Al Amjaad Trading & Manufacturing Company "Barns"

Effective Date: 1/10/2026

Introduction and Scope of the Policy

Al Amjaad Trading & Manufacturing Company "Barns" is committed to protecting your personal data, respecting your privacy, and complying with the provisions of the Personal Data Protection Law in the Kingdom of Saudi Arabia, its Implementing Regulations, and the relevant laws and instructions.

This Policy explains how the Company collects, processes, uses, stores, and destroys your personal data through its website, www.barns.com.sa. It also explains your rights relating to your personal data and how to exercise such rights.

Al Amjaad Trading & Manufacturing Company "Barns" is the Controller of the personal data processed within the scope of this Policy and is committed to processing your personal data in accordance with the applicable legal bases and the specific purposes set out in this Policy.

By using the Company's website and providing your personal data through it, you acknowledge that you have read this Policy and understood how your personal data is collected, processed, and used, as well as the specific purposes thereof. Your personal data is processed in accordance with the applicable legal bases and the purposes set out in this Policy. Separate consent is not required where there is another legal basis that permits the processing in accordance with the provisions of the Personal Data Protection Law and its Implementing Regulations. Where consent is the legal basis for processing, such consent shall be obtained in accordance with the applicable legal requirements.

Purpose of Collecting Personal Data

The Company collects and processes personal data provided through the inquiry form and the order form for specific purposes directly related to the Company's activities, including the following:

• Processing inquiries and requests, and communicating with the Data Subject to respond to their inquiry or request and provide them with relevant information.
• Understanding the needs of customers and beneficiaries in relation to the Company's products and services, which helps the Company provide appropriate information and services.
• Improving and developing the services provided to customers and beneficiaries based on the inquiries and requests received, to the extent necessary and permitted by applicable laws and regulations.
• Using personal data for marketing purposes and promoting the Company's products and services, as well as the products and services of the Group Companies, including providing related offers and information, in accordance with the applicable legal basis and the requirements for obtaining consent, where required.
• Processing and fulfilling orders placed through the website, including confirming the order, arranging delivery to the address provided, and communicating with the Data Subject regarding the order.
• Enabling payment for orders through the payment methods available on the website.

The Company shall not use personal data for purposes that are incompatible with the purpose for which the data was collected. The personal data collected and processed shall also be limited to the minimum necessary and directly related to the specified purposes, in accordance with the Personal Data Protection Law and its Implementing Regulations.

Where the processing of personal data for marketing purposes is based on the Data Subject's consent, such consent shall be obtained in accordance with applicable legal requirements, with the purpose of the processing clearly specified when requesting consent.

Personal Data Collected

The Company collects the minimum personal data necessary to process enquiries and requests submitted through its website. The personal data collected may vary depending on the nature of the enquiry or request.

The personal data that may be collected through the enquiry form includes the following:

• Name.
• Company name.
• Email address.
• Phone number.
• City.
• Type of enquiry or request.
• Message content and any information that the Data Subject chooses to provide therein.

The personal data that may be collected through the order form (checkout) includes the following:

• First name and last name.
• Phone number.
• Email address.
• Delivery address.
• City.
• Order notes and any information that the Data Subject chooses to provide therein.

The Company is committed to collecting personal data that is necessary and appropriate for achieving the specified purpose for which it is collected. The Company does not request additional personal data that is not directly related to the purpose of processing, unless the collection of such data is required or permitted under the applicable laws and regulations.

Methods of Collecting Personal Data

Personal data is collected directly from the Data Subject, including, for example:

• Completing the enquiry or contact forms available on the Company's website.
• Submitting requests or correspondence and communicating with the Company through its approved official channels.
• Providing the Company with personal data when contacting the Company or requesting its products or services, where necessary to achieve the specified purpose of processing.

Personal data is also collected directly from the Data Subject when placing an order through the website, by completing the order form and providing the delivery details necessary to fulfil and deliver the order.

Personal Data Storage

Personal data collected through the Company's website is stored in the Company's electronic systems and associated backups, in accordance with applicable legal requirements and the Company's approved internal policies and procedures.

The Company takes appropriate technical and organizational measures to protect stored personal data against unauthorized access, use, disclosure, alteration, loss, or damage, taking into account the nature of the data and the risks associated with it.

Personal Data Processing

Personal data is processed by the Company to the extent necessary to achieve the specific and legitimate purposes set out in this Policy, in accordance with the Personal Data Protection Law, its Implementing Regulations, and other relevant laws and regulations.

Personal data is processed in accordance with the Company's approved internal policies, controls, and procedures, in a manner that ensures that such processing is related to the purpose for which the personal data was collected and that the data is not used in a manner that conflicts with that purpose, except where otherwise permitted by law.

The processing of personal data is limited to persons authorized to process such data in accordance with the nature of their duties and job responsibilities, and only to the extent necessary to fulfill the specified purposes of the processing.

Disclosure of Personal Data

The Company may share personal data with service providers that support the fulfilment of orders, such as delivery and payment service providers, only to the extent necessary to process the order and deliver it to the Data Subject, and in accordance with the Personal Data Protection Law and its Implementing Regulations. The Company takes appropriate measures to ensure that such providers process personal data only for those purposes and protect it appropriately.

Destruction of Personal Data

The Company is committed to destroying personal data when the purpose for which it was collected has been fulfilled or has ceased to exist, or when the statutory retention period has expired, unless there is a legal basis requiring its retention for a specified period, or its retention is necessary to fulfil a legal obligation, protect the rights of the Company or the Data Subject, or due to its relevance to proceedings or a case pending before a competent authority.

In cases where personal data is required to be retained after the purpose for which it was collected has ended, it shall be destroyed upon the expiry of the statutory retention period or when the reason for retaining it ceases to exist, as applicable, in accordance with the policies, procedures, and security standards approved by the Company.

The Company takes appropriate measures to ensure that personal data is destroyed in a manner that prevents its recovery, access, or reuse, whether the data is stored electronically or by any other means.

Data Subject Rights

Subject to the conditions, controls, and exceptions set out in the Personal Data Protection Law, its Implementing Regulations, and the relevant laws, you have the right to:

• Right to Know: Know the legal basis for collecting and processing your personal data, as well as the purpose for which it is collected and processed.
• Access: Access and view your personal data held by the Company, in accordance with the applicable statutory controls and procedures.
• Obtaining a Copy: Request a copy of your personal data held by the Company in a clear and readable format, in accordance with the applicable statutory controls and procedures.
• Correction: Request the correction, completion, or updating of your personal data where it is inaccurate, incomplete, or not up to date.
• Destruction: Request the destruction of your personal data where it is no longer needed, subject to statutory retention requirements and cases where the law requires the data to be retained.
• Withdrawal of Consent: Withdraw your consent to the processing of your personal data in cases where consent is the legal basis for the processing, in accordance with the applicable statutory controls and exceptions.
• Submitting a Complaint: Submit a complaint regarding the processing of your personal data to the Company through the communication channels designated for this purpose. You also have the right to submit a complaint to the competent authority in accordance with the Law.

Exercise of Data Subject Rights

The Company has appointed a Personal Data Protection Officer to oversee privacy and personal data protection matters within the Company. To submit a request relating to your rights, or to make an enquiry or submit a complaint regarding the processing of your personal data, you may contact us through the following channels:

• Email: dpo@barns.com.sa
• Phone: +966.12.6690025
• Address: P.O. Box 8707, Jeddah 21492, Tahlia St., Kingdom of Saudi Arabia.

Please state the nature of your request and provide the Company with the information necessary to identify the personal data related to it. The Company may request additional information or documents, to the extent necessary, to verify your identity, in order to protect your personal data from unauthorized access or disclosure.

The Personal Data Protection Officer reviews the request and coordinates with the relevant departments and functions to take the necessary action in relation to the request, and responds to the request within the periods specified under the Personal Data Protection Law and its Implementing Regulations.

The response period may be extended in cases permitted by the Law or its Implementing Regulations, provided that you are notified accordingly in accordance with the applicable legal requirements.

Submitting a request or contacting the Company does not affect your right to submit a complaint to the competent authority in accordance with the Personal Data Protection Law and its Implementing Regulations.

Privacy Policy Updates

The Company reserves the right to review and update this Policy from time to time in line with changes in personal data processing practices or the relevant legal and regulatory requirements.

Any updates to this Policy shall take effect from the date the updated version is published on the Company's website, unless a different effective date is stated in the updated version. We recommend reviewing this Privacy Policy periodically to stay informed of the latest version.

The Company undertakes to record updates made to this Policy in the updates log, including the date of the update and the material changes made, where appropriate.

In cases where the relevant laws and regulations require Data Subjects to be notified of changes or their consent to be obtained, the Company will take the necessary measures required by law accordingly.