Privacy Policy

Last Updated 

This Privacy Notice was last updated on 19 June 2026.

Introduction 

ACE Gallagher Arabia Insurance Brokers Company (“we”, “us”, or “the Company”) is committed to protecting the privacy of its users and ensuring the security of their personal data, in accordance with the provisions of the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its implementing regulations, as well as all applicable instructions and regulations issued by relevant regulatory authorities, including the Insurance Authority.

We process your personal data in a lawful, fair, and transparent manner, and only for specific and legitimate purposes as outlined in this Privacy Policy.

By using our services and/or providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy and, where required by applicable law, you consent to the collection and processing of your personal data in accordance with the terms set out herein.

Scope of the Policy

This Privacy Policy applies to all activities involving the collection and processing of personal data carried out through the services of ACE Gallagher Arabia Insurance Brokers Company, including, but not limited to:

  • Users and visitors of the website (www.wakeel.com) 
  • Users of current or future electronic applications (if any) 
  • Existing and prospective customers 
  • Individuals whose data is collected through digital forms or various communication channels 

This Policy also applies to all activities related to the provision of our services, including technical integrations with partners and service providers (such as insurance companies), to the extent that we exercise control over or supervise the processing of personal data.

This Privacy Policy does not apply to third-party websites or services that are not under the control of the Company. We recommend that you review the privacy policies of those third parties before providing them with any personal data.

Definitions 

For the purposes of this Policy, the following terms shall have the meanings set out below, unless the context requires otherwise:

  • Personal Data: Any information, regardless of its source or form, that may lead to the identification of an individual directly or indirectly, such as name, national ID number, residency number, address, phone number, email address, or any other related data. 
  • Processing: Any operation performed on personal data by any means, whether manual or automated, including collection, recording, saving, organizing, storing, modifying, updating, retrieving, using, disclosing, publishing, sharing, linking, blocking, erasing, or destroying the data. 
  • Sensitive Personal Data: Personal data that includes information relating to racial or tribal origin, religious, intellectual or political beliefs, trade union membership, criminal or security data, biometric data, health data, or any other data classified as sensitive under the Personal Data Protection Law or its implementing regulations.

The Personal Data We Collect About You 

We may collect and process different types of personal data depending on how you use our services. This may include, but is not limited to, the following:

  • Identity Data: such as your name, national ID number or residency number, date of birth, and nationality. 
  • Contact Data: such as your phone number, email address, national address, or other means of communication. 
  • Transaction Data: such as details of your requests, purchases, payments, and records of your interactions with our services. 
  • Technical Data: such as your Internet Protocol (IP) address, device type, browser type, operating system, and browsing activity within the website or application. 
  • Service-Related Data: such as insurance-related information, vehicle details, policy information, and any data required to provide the service or complete a transaction. 
  • Data Collected from Third Parties: such as information obtained from partners or insurance companies, to the extent necessary to provide our services and in compliance with applicable laws and regulations.

Purpose of Processing Personal Data 

We collect and process your personal data for specific and legitimate purposes, depending on how you use our services. These purposes include, but are not limited to, the following:

  • Providing Services and Products: enabling you to benefit from our services, including browsing, comparing, and purchasing insurance products. 
  • Identity Verification: verifying users’ identities and complying with “Know Your Customer” (KYC) requirements and applicable regulatory obligations. 
  • Processing Requests and Transactions: completing purchases, issuing insurance policies, and managing service-related requests and transactions. 
  • Improving User Experience: analyzing the use of the website or application to improve and develop our services and personalize your experience. 
  • Communicating with Users: sending notifications, alerts, and service-related updates, as well as responding to inquiries and complaints. 
  • Regulatory Compliance: complying with applicable laws and regulations in the Kingdom of Saudi Arabia and requirements of relevant regulatory authorities. 
  • Fraud Prevention and Security: detecting and preventing fraudulent or unlawful activities, and enhancing the security of our platforms and systems. 
  • Customer Relationship Management: improving service quality, managing accounts, and providing customer support and after-sales services.

Legal Basis for Processing Personal Data 

We process personal data based on one or more of the lawful bases recognized under the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, depending on the purpose of the processing. These bases include:

  • Consent: obtaining explicit consent from the data subject in cases where such consent is required by law. 
  • Contractual Necessity: processing personal data necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the data subject’s request prior to entering into a contract. 
  • Legal Obligation: complying with legal or regulatory requirements imposed on the Company by competent authorities. 
  • Legitimate Interests: processing personal data for the purposes of the Company’s legitimate interests, provided that this does not adversely affect the rights and interests of the data subject and is carried out in accordance with applicable laws.

Sharing of Personal Data with Third Parties 

We may share your personal data with third parties to the extent necessary to provide our services and in compliance with applicable laws and regulations in the Kingdom of Saudi Arabia. Such parties may include, but are not limited to:

  • Service Partners: such as insurance companies, business partners, or service providers with whom we collaborate to deliver or improve our services. 
  • Regulatory and Government Authorities: where disclosure is required by applicable laws, regulations, or official requests from competent authorities. 
  • Infrastructure and Technology Service Providers: such as hosting providers and IT service providers that support the operation of our platforms and services. 

