Privacy Policy - Yarn Cloud Technologies

Privacy Policy Effective Date: January 1, 2023

I. Personal Information Collection

Yarn Cloud Technologies collects and processes personal information as a service provider to property owners and management companies (referred to as “Clients”). This personal information encompasses a wide range of data elements and may relate to Clients’ residents, potential renters, existing and potential Clients, and Client employee end users of Yarn Cloud Services.

In particular, Yarn Cloud Services have gathered the following categories of personal information from our Clients regarding their residents, prospects, and/or employee end users over the past twelve (12) months:

Category	Examples
Identifiers	Name, mailing address, email address, phone number, national ID number, passport number, or other similar personal identifiers associated with residential and commercial real estate leasing activities.
Note: Some personal information included in this category may overlap with other categories.
Sensitive Personal Information	National ID number, passport number; Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; Racial or ethnic origin;
Personal information categories listed in the Saudi Data Protection Law	Name, electronic signature, national ID number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, employment status, employment history, bank account number, credit card number, debit card number, or any other financial information, and similar personal identifiers associated with residential real estate leasing activities.
Note: Some personal information included in this category may overlap with other categories.
Protected classification characteristics under Saudi Data Protection Law	Age, gender, nationality, marital status, medical condition, physical or mental disability, and similar personal identifiers associated with residential real estate leasing activities.
Commercial information	Rental ledger data and payment history, record of applications and services utilized, customer support records and communications, and similar personal identifiers associated with residential real estate leasing activities.
Biometric information	Voice call recordings from product support operations.
Internet or other similar network activity	Information related to an individual’s interaction with a Yarn Cloud website, application, or service.
Geolocation data	Physical location for localized search/application functionality
Sensory data	Voice call recordings from product support operations
Professional or employment-related information	Current or past job history and income, and similar personal identifiers associated with residential real estate leasing activities.
Inferences drawn from other personal information	Profile reflecting a person’s preferences, characteristics, predispositions, behaviors, and personal identifiers associated with residential real estate leasing activities.

II. Personal Information Exceptions

Personal information does not encompass:

Publicly available information from government records.
De-identified or aggregated consumer information.
Information excluded from the scope of Saudi Data Protection Law, such as:
- Health or medical information covered by applicable medical privacy laws.
- Personal information covered by specific sector-specific privacy laws.

III. Personal Information Sources

Yarn Cloud Technologies gathers the categories of personal information listed above from the following sources:

Resident and potential renter personal information is collected:
- from Clients’ residents during enrollment in or utilization of Yarn Cloud Services offered on behalf of Clients,
- from Clients via direct input into Yarn Cloud Services or integration with Client software systems and third-party service providers, and
- indirectly from credit reporting agencies/bureaus, payment processors/gateways/banks, and website analytics services integrated with Yarn Cloud Services.
Client and Client employee end user personal information is collected:
- from Client’s employees during setup of Yarn Cloud Services user accounts, and
- from Client during activation and implementation of Yarn Cloud Services.

IV. Personal Information Use & Processing

While offering the suite of Yarn Cloud Services, Yarn Cloud Technologies primarily functions as a service provider under contract to our Clients. As a service provider, Yarn Cloud Technologies does not exercise control over any of the personal information we process on behalf of our Clients. Our Clients collect and manage all such personal information, and Yarn Cloud Technologies is obligated to provide our products and services in accordance with Clients’ contractual provisions and instructions regarding data collection, privacy, processing, and security. In instances where Yarn Cloud Technologies provides services as a data controller, a separate privacy policy is made available exclusively for such services at the point of data collection.

Accordingly, we may utilize or disclose the personal information we collect for one or more of the following purposes:

To fulfill the purpose for which the personal information was collected and provide the requested Yarn Cloud Services.
To integrate with services provided by Yarn Cloud Technologies or third-party service providers contracted by Clients.
To distribute communications and legally required notifications regarding the status of Yarn Cloud Services via phone, email, and SMS text.
To provide maintenance, enhancement, research, development, security, support, and website optimization for Yarn Cloud Services.
To maintain compliance with federal and state laws related to software-as-a-service, background screening, financial institutions, and money services businesses.
To establish, manage, customize, and secure Yarn Cloud Services user accounts.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Yarn Cloud Technologies’ assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Yarn Cloud Technologies is among the assets transferred. Yarn Cloud Technologies will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. Additionally, Yarn Cloud Technologies’ processing of sensitive personal information is limited to activities necessary for the delivery and performance of Yarn Cloud Services on behalf of our Clients and end users.

V. Personal Information Disclosure

Yarn Cloud Technologies does not sell personal information collected through Yarn Cloud Services, and no such disclosure has taken place in the preceding 12 months.

Yarn Cloud Technologies may share personal information with third parties for business purposes under specific circumstances, including service providers and vendors that support or integrate with the Yarn Cloud Services described in this statement (see chart below). Yarn Cloud Technologies only discloses personal information to the extent reasonably necessary to meet the requirements of Yarn Cloud Services, or for the third-party vendors or service providers to carry out the services on our or our Clients’ behalf. We do not allow third-party vendors or service providers to use or disclose your personal information except for the purpose of providing the services we request of them. However, it is important to note that Yarn Cloud Technologies does not exercise direct control over the privacy policies and practices of Clients or any other third

-party companies, agents, or contractors.

