by logging into your account on the website.
- Right to Request a Copy of Your Personal Data: You have the right to request a copy of your personal data in accordance with the applicable laws and regulations.
- Right to Request Correction of Your Personal Data: You may log into your account and directly correct the personal data you have provided through the website. Personal data obtained through the National Single Sign-On (Nafath) or from other entities must be corrected through Nafath or the relevant entities’ websites, as applicable.
- Right to Request deleting Your Personal Data: You have the right to request SRCA delete your personal data in accordance with the applicable law by contacting the Data Protection Officer (DPO) at dpo@srca.org.sa. SRCA will assess the request and take the appropriate action after ensuring compliance with applicable legal obligations, including any requirements relating to archiving in the public interest and the retention of personal data associated with financial or legal claims until the purpose for retaining such data has been fulfilled.
- Right to Withdraw Consent to the Processing of Your Personal Data: Where processing is based on your consent, you may withdraw your consent in accordance with the applicable law, provided that such withdrawal does not conflict with applicable laws and regulations or prevent SRCA from fulfilling its legal or regulatory obligations. You may submit a request to withdraw your consent by contacting the Data Protection Officer (DPO) at dpo@srca.org.sa.
Except as provided by law, the data owner will not be required to pay any fees to practice these rights. If a request to practice any of these rights is submitted, the data subject will be responded to within thirty working days from receiving the request.
For further information about how your personal data is processed and how you may exercise your rights, or if you are unable to exercise your personal data rights through the methods described above, you may contact SRCA’s Data Protection Officer (DPO) using the contact details provided in this Privacy Policy.
Contact SRCA's Data Protection Officer:
Department: | Privacy Department |
|---|---|
Last Update: | 1/8/2026 | Address: | Riyadh, Sahafa District، King Fahd Branch Road |
Telephone: | 0112805555 – 11582 |
Email: | dpo@srca.org.sa |
How Can You Submit a Complaint or Objection?
If you have any inquiries or wish to submit a complaint regarding any violation involving your personal data, you may contact SRCA’s Data Protection Officer (DPO) using the contact details provided above.
