Privacy Policy

This Privacy Policy ("Policy") describes how JMM INNOVATIONS ("we", "us", or "our") collects, uses, stores, and protects your personal data when you access or use the Muqaddam platform ("Platform"). This Policy is issued in compliance with the Saudi Personal Data Protection Law (PDPL) promulgated by Royal Decree No. M/19 dated 9/2/1443H (as amended), its Implementing Regulations, and the European Union General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), where applicable. By using the Platform, you consent to the practices described herein. If you do not agree, please discontinue use immediately.

For purposes of the GDPR, where we process data of EEA residents, JMM INNOVATIONS acts as the data controller.

• Identity & Contact Data: Full name, email address, job title, organization name, phone number, and other contact details provided during registration, profile setup, or correspondence. • Account Data: Username, authentication credentials (hashed), account preferences, language settings, and role assignments. • Usage & Technical Data: IP addresses, browser type and version, device identifiers, operating system, pages visited, features used, clickstream data, timestamps, session duration, and referral sources. • Uploaded Content: Documents, files, proposals, RFx responses, knowledge base entries, and any other content you upload to the Platform for processing. • Communication Data: Messages, notes, feedback submissions, support requests, and any correspondence with us. • Cookies & Analytics Data: Information collected through cookies, web beacons, and similar technologies as described in Section 12. • Payment Data: Where applicable, billing information processed through our third-party payment processors (we do not store full payment card details).

• Consent (PDPL Art. 6 / GDPR Art. 6(1)(a)): Where you have given explicit consent for specific processing activities, such as marketing communications and optional analytics. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. • Contract Performance (PDPL Art. 5(1) / GDPR Art. 6(1)(b)): Processing necessary for the performance of our contract with you, including providing Platform services, managing your account, and delivering requested features. • Legal Obligation (PDPL Art. 5(2) / GDPR Art. 6(1)(c)): Processing necessary to comply with applicable laws, regulations, court orders, or governmental requests. • Legitimate Interest (PDPL Art. 5(3) / GDPR Art. 6(1)(f)): Processing necessary for our legitimate interests, including Platform improvement, security monitoring, fraud prevention, and analytics, provided such interests are not overridden by your rights and freedoms. • Public Interest (PDPL Art. 5(4)): Where processing is necessary for a purpose that serves the public interest, as determined under Saudi law.

• To provide, operate, maintain, and improve the Platform and its features. • To process and analyze your uploaded documents using AI-powered tools for requirement extraction, draft generation, evaluation scoring, and other Platform capabilities. • To create and manage your user account, including authentication and authorization. • To personalize your experience, including language preferences, dashboard configurations, and content recommendations. • To communicate with you about your account, service updates, scheduled maintenance, and support requests. • To send transactional notifications related to proposal deadlines, task assignments, approval workflows, and governance actions. • To conduct analytics and generate aggregated, anonymized reports to improve Platform performance and reliability. • To detect, prevent, and respond to fraud, security incidents, and technical issues. • To comply with legal and regulatory obligations. • To send optional marketing communications about Platform features, updates, and industry insights (only with your explicit consent, which you may withdraw at any time via notification settings or by contacting us).

• Documents, proposals, and content you submit may be processed by AI language models to provide features such as requirement extraction, draft generation, compliance analysis, evaluation scoring, and content suggestions. • AI processing is performed solely for the purpose of delivering Platform services to you. Your content is NOT used to train, fine-tune, or improve external AI models. • AI-generated outputs (drafts, suggestions, analysis) are provided as decision-support tools. You are solely responsible for reviewing, validating, and approving all AI-generated content before use. • We retain AI processing logs only as necessary for service delivery, debugging, and quality assurance, subject to the retention periods in Section 10.

• Service Providers & Sub-processors: We engage trusted third-party service providers for infrastructure hosting, AI model inference, email delivery, analytics, and customer support. All sub-processors are bound by data processing agreements (DPAs) requiring them to process data only on our instructions and in accordance with this Policy. A list of current sub-processors is available upon request. • AI Model Providers: Content submitted for AI processing may be transmitted to AI model providers solely for inference purposes. We ensure these providers do not retain or use your content beyond the immediate processing request. • Legal & Regulatory Obligations: We may disclose personal data if required by law, regulation, legal process, court order, or governmental request, including requests from Saudi authorities (SDAIA, NDMO) or EU data protection authorities. • Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections described herein. We will notify you of any such transfer. • With Your Consent: We may share data with third parties where you have given explicit consent for such sharing.

• Saudi PDPL (Article 29): Cross-border transfers are conducted only where the receiving jurisdiction provides adequate data protection, or where appropriate safeguards are in place as approved by the competent authority (SDAIA/NDMO). We implement contractual safeguards and technical measures to protect transferred data. • GDPR (Chapter V): For transfers of EEA personal data outside the EEA, we rely on European Commission adequacy decisions, Standard Contractual Clauses (SCCs) adopted pursuant to Commission Decision 2021/914, or other approved transfer mechanisms. • We maintain records of all international transfers and the safeguards applied, which are available for review by supervisory authorities upon request.

• Encryption: Data at rest is encrypted using AES-256; data in transit is protected using TLS 1.2 or higher. • Access Controls: Role-based access control (RBAC) with principle of least privilege. Multi-tenant architecture ensures strict data isolation between organizations. • Authentication: Secure passwordless authentication using one-time passwords (OTP) with rate limiting and brute-force protection. • Infrastructure Security: Regular vulnerability assessments, penetration testing, and security audits. Automated threat detection and monitoring. • Row-Level Security: Database-level security policies ensure users can only access data within their authorized tenant scope. • Employee Access: Access to personal data is restricted to authorized personnel who need it for legitimate business purposes, subject to confidentiality obligations. • Incident Response: We maintain a documented incident response plan and conduct regular security drills.

While we employ industry-leading security measures, no system is completely immune to security threats. We cannot guarantee absolute security but commit to promptly addressing any security incidents.

• Account Data: Retained for the duration of your active subscription plus ninety (90) days after account closure to facilitate reactivation requests and resolve any outstanding matters. • Uploaded Documents & Proposals: Retained until you delete them or your account is terminated. Upon termination, you have 90 days to export your data before permanent deletion. • Usage Logs & Analytics Data: Retained for up to twenty-four (24) months, after which they are anonymized or deleted. • Communication Records: Retained for up to thirty-six (36) months for support quality assurance and dispute resolution. • Legal & Regulatory Records: Retained for the periods required by applicable Saudi laws, including commercial and tax regulations (typically five to ten years). • AI Processing Logs: Retained for up to twelve (12) months for quality assurance and debugging purposes.

Upon expiration of the applicable retention period, personal data is securely deleted or irreversibly anonymized.

• Right of Access (PDPL Art. 4 / GDPR Art. 15): Request confirmation of whether we process your data and obtain a copy of your personal data. • Right to Rectification (PDPL Art. 4 / GDPR Art. 16): Request correction of inaccurate or incomplete personal data. • Right to Erasure (PDPL Art. 4 / GDPR Art. 17): Request deletion of your personal data, subject to legal retention requirements and legitimate grounds for continued processing. • Right to Restrict Processing (GDPR Art. 18): Request restriction of processing in certain circumstances. • Right to Data Portability (PDPL Art. 4 / GDPR Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller. • Right to Object (PDPL Art. 4 / GDPR Art. 21): Object to processing based on legitimate interests or for direct marketing purposes. • Right to Withdraw Consent (PDPL Art. 6 / GDPR Art. 7(3)): Withdraw consent at any time for processing activities based on consent, without affecting the lawfulness of prior processing. • Right Not to Be Subject to Automated Decision-Making (PDPL Art. 20 / GDPR Art. 22): Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please contact us at privacy@jmminnovations.com. We will verify your identity and respond within thirty (30) days. If we require additional time, we will inform you of the extension and reasons.

• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant supervisory authority: – In Saudi Arabia: Saudi Data and Artificial Intelligence Authority (SDAIA) / National Data Management Office (NDMO) — https://sdaia.gov.sa – In the EU: Your local Data Protection Authority (DPA) under GDPR Article 77.

• Essential Cookies: Required for Platform functionality, including authentication, session management, and security. These cannot be disabled. • Analytics Cookies: Used to understand usage patterns, measure performance, and improve the Platform. These are activated only with your consent where required by law. • Preference Cookies: Store your settings such as language preference and display options.

We do not use advertising or third-party tracking cookies. You may manage cookie preferences through your browser settings. Disabling essential cookies may impair Platform functionality.

• GDPR Compliance: We will notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach (Article 33). If the breach is likely to result in a high risk to affected individuals, we will also notify you directly without undue delay (Article 34). • PDPL Compliance: We will notify the Saudi Data and Artificial Intelligence Authority (SDAIA) without delay and will inform affected data subjects where the breach is likely to cause harm, in accordance with PDPL requirements and NDMO guidance. • Our notification will include the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to address the breach.

• A prominent notice within the Platform at least thirty (30) days before the changes take effect. • Email notification to the address associated with your account.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

Data Protection Officer JMM INNOVATIONS Email: dpo@jmminnovations.com

General Privacy Inquiries Email: privacy@jmminnovations.com

Mailing Address: JMM INNOVATIONS Riyadh, Kingdom of Saudi Arabia

For complaints regarding data protection, you may also contact: • Saudi Data and Artificial Intelligence Authority (SDAIA): https://sdaia.gov.sa • National Data Management Office (NDMO): https://ndmo.gov.sa • Your local EU Data Protection Authority (for EEA residents)

Last updated: March 9, 2026