Category	Third Party Disclosure
Business Purposes	Service providers/vendors/subsidiaries
Identifiers	Service providers/vendors/subsidiaries
Sensitive Personal Information	Service providers/vendors/subsidiaries
Personal information categories listed in the Saudi Data Protection Law	Service providers/vendors/subsidiaries
Protected classification characteristics under Saudi Data Protection Law	Service providers/vendors/subsidiaries
Commercial information	Service providers/vendors/subsidiaries
Biometric information	Service providers/vendors/subsidiaries
Internet or other similar network activity	Service providers/vendors/subsidiaries
Geolocation data	Service providers/vendors/subsidiaries
Sensory data	Service providers/vendors/subsidiaries
Professional or employment-related information	Service providers/vendors/subsidiaries
Inferences drawn from other personal information	Service providers/vendors/subsidiaries

VI. Personal Information Rights and Choices – Saudi Data Privacy Rights

Certain rights regarding personal information are granted to residents of Saudi Arabia. Each right includes the ability to make specific requests as well as the obligation of the receiving party to (i) verify the identity of the requester and (ii) respond in line with statutory guidelines. This section outlines your rights and explains how to exercise them.

Accessing and Updating Personal Information

If your personal information is found to be outdated, incomplete, or incorrect, you may access and update your information by logging into your Yarn Cloud Services account or contacting your property manager. If you need confirmation that your requested changes have been implemented and such confirmation is not readily visible in your Yarn Cloud Services account, you may request confirmation at the email address provided below (See “Contact Us”).

Access to Specific Information Regarding Personal Information Use/Disclosure and Portability

You have the right to request a summary of the collection, use, and disclosure of your personal information over the past 12 months. Generally, such disclosure requests should be directed to the property manager overseeing your apartment community or rental property. As previously mentioned, Yarn Cloud Technologies functions as a service provider for our Clients, and we do not control the collection, use, and disclosure of your personal information.

However, if you have a direct relationship with Yarn Cloud Technologies, consumer requests should be submitted directly to us through the approved channels listed in Section VII below.

In response to a verifiable consumer request for these services, we will disclose the following information for the relevant Yarn Cloud Services:

The categories, specific types, and sources of personal information we collected about you.
Our business purpose for collecting the personal information.
The categories of third parties with whom we share that personal information and the purpose for the disclosure.

You also have the right to request a copy of this personal information in a readily usable format that can be transferred to other entities (often referred to as “data portability”). If you make such a request, Yarn Cloud Technologies may be (i) restricted from providing certain sensitive personal information in response to the request or (ii) prohibited from fulfilling the request entirely if it poses an unreasonable security risk.

Deletion of Personal Information

You have the right to request that Yarn Cloud Technologies delete any of your personal information that we collected and retained, subject to certain exceptions. In most cases, requests for deletion should be directed to the property manager overseeing your apartment community or rental property. As previously mentioned, Yarn Cloud Technologies functions as a service provider for our Clients, and we do not control the collection, use, and disclosure of your personal information.

However, if you have a direct relationship with Yarn Cloud Technologies, consumer requests should be submitted directly to us through the approved channels listed in Section VII below.

Once we receive and verify your verifiable consumer request, we will delete or de-identify (and instruct our service providers to delete or de-identify) your personal information from our records, unless one of the following exceptions applies:

We may deny your deletion request if retaining the information is necessary for Yarn Cloud Technologies or our service providers to:
- Complete the transaction for which we collected the personal information, provide the Yarn Cloud Services that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you or your property manager, or otherwise fulfill our contract with you or your property manager.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug Yarn Cloud Services to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided by law.
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us or our Clients.
- Comply with laws, regulations, statutes, codes, ordinances, or other legal obligations.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

VII. Submitting Consumer Requests – Exercising Access, Data Portability, and Deletion Rights

In most instances, consumer requests should be submitted to the property manager overseeing your apartment community or rental property. As previously mentioned, Yarn Cloud Technologies functions as a service provider for our Clients, and we do not control the collection, use, and disclosure of your personal information.

However, if you have a direct relationship with Yarn Cloud Technologies, consumer requests should be submitted directly to us. To exercise your access, data portability, and deletion rights, please submit a verifiable consumer request to us through the secure webform linked here.

Only you (or someone legally authorized to act on your behalf) can make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You are limited to making a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information to enable us to confirm your identity as the person about whom we collected personal information (and, if applicable, the authority and identity of an authorized representative).
Describe your request with enough detail to enable us to properly understand, evaluate, and respond to it.

Please note, we cannot respond to your request or provide you with personal information if we cannot (i) verify your identity or authority to make the request and (ii) confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to personal information associated with that specific account.

We will use personal information provided in a verifiable consumer request only to verify the requestor’s identity or authority to make the request.