We share personal data in accordance with the following safeguards:

  • Ensuring that any data sharing is limited to the specific and legitimate purposes outlined in this Policy. 
  • Limiting the shared data to the minimum amount necessary to achieve the intended purpose. 
  • Engaging only with third parties that adhere to appropriate data protection standards in compliance with the Personal Data Protection Law. 
  • Implementing appropriate contractual and organizational measures to ensure the protection of personal data and to prevent its use for any unauthorized purposes.

How We Store Your Personal Data and Retention Period

We do not transfer personal data outside the Kingdom of Saudi Arabia except in cases permitted by law and in compliance with the provisions of the Personal Data Protection Law (PDPL). Such cases include, but are not limited to:

  • The existence of a lawful basis for the transfer. 
  • Ensuring that an adequate level of protection is in place for personal data outside the Kingdom, equivalent to or higher than the level of protection required under the PDPL. 
  • Obtaining the necessary approvals or permits from the competent authorities, where required by law. 

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required under applicable laws and regulations in the Kingdom of Saudi Arabia.

Upon the expiry of the purpose of processing or the applicable legal retention period, we will take one of the following actions:

  • Securely delete or destroy the personal data. 
  • Or anonymize the data (where possible) for use in statistical or analytical purposes without identifying the individual.

Payments Through the Website

The website provides electronic payment services to enable users to purchase available products and services.

If you choose to make a payment online, you will be redirected to enter your payment details (such as card information) through secure and authorized payment gateways.

Payment data is processed by authorized payment service providers in accordance with applicable security standards, such as the Payment Card Industry Data Security Standard (PCI DSS). We do not store sensitive payment card data on our systems.

Cookies and Network Settings 

We use cookies and similar technologies to automatically collect certain data when you use our website. A cookie is a small text file that is stored on your device when you visit the website and is used to remember certain information about your preferences or usage.

These cookies help us to:

  • Improve the performance and functionality of the website and its services. 
  • Understand how the website is used and analyze overall user behavior. 
  • Personalize user experience and provide more relevant content. 

We may use different types of cookies, including essential cookies required for the operation of the website and analytical cookies used to improve performance.

You can control your cookie preferences through your browser settings, including rejecting all or some cookies or receiving alerts when cookies are being sent to your device. However, disabling certain cookies may affect the functionality of the website or your user experience.

Where required by applicable law, your consent will be obtained before the use of cookies.

Personal Data Breach Notification 

In the event of any breach, leak, or unauthorized access to personal data, we are committed to taking the necessary measures without undue delay, in accordance with the provisions of the Personal Data Protection Law (PDPL) and its implementing regulations.

This includes:

  • Assessing the incident and determining its scope and impact promptly. 
  • Implementing appropriate technical and organizational measures to mitigate risks and address the incident. 
  • Notifying the competent regulatory authorities within the legally prescribed timeframe. 
  • Informing affected individuals where the incident is likely to result in potential harm to their data or rights. 

We continuously work to enhance our security measures to minimize the risk of such incidents.

What Are Your Legal Rights?

The Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia grants data subjects a number of rights, including the following:

  • Right of Access: You have the right to request access to your personal data that we hold and to obtain a copy of it in a readable electronic format or as a printed copy, without prejudice to the rights of others, such as trade secrets or intellectual property rights. 
  • Right to Rectification: You have the right to request the correction or updating of your personal data if it is inaccurate or incomplete. 
  • Right to Erasure: You have the right to request the deletion of your personal data, subject to applicable legal and regulatory requirements. 
  • Right to Object: You have the right to object to the processing of your personal data in certain circumstances, as permitted by applicable law. 
  • Right to Data Portability: You have the right to request the transfer of your personal data to another entity in a structured and usable format, in accordance with applicable regulations. 
  • Right to Restriction of Processing: You have the right to request the restriction of the processing of your personal data in certain cases. 
  • Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of processing carried out prior to such withdrawal. 
  • Right to Opt-Out of Marketing Communications: You have the right to request that you no longer receive marketing or promotional communications at any time. 

If you wish to exercise any of your rights listed above, please contact us at: help.wakeel@ace-gallagher.com

Updates to This Privacy Policy 

ACE Gallagher Arabia Insurance Brokers Company reserves the right to update or modify this Privacy Policy from time to time, in order to comply with applicable laws and regulations or to improve our data protection practices.

Any updates will be published on this page along with the “Last Updated” date, and the updated version will become effective as of the date of publication.

Where changes involve material modifications that may affect your rights or the way we process your personal data, we may notify you through appropriate communication channels.

Notices 

Any notices issued under this Policy or the Terms and Conditions may be provided to you electronically and shall be deemed valid and effective when sent through approved electronic means.

You may also submit any notices or inquiries to us electronically via the following email address:

help.wakeel@ace-gallagher.com

Governing Law and Jurisdiction 

This Privacy Policy shall be governed by and construed in accordance with the laws and regulations of the Kingdom of Saudi Arabia.

By using this website, you agree that the applicable laws and regulations of the Kingdom of Saudi Arabia shall govern the interpretation and implementation of this Policy, and that any disputes arising in connection with it shall be subject to the jurisdiction of the competent courts of the Kingdom of Saudi Arabia.