EFFIVITY PDPL COOKIE POLICY

Last revision: 28 April 2026

1. Data Controller

The data controller responsible for the processing of personal data via cookies on www.effivity.com (the 'Platform') is:

As an entity that collects personal data from individuals in the Kingdom of Saudi Arabia, Effivity Technologies Pvt Ltd is subject to the obligations of the Saudi PDPL in respect of data subjects located in the Kingdom, including the duty to obtain explicit prior consent before processing personal data through non-essential cookies.

This Cookie Policy supplements, and should be read together with, the Effivity Privacy Policy available at www.effivity.com/privacy, which sets out our broader practices in relation to the processing of personal data.

In line with Article 32 of the Implementing Regulations of the Saudi PDPL, Effivity has appointed a Data Protection Officer responsible for monitoring our compliance with the PDPL. The Data Protection Officer can be contacted at dpo@effivity.com.

2. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work more efficiently, provide a better user experience, and give website operators information about how their site is being used.

Cookies may collect personal data within the meaning of Article 1 of the Saudi PDPL, including IP addresses, device identifiers, browsing behaviours, and inferred preferences. When they do, such processing is governed by the PDPL and its Implementing Regulations.

3. Legal Basis for Processing Under Saudi PDPL

Effivity Technologies Pvt Ltd processes personal data through cookies on the following legal bases under the Saudi PDPL:

In accordance with Article 5 of the Saudi PDPL, consent must be explicit, informed, specific, and unambiguous. You have the right to withdraw your consent at any time without this affecting the lawfulness of processing prior to withdrawal.

4. Cookies We Use

4.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They do not require your consent under the Saudi PDPL. They enable core functionality such as page navigation, session management, and access to secure areas.

4.2 Preference Cookies

These cookies remember your settings and choices on the Platform. They require your prior consent under the Saudi PDPL.

4.3 Statistics Cookies

These cookies collect information about how you use the Platform in order to help us improve its performance and your experience. They require your prior consent under the Saudi PDPL.

4.4 Marketing Cookies

These cookies are used to deliver advertisements relevant to you and to track the effectiveness of our marketing campaigns. They require your prior consent under the Saudi PDPL.

5. Cookie Consent Under Saudi PDPL

In compliance with Article 5 of the Saudi PDPL, we obtain your explicit, prior, and informed consent before placing any non-essential cookies on your device. When you first visit the Platform:

• A cookie consent banner will be displayed, clearly describing the categories of cookies used and their purposes.

• You may accept all categories, accept only strictly necessary cookies, or customise your preferences by category.

• Where you do not provide consent, only technically necessary cookies will be activated.

• Your consent preferences are stored for a period not exceeding 12 months, after which you will be asked to renew your consent.

Consent obtained through the banner constitutes an explicit and documented record as required by the Saudi PDPL and its Implementing Regulations.

6. Your Rights Under Saudi PDPL

As a data subject in the Kingdom of Saudi Arabia, you have the following rights in respect of your personal data processed through cookies, under Chapter 4 of the Saudi PDPL:

To exercise any of the above rights, please contact us at privacy@effivity.com. We will respond within the timeframe required by the Saudi PDPL (not exceeding 30 days from receipt of your request).

7. Managing and Disabling Cookies

You may control and manage cookies through the following methods:

7.1 Our Cookie Consent Tool

At any time, you may update your cookie preferences by accessing the cookie settings panel available on the Platform. Withdrawing consent for non-essential cookies will cause them to be deactivated immediately.

7.2 Browser Settings

You may disable cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. Browser-specific instructions are available at:

• Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

• Chrome: https://support.google.com/chrome/answer/95647

• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

• Microsoft Edge: https://support.microsoft.com/en-us/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy

7.3 Opt-Out Tools

For interest-based advertising, you may opt out via the Digital Advertising Alliance tool at https://youradchoices.com or the Network Advertising Initiative at https://www.networkadvertising.org.

To opt out of Google Analytics specifically, please install the Google Analytics Opt-Out Browser Add-on available at https://tools.google.com/dlpage/gaoptout.

8. Google Analytics

We use Google Analytics, a service provided by Google LLC, United States, to analyse usage of the Platform. Google Analytics uses first-party statistical cookies. Your IP address is anonymised prior to transmission to Google's servers in the United States. Google will not associate your IP address with any other data it holds about you.

The transfer of personal data to the United States is subject to appropriate cross-border data transfer safeguards as required by Article 29 of the Saudi PDPL. For more information on Google's privacy practices, please visit: https://support.google.com/analytics/answer/6004245.

9. Google reCAPTCHA

We use Google reCAPTCHA to protect the Platform from spam and automated abuse. When reCAPTCHA is activated, Google collects personal and non-personal data including browser cookies, mouse click information, browser language, installed plugins, and JavaScript objects. This data is sent to Google in the United States.

Our legal basis for this processing is our legitimate interest in maintaining the security and integrity of the Platform. For more information, please visit: https://www.google.com/recaptcha/intro/v3.html.

10. Cross-Border Data Transfers

Several third-party cookies listed in this Policy result in the transfer of personal data to servers located outside the Kingdom of Saudi Arabia, including to the United States, Ireland, and other jurisdictions.

In accordance with Article 29 of the Saudi PDPL and the Regulations on Personal Data Transfer outside the Kingdom (issued by SDAIA, as amended on 1 September 2024), such transfers are carried out only where:

• The transfer is necessary for the performance of a contract or the protection of the public interest;

• The recipient country ensures an adequate level of protection for personal data; or

• Appropriate contractual safeguards, standard data protection clauses, or other mechanisms approved by SDAIA are in place.

A record of all cross-border transfers is maintained in our internal data processing register, available to SDAIA upon request.

11. Data Retention

Personal data collected through cookies is retained for no longer than is necessary for the purpose for which it was collected, and in any event for no longer than the periods specified in the cookie table in Section 4.

Upon expiry of the applicable retention period, or upon withdrawal of your consent, cookie data will be deleted or anonymised in accordance with our data retention and disposal procedures and Article 18 of the Saudi PDPL.

11A. Personal Data Breach Notification

In the event of a personal data breach affecting personal data collected through cookies, Effivity Technologies Pvt Ltd shall notify the Saudi Data & AI Authority (SDAIA) within seventy-two (72) hours of becoming aware of the breach, in accordance with Article 20 of the Saudi PDPL and the Implementing Regulations. Where the breach is likely to result in serious harm to data subjects, affected individuals will also be notified without undue delay.

12. Children's Data

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from children through cookies. In line with the Implementing Regulations of the Saudi PDPL, where personal data of a data subject who has limited or no legal capacity (including minors) is processed, consent must be obtained from the guardian or legal representative. If you believe that a child has provided us with personal data, please contact us at privacy@effivity.com and we will take immediate steps to delete such data in accordance with the Saudi PDPL.

13. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our practices, applicable law, or guidance from SDAIA or NDMO. Any material changes will be communicated to you via a prominent notice on the Platform and, where appropriate, by email or through the cookie consent tool.

The date of the most recent revision is indicated at the top of this document. We encourage you to review this Policy periodically to stay informed about our use of cookies.

An Arabic-language version of this Cookie Policy is available upon request and may be obtained by contacting privacy@effivity.com. In the event of any discrepancy between the English and Arabic versions, the Arabic version shall prevail in respect of data subjects in the Kingdom of Saudi Arabia.

14. Contact Us

If you have any questions, concerns, or requests regarding this Cookie Policy or our processing of your personal data, you may contact our Privacy team using the details below: