RSA Privacy Policy

Last Updated Oct 15, 2026

About Us

Morni is a brand owned by Advanced Innovation Trading, a Saudi company providing integrated digital services for the automotive sector, including roadside assistance, vehicle auctions, claims services, and vehicle care through its applications and electronic platforms.

At Morni, we are committed to protecting your Personal Data and processing it transparently in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations. This Privacy Policy explains what Personal Data we collect, how we collect it, the purposes for which we process it, how we retain and destroy it, your rights, and how you can exercise them.

Scope of the Privacy and Data Protection Policy

This Privacy Policy applies to Personal Data that we collect or process when you use our websites, applications, and services. It covers customers, application users, service providers, auction sellers and buyers, and representatives of contracted entities.

Personal Data We Collect

We collect the minimum Personal Data necessary to provide our services and fulfill our obligations. The categories of Personal Data we may collect include:

We do not collect additional Personal Data beyond what is necessary for the relevant service unless there is a lawful basis for doing so and you are informed in accordance with applicable law.

How We Collect Your Personal Data

Directly from you:

When you create an account, request a service, contact us, or upload documents.

Through our applications:

For example, location data while an active service request is in progress or service providers' connection status, subject to the permissions you grant.

From parties involved in providing the service:

Such as payment service providers for transaction verification and operational partners, to the extent necessary to fulfill your request.

We collect only the minimum Personal Data necessary and directly relevant to the specified processing purposes. Our collection is limited to what is necessary to achieve those purposes or what is supported by a lawful basis.

Why We Process Your Personal Data

We process your Personal Data for the following purposes:

Legal Basis for Processing

We identify an applicable lawful basis for each processing activity before it begins. These bases may include:

Your Consent and Withdrawal of Consent

Where consent is the lawful basis for processing, we obtain it freely, specifically, in a documented manner, and separately for each purpose.

You may withdraw your consent at any time as easily as you provided it, through the application settings or by contacting us at data.protection@morni.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We do not send you marketing communications unless you have provided your explicit consent. Every marketing communication provides an option to unsubscribe.

Sharing and Disclosure of Your Personal Data

We do not sell, rent, or trade your Personal Data. We may share your Personal Data only to the extent necessary with the following parties:

For any disclosure, we ensure that a lawful basis exists, that disclosure is limited to the minimum necessary, and that it is documented. We do not disclose Personal Data where doing so would compromise the security of the Kingdom, the safety of individuals, the privacy of others, or confidentiality obligations.

Transfer of Personal Data Outside the Kingdom

As a general rule, your Personal Data is processed within the Kingdom of Saudi Arabia. If transferring Personal Data outside the Kingdom becomes necessary, the transfer will be carried out only in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom, limited to what is necessary, and subject to the applicable safeguards. We will inform you or obtain your consent where required by law.

Retention and Destruction of Your Personal Data

We retain your Personal Data for as long as necessary to fulfill the purpose for which it was collected or for the period required by applicable laws. Once the relevant retention period ends, we securely destroy the data in a manner that prevents its recovery or irreversibly anonymize it.

We may continue to retain Personal Data after the original purpose has ended where required by law or where the data relates to an ongoing claim or dispute. Our retention periods are governed by an approved retention schedule that is reviewed periodically.

How We Store and Protect Your Personal Data

We store your Personal Data in secure systems and storage environments and implement appropriate organizational and technical measures to protect it against unauthorized access, use, alteration, disclosure, or destruction. These measures include restricting access on a need-to-know basis, applying encryption where appropriate, monitoring systems, contractually requiring our partners to comply with protection standards, and training our employees on data protection and confidentiality.

Access to Personal Data is restricted to authorized individuals who require it to perform their duties.

Personal Data Breaches

If a Personal Data breach occurs that may harm your Personal Data or rights, we will take immediate steps to contain and address the incident. We will notify the competent authority within the applicable statutory time limits and inform you without undue delay, in clear language, where the incident is likely to cause you harm. Such notification will include the measures taken and steps you can take to protect yourself.

Minors and Persons Under Legal Guardianship

Our services are intended for individuals who have the legal capacity to use them. Where Personal Data relates to a minor or a person subject to legal guardianship, processing will be carried out through their legal guardian or lawful representative after verifying their capacity, in a manner that serves the Data Subject's best interests.

Cookies

We use cookies and similar technologies to operate and secure our services, remember login details, analyze and improve service usage, and support marketing activities and live chat functionality.

The types of cookies used may vary depending on the service. You can manage cookies through your application or browser settings. Disabling certain cookies may affect the functionality of some features.

Your Rights

Under the Personal Data Protection Law and its Implementing Regulations, and subject to the applicable conditions and exceptions, you have the following rights:

How to Exercise Your Rights

You may exercise any of your rights by contacting us at data.protection@morni.com or through our customer service channels.

We may request documents to verify your identity or the authority of your representative in order to protect your Personal Data.

We will respond to your request within thirty (30) days of receipt. This period may be extended by an additional thirty (30) days where necessary, provided that we notify you of the reasons for the extension.

Complaints and Escalation

If you are dissatisfied with how we have handled your request or complaint, you may escalate the matter to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the complaints service on the National Data Governance Platform, within ninety (90) days from the date of the incident or when you became aware of it.

Your Responsibility for the Accuracy of Your Personal Data

You are responsible for ensuring that the Personal Data you provide to us is accurate and up to date.

If you provide Personal Data relating to another individual, you confirm that you have the necessary lawful authorization and have informed that individual of this Privacy Policy to the extent relevant to them.

Updates to This Privacy Policy

We may update this Privacy Policy to reflect legal, regulatory, or operational changes. The updated version will be published with its latest update date.

We will notify you of material changes through our communication channels. We will obtain your separate consent where a change introduces a new purpose for which consent is required. Your continued use of our services alone does not constitute consent where explicit consent is required.

General Provisions

This Privacy Policy is governed by the Personal Data Protection Law issued under Royal Decree No. (M/19) dated 9/2/1443 AH, as amended, together with its Implementing Regulations.

In the event of a conflict with any applicable legal requirement, the applicable legal requirement shall prevail, and this Privacy Policy will be updated accordingly. Nothing in this Privacy Policy limits any greater protection afforded to you under applicable law.

If you have any questions about this Privacy Policy or your Personal Data, please contact us at data.protection@morni.com or call our unified contact number at 920003922.