Contest Bag Privacy Policy

Last Updated: October 1st, 2025

This Privacy Policy (“Policy”) describes how Contest Bag Company (“Contest Bag,” “we,” “us,” or “our”) collects, processes, stores, uses, and protects personal data of users, customers, students, and visitors (“you,” “your”) in connection with our website www.contestbag.com and related services.

We are committed to safeguarding your personal data in accordance with the Personal Data Protection Law (PDPL), issued under Royal Decree No. M/19 dated 9/2/1443H (corresponding to September 16, 2021), as amended by Royal Decree No. M/148 dated 5/9/1444H, its Implementing Regulations, and all relevant executive decisions in the Kingdom of Saudi Arabia.

By accessing or using our website or services, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

1. Definitions

For the purpose of this Policy:

“Personal Data” means any information, regardless of its source or form, that may directly or indirectly identify an individual, including name, identification number, address, contact information, financial details, or contest data.
“Data Subject” means the individual to whom the personal data relates, including students, parents, guardians, and website visitors.
“Processing” means any operation performed on personal data, including collection, recording, storage, usage, sharing, transfer, or deletion.
“Controller” means Contest Bag, which determines the purposes and means of processing personal data.
“Processor” means any third party engaged by Contest Bag to process data on its behalf.

2. Scope of Application

This Policy applies to all personal data processed by Contest Bag in connection with:

Registration for contests and educational events.
Access and use of the Contest Bag website.
Customer service and communication.
Financial transactions, subscriptions, and online payments.
Participation in local, regional, and international Olympiads.

3. Categories of Data Collected

We may collect and process the following types of personal data:

Identity Data: Full name, nationality, date of birth, gender, identification documents (where required).
Contact Data: Email, phone number, postal address, school name, school location.
Educational Data: Student grade, academic performance, contest registration, results, rankings, and certificates.
Transaction Data: Payment information, billing details, order history, and invoices.
Technical Data: IP address, browser type, operating system, cookies, and device identifiers.
Communication Data: Records of correspondence with us via email, phone, WhatsApp, or other channels.

4. Lawful Basis for Processing

We process personal data only when a lawful basis exists under the PDPL, including:

Consent: When you voluntarily provide data for contest participation or account creation.
Contractual Necessity: When data is required to provide services, process payments, or fulfill agreements.
Legal Obligation: To comply with Saudi regulations, tax laws, or instructions from competent authorities.
Legitimate Interest: To improve services, prevent fraud, ensure website security, or protect Contest Bag’s rights.

5. Purposes of Processing

We may use personal data for the following purposes:

To verify eligibility and manage contest registrations.
To issue certificates, rankings, and official contest results.
To process orders, subscriptions, and payments.
To provide technical support, updates, and service-related communication.
To comply with reporting obligations to Saudi regulators or educational authorities.
To share necessary data with international contest organizers, subject to consent and PDPL safeguards.
To improve our website, products, and services through analytics and user behavior studies.

6. Data Sharing and Disclosure

We may disclose personal data under the following limited circumstances:

Service Providers and Processors: Payment gateways, IT hosting, and logistics companies, subject to strict contractual confidentiality obligations.
Educational Partners and Contest Organizers: Schools, academic institutions, and affiliated organizations involved in Olympiads and contests.
Government Authorities: When disclosure is required by Saudi regulators, courts, or other competent authorities.
International Transfers: With international organizers or affiliates outside Saudi Arabia, only when necessary, after ensuring compliance with PDPL requirements and obtaining your consent.

We do not sell or commercially exploit personal data.

7. International Transfers of Data

Where personal data is transferred outside the Kingdom of Saudi Arabia:

Such transfers will only occur when required to provide contest participation in international Olympiads.
We will ensure compliance with PDPL rules for cross-border transfers.
We will obtain explicit consent from the data subject or guardian before such transfer.

8. Data Retention

Contest Bag applies strict retention and deletion policies:

Personal data will be stored only for the minimum period necessary to achieve the purpose of processing.
Contest registration and performance data may be retained for up to five (5) years for reporting, recognition, and recordkeeping purposes.
Financial and invoicing data will be retained in compliance with Saudi tax and accounting laws.
Upon expiration of the retention period, data will be securely deleted or anonymized.

9. Data Security

We employ appropriate technical and organizational measures to safeguard data, including:

Encryption of sensitive information.
Restricted access to authorized personnel only.
Firewalls, intrusion detection, and secure server environments.
Regular review and audit of data protection procedures.

While we take every reasonable measure, no transmission over the internet can be guaranteed as 100% secure.

10. Rights of Data Subjects

Under Saudi PDPL, you are entitled to exercise the following rights:

Right to Access: Request a copy of your personal data held by Contest Bag.
Right to Correction: Request correction of inaccurate or incomplete data.
Right to Deletion: Request erasure of personal data where no lawful basis for retention exists.
Right to Restriction: Request restriction of processing under certain circumstances.
Right to Withdraw Consent: Withdraw consent where processing is based solely on consent.
Right to Information: Be informed about the purpose and means of data processing.

Requests may be submitted by contacting us (see Section 14). We will respond within the timeframes mandated by PDPL.

11. Children’s Data

We recognize that many Contest Bag users are minors.
We process student data only with the consent of a parent, guardian, or school representative.
Parents/guardians are responsible for the accuracy of information submitted.
Children’s data is handled with heightened protection and will not be shared beyond what is necessary for contest participation.

12. User Obligations

By using our services, you agree to:

Provide accurate, complete, and truthful information.
Obtain parental or school consent when registering minors.
Not use false identities or impersonate others.
Comply with all applicable Saudi laws and regulations.

13. Breach Notification

In the event of a personal data breach that may cause damage to data subjects, we will:

Notify the Saudi Data & Artificial Intelligence Authority (SDAIA) in accordance with PDPL requirements.
Inform affected data subjects without undue delay.
Take immediate remedial actions to contain and mitigate the breach.

14. Contact Information

For inquiries, complaints, or requests regarding this Privacy Policy or your personal data rights, you may contact us:

Contest Bag Company

Email: [email protected]

Address: Riyadh 13226, Saudi Arabia

15. Policy Updates

We reserve the right to amend or update this Policy from time to time to reflect changes in laws, regulations, or business practices. Updates will be published on our website with the “Last Updated” date.