VII. Consumer Request Responses and Timelines

We will acknowledge receipt of your request within ten (10) business days. If you do not receive acknowledgment within the specified timeframe, please contact us at [email protected]. We strive to respond to verifiable consumer requests within forty-five (45) days from the date of receipt. In cases where additional time is required beyond the initial 45 days, we may extend the response time by an additional 45 days (for a maximum total response time of 90 days). If an extension is necessary, we will inform you in writing, providing the reason for the extension and the anticipated duration.

If you hold an account with us, we will provide our written response through that account wherever possible. In the absence of an account or if your account does not possess communication capabilities, we will deliver our written response to the email address you have designated.

Any disclosures we make will cover only the 12-month period preceding the receipt of the verifiable consumer request. Our response will also explain the rationale behind any inability to comply with a request, if applicable.

We do not impose a fee for processing or responding to your verifiable consumer request unless it is found to be excessive, repetitive, or baselessly unfounded. If we determine that such a fee is warranted, we will explain the reasons for our decision and provide an estimated cost before fulfilling the request.

IX. Personal Information Sharing and Opt-Out Rights

Yarn Cloud Technologies does not engage in the sale of personal information collected through Yarn Cloud Services, and no such activity has occurred in the prior 12 months. In the event that Yarn Cloud Technologies alters its practices and participates in the sale of personal information as regulated by law, we will provide advance notification to affected individuals and offer the opportunity to opt in/opt out in accordance with regulatory requirements.

Yarn Cloud Technologies uses cookies and tracking technologies as detailed in the Cookie Policy. Under certain circumstances, these technologies may be deemed as a “sharing” of personal information under relevant privacy laws. We offer a cookie settings preference center, allowing you to opt out and customize the cookies presented on our websites and services.

X. Non-Discrimination

We do not discriminate against you for exercising any of your privacy rights. Unless legally permissible, we will not engage in any of the following practices in response to the exercise of your privacy rights:

Deny you goods or services.
Charge you different prices or rates for goods or services, including granting discounts or other benefits, or imposing penalties.
Provide you with a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

XI. Other Saudi Privacy Rights

The Kingdom of Saudi Arabia also grants its residents privacy rights through laws that are separate from the Saudi Data Protection Law. These rights include the following:

The ability to request information regarding the disclosure of personal information to third parties for their direct marketing purposes, in accordance with applicable laws. To make such a request, please send an email to [email protected]

XII. Cookies, Web Beacons, and Other Technologies – Do Not Track

Upon accessing Yarn Cloud Services or our website, our servers may place small text files (“cookies”) on your computer for recordkeeping purposes. Cookies help us gather information about your online activity to enhance your experience, secure user accounts, remember preferences, and customize features.

In addition to cookies, Yarn Cloud Services and our website may use web beacons, clear gifs, or similar technologies to gather insights into user interactions and feature usage. These technologies aid in identifying popular pages, viewing patterns, click-through rates, conversion rates, and other data for the improvement, monitoring, and operation of our websites, products, and services.

Details about our cookie and similar technology usage are outlined in our Cookie Policy.

Some web browsers offer a “Do Not Track” feature, allowing you to indicate your preference for not being tracked online. These features vary among browsers, and our sites are not currently configured to respond to such signals. Most internet browsers provide controls for users to directly manage or disable cookies on their devices. However, please note that deactivating cookies may disable or restrict certain features of Yarn Cloud Services or our website.

When using our mobile applications, you can choose to opt out of the collection and use of location information through the app settings. Opting out may disable location-based services within the app, affecting associated functionality and features.

XIII. Third Party Links to Other Sites

Yarn Cloud Services may feature links to third-party service providers engaged by Clients. These linked services are operated by independent third parties that maintain separate privacy statements, terms of use, and relevant notices or disclosures regarding information handling practices. We are not responsible for the information handling practices of these independent entities and encourage you to review their practices before disclosing any information.

Yarn Cloud Services offering mobile applications do not involve third-party ad partners, campaigns, or personalized ad delivery.

XIV. Data Security

Yarn Cloud Technologies implements and maintains appropriate physical, administrative, technical, and organizational measures to safeguard the information we process from unauthorized or unlawful access, use, disclosure, or accidental loss, damage, alteration, or destruction. Personal information access is restricted and authorized only for individuals with a legitimate business need. While we endeavor to protect the processed personal information, no security program can offer 100% certainty, and we cannot guarantee prevention of every unauthorized attempt to access, use, or disclose personal information. We have security incident response policies and procedures to address incidents involving unauthorized personal data access.

XV. Children’s Online Privacy

Yarn Cloud Services do not target or attract children under the age of 13 for the online collection of personal information.

XVI. Changes to Our Privacy Statement

Yarn Cloud Technologies retains the right to amend this privacy statement at our sole discretion, without prior notice. When changes are made to this statement, we will post the updated content on our applicable websites and services, along with the effective date of the change. Continued use of Yarn Cloud Services post-update indicates acceptance of such changes.

Contact Us

For any questions, concerns, or requests related to this privacy statement, including exercising your privacy rights, you may reach us at:

Yarn Cloud Technologies

Email: [email protected]
Riyadh, Saudi Arabia