Privacy Policy | Tap Payments

Last Updated: 20-October-2026

Who We Are
This Privacy Notice (“Notice”) is issued by Tap Financial JSC (شركة تاب المالية) ("Tap", "we", "us"). Tap is a joint stock company incorporated under the laws of the Kingdom of Saudi Arabia, Commercial Registration No. 1010951139. Our principal place of business is The Zone, Central, 2nd Floor, Al Takhassousi, Al Mohammadiyah, Riyadh 12362, Kingdom of Saudi Arabia. Tap is regulated by the Saudi Central Bank (SAMA) under Major PI license number (٠٥/م ش م/١٤٤١).
What We Do and Who We Serve
Tap provides payment services to businesses in the Kingdom of Saudi Arabia. We do not sell goods or services directly to payers. We process payments on behalf of the merchants that choose to use our platform. Our services include:
- Payment acceptance and orchestration: Enabling merchants to accept card, wallet, and alternative payment methods via websites, mobile apps, or payment links with consolidated dashboard reporting.
- Billing: Digital invoicing and payment collection tools.
- Tokenization and authentication: Storing payment credentials safely as tokens and authenticating payers.
- Payouts and reconciliation: Settling transaction funds directly to the merchant's bank account.
- Merchant tools: Managing our merchant onboarding platform (Connect) and portal (tapOS).
Our customers are businesses, including small and medium enterprises (SMEs), freelancers, large corporations, and marketplaces. Individuals interact with us as merchants/sole traders, corporate directors/signatories, payers buying from a merchant, job applicants, or website visitors.
Which Law and Which Authorities Apply
We process the personal data of individuals within the Kingdom under the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 dated 09/02/1443H, as amended by Royal Decree No. M/148 dated 05/09/1444H, and its Implementing Regulations.
- Competent Authority: The Saudi Data and AI Authority (SDAIA) is the primary data protection authority overseeing compliance with the PDPL.
- Sector Regulator: The Saudi Central Bank (SAMA) regulates our financial services, including rules on cyber security, outsourcing, cloud computing, and anti-money laundering / counter-terrorist financing (AML/CFT).
The laws of other countries govern other Tap group entities operating outside Saudi Arabia and do not apply to Tap Financial JSC's operations within the Kingdom.

Our Role

FOR WHO	OUR ROLE	ROLE DETAILS
Merchants, sole traders, and freelancers	Controller	We independently determine why and how data is processed for onboarding, risk verification, account management, and payouts.
Merchant directors, owners, and signatories	Controller	We collect identity verification data to satisfy corporate governance and regulatory compliance rules.
Website and app visitors	Controller	We manage basic digital metrics to maintain platform safety and stability.
Job applicants	Controller	We evaluate applicant background information during our hiring process.
Payers (End-Customers)	Processor	We process transaction numbers, card tokens, and authorizations strictly under the instructions and contract of the respective merchant (who acts as the Controller).

What Personal Data We Process

We limit the personal data we collect to what is necessary for our operations:

FOR WHO	DATA WE PROCESS
Merchants, sole traders, freelancers	Full name, contact details, physical address, date of birth, national ID/Iqama details, commercial registration or freelancer certificate, account credentials, IP address, device fingerprint, and geographic location.
Merchant directors, owners, signatories	Full name, contact details, corporate designation, residential address, date of birth, and national ID/Iqama details.
Payers (End-Customers)	Tokenized payment card information, transaction history, transaction values, contact details, IP address, device fingerprint, and geographic location.
Website and app visitors	IP address, device fingerprint, network geographic location, and preference-based cookie data.
Job applicants	Name, contact details, address, date of birth; and, at the screening stage, government ID, designation and, for regulated roles, criminal record information obtained through Amn (Absher).

We do not knowingly process special categories of personal data (such as health, biometric or genetic data) about merchants, payers or visitors. Identity documents can reveal information such as ethnic origin or religion. We collect them only to verify identity, and we do not use them for any other purpose.

For job applicants to regulated roles, we process criminal record information, which is a special category of personal data, strictly for the purpose of assessing suitability for the role, and on the legal basis set out in “Why We Use Your Data and Our Legal Basis” section.

Why We Use Your Data and Our Legal Basis

In compliance with PDPL Articles 5 and 6, we process personal data only when a valid statutory legal basis is established.

1. Operations as a Data Controller

For these activities, Tap determines the data requirements directly:

ACTIVITY	PURPOSE	LEGAL BASIS
Identity Verification via Nafath	Confirm that the person signing up owns the national ID entered.	Legal Obligation (SAMA regulatory onboarding rules)
KYC & Address Collection	Know-Your-Customer checks using trusted government records.	Legal Obligation (AML/CFT statutory mandates)
Mobile Ownership Validation	Validate that the registered mobile number belongs to the applicant.	Legal Obligation (SAMA security standards)
Legal Information Validation	Verify corporate registration data or freelancer credentials.	Performance of a Contract / Legal Obligation
Account Creation & Activation	Review, perform risk assessments, and establish the business account.	Performance of a Contract
Bank Account Validation	Confirm IBAN details match the entity to prevent fraud and settle funds.	Legal Obligation / Performance of a Contract
Portal Access & Security	Control secure entry to tapOS using secure login and email OTP.	Performance of a Contract (Securing user accounts)
Fraud & AML/CFT Screening	Run continuous checks to detect financial crime and fraud.	Legal Obligation / Legitimate Interests
Website Operations	Run basic persistent cookies to keep digital infrastructure stable.	Legitimate Interests (System health)
Marketing & Analytics Cookies	Track optional analytical or promotional preferences.	Consent (Under Article 5)
Job Application Evaluation	Review applications submitted voluntarily by candidates.	Consent (By applying directly)
Background Screening of the job applicant	Run background check evaluations prior to formal hiring.	Consent (application) Legal obligation Explicit Consent (screening, including criminal record checks)

These map to the PDPL as follows:

“Consent” to Article 5; “Legal Obligation” and “Contract” to Article 6 (processing under another law or a prior agreement with you); and “Legitimate Interests” to Article 6 (not available for sensitive data, and only after a documented assessment). We do not rely on public tasks or vital interests for the activities above. Where you consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.

