Introduction
National Biscuits Confectionery Company (NBCC), together with its affiliates and subsidiaries (collectively referred to as HSA), is committed to protecting your personal data in accordance with applicable laws in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (“KSA PDPL”) and its Implementing Regulations.
This Privacy Notice explains how we collect, use, share, retain, and transfer your personal data when you interact with our website or engage with us in recruitment activities. It also outlines your rights. This Notice should be read together with our Cookie Policy.
About NBCC
National Biscuits Confectionery Company (NBCC), established in 1988 in Jeddah, Saudi Arabia, is one of the largest biscuit and snack manufacturers in the Middle East. The company offers a wide range of products through its leading brands — Teashop, Memories, and Al-Batal. Certified with ISO 22000 and the SASO Quality Mark, NBCC exports to over 25 international markets.
What Personal Data Do We Collect?
Personal data refers to any information about an individual from which that person can be identified.
Website Visitors: NBCC may collect the following types of personal data directly or indirectly when you interact with our website:
- Personal identifiers: such as your email, phone number, job position, first name, last name, or any other personal data you submit through our website.
- Location information: such as location data provided by a mobile device or linked to your IP address, where permitted by law.
- Essential browser data and trackers: such as your IP address through “essential cookies.”
- Optional browser data and trackers: such as browser/device type, operating system, referral source, visit duration, and pages viewed through “optional cookies.”
Applicants and Candidates: For Recruitment Activities, NBCC may collect:
- Recruitment information: including personal identifiers (name, date of birth, nationality), contact information (address, email, phone), and professional information (CVs, educational history, work experience, skills and references).
- Digital platform interactions: such as name, address, and contact number.
Categories of Personal Data
| Category | Details |
|---|---|
| Identification Data | Full name, gender, nationality, date and place of birth, National ID/IQAMA, passport number, driving license number, signature, and photo identification. |
| Contact Information | Home or business address, email address, phone number, and national address. |
| Financial Information | Payment information, financing data, insurance coverage, and related financial transactions. |
| Sensitive Data | Biometric or health data where legally required. |
| Employment & Education Data | Occupation, employer, and employment details. |
| Family & Relationship Data | Emergency contacts. |
Legal Basis for Processing
- Legal Obligation: To comply with Saudi laws, including PDPL and other regulatory bodies.
- Contractual Necessity: To fulfill our contractual obligations.
- Legitimate Interests: To improve our operations, ensure safety, and provide efficient customer service.
- Consent: For specific purposes such as marketing communications or sharing information with third parties.
- Vital or Public Interests: To protect safety or comply with public authority requests.
How We Collect Your Personal Data
Information you give us — directly from you when you request or purchase products/services, register with us, call our service number, or otherwise interact with us, including via online forms and through HSA subsidiaries.
Information collected automatically — indirectly via technologies such as cookies and APIs when you visit our websites and applications, or through analytics tools.
Personal Data Usage
- With your consent: to respond to inquiries, provide customer service, send marketing communications and handle recruitment activities.
- Contractual obligations: to manage accounts, requests, and recruitment steps.
- Legitimate interests: to protect our business and website, deliver relevant content, ensure security, improve services, detect fraud, and evaluate recruitment processes.
You can withdraw consent at any time; however, declining to provide personal data may limit the services we can offer.
Who We Share Your Personal Data With?
- Financial Institutions: For payment and salary.
- Insurance Companies: For insurance management.
- Service Providers: IT hosting, CRM, logistics, and marketing partners under strict confidentiality agreements.
- Regulatory or Government Authorities: Upon lawful request or when required for licensing, taxation, or compliance.
- Legal and Professional Advisors: For compliance, audit, or dispute resolution.
- Law Enforcement: When required for accident investigation or fraud prevention.
- With Your Consent: For any additional sharing beyond the above cases.
Security and Retention
We retain your personal data as long as necessary to fulfill the purposes in this Notice unless a longer retention period is required by law. When no longer required, we securely dispose of or anonymize it.
Disclosures of Your Personal Data
We may disclose your personal data to: affiliates and subsidiaries; service providers; third-party platforms (when you direct us); and authorities when required by law.
How We Keep Your Data Secure
- Data encryption and access controls.
- Regular vulnerability assessments and monitoring.
- Secure storage within Saudi Arabia (or approved regions with equivalent protection).
- Employee training on data protection and privacy.
- Strict confidentiality obligations for all service providers.
International Data Transfers
If your personal data needs to be shared outside the Kingdom, it will only be done in accordance with PDPL requirements, to countries with adequate data protection laws or through approved contractual safeguards.
Your Rights
- Right to Be Informed: about how your data is collected and used.
- Right to Access: your personal data.
- Right to Request a Copy: of your personal data.
- Right to Correct: inaccurate or incomplete data.
- Right to Delete: your personal data when no longer required or unlawfully processed.
- Right to Withdraw Consent: at any time.
- Right to File a Complaint: with the Saudi Data and Artificial Intelligence Authority (SDAIA).
We will process all valid requests within 30 days, extendable once with notification.
Protection of Minors and Legally Incompetent Persons
Our services are intended for adults and legally competent individuals. If we process data of minors, it must be provided or approved by a parent or legal guardian.
Third Party Links
We are not responsible for third-party websites. Please review their privacy notices.
Your Responsibilities
You are responsible for ensuring the accuracy of the information you provide and informing us promptly of any changes. If you share personal data of other individuals, you must ensure they are aware of this Privacy Notice.
Social Media and Public Platforms
We advise you not to share sensitive or personal information on our social media pages (Instagram, X, YouTube, etc.), as these platforms are publicly accessible.
Updates to This Privacy Notice
This Privacy Notice was last updated in February 2026. We may update it from time to time. Updated versions will be published on our website.
Last updated: February 2026
Contact Us
If you have any questions regarding this Privacy Notice or your data rights, please contact our Data Protection Officer (DPO) at: _TechnovalDPO@technoval.com