For criminal record checks, your explicit consent is obtained by Amn through its own platform before your record is shared with us; we do not separately collect this consent.

2. Operations as a Data Processor

Payment Processing: When processing transactions on behalf of merchants, Tap functions as a Processor. The legal basis for this processing is established by the merchant (the Controller) through their direct purchase agreement with the payer. Tap handles this data strictly to execute transactions and generate merchant reports under its service contract with the merchant.

Where you provide explicit consent, you may withdraw it at any time. Withdrawal does not affect the legality of any processing completed before the withdrawal date.

Where Your Data Comes From and Who Receives It

We collect data from you, from your use of our services, and from trusted sources during onboarding.

RECIPIENT OR SOURCE	WHAT IT DOES
National identity verification platforms	National identity ecosystem used to authenticate accounts.
Identity, address and mobile verification platforms	Validates national identity data, addresses, and mobile network ownership.
Commercial registration and freelancer verification providers	Verifies active Commercial Registrations and freelancer certifications.
Bank account verification providers	Validates corporate IBAN ownership against business records.
SMS service providers	SMS delivery of one-time passwords and notices.
Email service providers	Email delivery of one-time passwords and notices.
Affiliated technology services provider (Tap group company)	A Tap group company providing technical support, database administration, and system infrastructure. It operates strictly under a processor contract.
Cloud and infrastructure providers	Localized infrastructure partners hosting our platforms inside physical data centers within Saudi Arabia.
Applicant tracking platforms	Platforms utilized for job applicant tracking and hiring compliance.
Government criminal record verification platforms	Criminal record verification for employees; obtains the applicant's explicit consent through its own platform before sharing the result with us.
Sanctions and financial crime screening provider	Screens for global PEP, sanctioned entities, and financial crime indicators.
Payment card schemes and networks	For example Visa, Mastercard, Mada etc and associated banking networks processing authorization, clearing, and chargebacks.
Acquiring or Settlement banks	Payment authorization, settlement, chargebacks.

We also share personal data with SAMA, local courts, and Saudi regulatory bodies when legally required. We never sell personal data to third parties.

Transfers Outside the Kingdom
We store and host our primary payment infrastructure locally within data centers in Saudi Arabia. Personal data is only transferred outside the Kingdom when permitted under the PDPL Cross-Border Data Transfer Regulations, ensuring that equivalent security measures and standard contractual clauses are established with global Tap corporate affiliates or international partners.
How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, as well as to meet statutory, financial, tax, and SAMA regulatory retention mandates (such as 10-year AML record-keeping rules). When no longer required, data is permanently destroyed or irreversibly anonymized in compliance with local privacy laws.
How We Protect Your Data
We maintain a robust security posture using technical and organizational safeguards:
- Technical Measures: End-to-end data encryption, data pseudonymization, strict role-based access control, multi-factor authentication, enterprise firewalls, automated intrusion detection systems, and daily redundant backups.
- Organizational Measures: Internal data governance policies, a dedicated Information Security Management System (ISMS), structured data breach incident plans, and regular external audits.
If a high-risk data breach occurs that could impact your rights or privacy, we will notify you and the competent authorities (SDAIA/SAMA) in accordance with the timelines defined by law.
Your Rights
Under the Saudi PDPL and its Implementing Regulations, you hold specific statutory rights regarding your personal data:
- Right to Information: The right to know how your data is used and the legal grounds behind it.
- Right to Access: The right to look at your personal data records held by us.
- Right to Request a Copy: The right to obtain a copy of your personal data in a clear, readable format.
- Right to Correction: The right to update inaccurate, incomplete, or outdated information.
- Right to Destruction: The right to ask for the complete deletion of your data when its statutory retention period expires.
- Right to Withdraw Consent: The right to cancel consent at any time for activities that rely on consent as a legal basis.
- Right to Compensation: The right to claim compensation for material or moral damage you suffer as a result of any violation of the Law or its Implementing Regulations by us.
Note: These rights may be limited if processing is required by SAMA directives, financial reporting rules, or anti-money laundering laws.

To exercise a right, contact us using the details in the “Contact and Complaints” section. We may ask you to verify your identity first.

We will execute your request within 30 days of receipt, and without delay. We may extend this period by up to a further 30 days where execution requires disproportionate effort or where we receive multiple requests from you; in that case, we will notify you in advance of the extension and the reasons for the delay.
Contact and Complaints
To exercise your legal privacy rights, file an inquiry, or submit a formal request, contact our team:
- Corporate Office: Tap Financial JSC, The Zone, Central, 2nd Floor, Al Takhassousi, Al Mohammadiyah, Riyadh 12362, Kingdom of Saudi Arabia.
- Privacy enquiries and requests: privacy@tap.com.sa
- Data Protection Officer: Amjad Bin Rubayan, (A.BinRubayan@tap.company)
If you believe your data has been handled incorrectly, please contact us directly first. You also retain the right to escalate complaints to SAMA or SDAIA regarding financial service or data protection discrepancies.
Changes to This Notice
We will update this Notice when our processing changes. The version and effective date are shown at the top. For material changes we will notify you through our website or merchant portal before they take effect.