1. Introduction
BRJ is committed to respecting your privacy and protecting your personal data.
We will be transparent about the information we are collecting about you and what we will do with it.
We will use your personal data for the purposes described below. Your personal data will not be processed in a manner inconsistent with the purpose of its collection or in cases other than those stipulated by applicable privacy laws.
We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to process your personal data.
We have measures to protect your personal data and keep it secure.
We will respect your data protection rights and aim to give you control over your own personal data.
You can access our full Privacy Policy below to help you to understand how we use your personal data. In it, we explain in particular the types of personal data we collect, how we collect and process it, what we may process it for and who we may share it with.
2. Full Privacy Policy
2.1 Controller Of Personal data
Any personal data processed in connection with this Privacy Policy is controlled by Bab Rizq Jameel Company Ltd (“BRJ”, “we”), having its CR Number 4030169294 with registered head office Prince Majed Street, Al Safa District, P.O Box 248, Jeddah 21411, Kingdom of Saudi Arabia. which is considered the “data controller” of your personal data under the KSA Personal Data Protection Law and its Implementing Regulations. To contact our Data Protection Officer, please send a request using the contact details specified at the end of this Privacy Policy.
2.2 What do we do?
We believe small and medium enterprises are vital to driving national economic growth. Guided by this conviction, we established the MIT Enterprise Forum in Saudi Arabia to energize the local entrepreneurship ecosystem. Today, we have evolved that event into the StartSmart Competition, leveraging our membership in the MIT-Jameel World Education Lab to deliver knowledge and value to Saudi entrepreneurs
2.3 What Do We Mean By Personal Data?
Personal data means any data, regardless of its source or form, that may lead to identifying you specifically, or that may directly or indirectly make it possible to identify you, including your name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of you, and any other data of a personal nature.
2.4 When Does This Policy Apply?
This Privacy Policy applies to personal data about you that we collect, use, or otherwise process in connection with your relationship with us as a Participants and your use of our website and any online services offered through the website. Personal data is utilized in this process to assist you with registering for evaluation, selection and performance tracking of the startup.
2.5 How We Collect and What Types of Personal Data Do We Collect About You?
2.5.1 Direct Collection
We collect and generally process personal data that you provide directly to while interacting with us via website, email, phone or in person visits.
In that respect, we collect the following types of personal data:
Data Elements
Data Category
Purpose of Collection
Name/Photograph/ Date of Birth/ PIN
Personally Identifiable Information
To accurately identify candidates.
Address
Email Address
Contact Number
Contact Information
To enable efficient communication, provide relevant updates about opportunities.
Educational Qualifications
Candidate Information
To Gather relevant educational details.
We will inform you at the time of collection of your personal data whenever the provision of such personal data to us is mandatory in order to allow us to achieve the purposes described below. Otherwise the provision of the personal data is optional. If you do not provide the personal data we require this may affect our ability to provide services to you.
2.5.2 Indirect Collection
We may also collect and process personal data about you indirectly when you use our services, our website.
In that respect, we collect the following types of personal data:
Data Element
Data Category
Purpose of Collection
location data, IP address, Cookies
Online Identifiers
To Enhance user experience, website performance.
2.6 What Do We Use Your Personal Data For and Our Legal Basis?
We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to use your data, as described below:
2.6.1 Performance of Contract
It will be necessary for us to use your personal data to:
accept and store your online competition entry and all required supporting documents, verify your identity, postal address and overall eligibility to participate in the StartSmart Competition
forward your submission and contact details to the Competition’s internal judging committee so they can evaluate entries and, where needed, communicate with shortlisted candidates
administer every stage of the Competition lifecycle—scheduling pitches, confirming attendance, awarding cash prizes and other benefits, and publishing the list of winners on our digital channels in accordance with the official rules
Provide you with personalized feedback, coaching and mentorship throughout the Competition to help you refine your pitch and business model
respond to enquiries or support requests sent via the website
promote the Competition’s objectives by publishing participant testimony on our website and social-media accounts .
2.6.2 Legitimate Interest
We may have a legitimate business interest to process your personal data to:
protect the security and integrity of our website and competition platforms, maintain session management and guard against fraud or misuse (essential cookies)
analyse aggregated site-usage data (performance cookies and analytics) so we can improve website functionality, content and overall user experience
Use your profile and submission data to facilitate introductions and networking with potential investors, mentors, and partner organizations aligned with your project
Share relevant participant profiles and pitch summaries with vetted investors to support funding opportunities for shortlisted startups
2.6.3 Compliance With Legal Obligation
We may need to process your personal data to comply with laws and regulations, including to:
confirm that every participant is at least 18 years old and that submissions do not breach Saudi laws or public-policy principles
respond to lawful requests from courts, regulators or law-enforcement bodies and to enforce our Terms & Conditions or protect the rights, property or safety of Bab Rizq Jameel and others
fulfill your Data Subject Rights requests, as required by applicable data protection laws.
2.6.4 Vital Interest
In exceptional circumstances—such as a medical or safety emergency during a Competition event—we may need to process limited personal data to safeguard your life or physical well-being when obtaining your consent is impossible or impracticable.
2.6.5 Consent
We may rely on your prior consent in order to:
place non-essential cookies or similar technologies on your device to personalise content and enhance your browsing experience, as detailed in our Cookie Policy
send you optional , marketing updates and invitations about future StartSmart competitions and conferences when you choose to subscribe via the “Stay in touch” form.
In case we use your data for any automated decision-making, we will obtain your consent
You can withdraw your consent to such processing at any time, by visiting the consent withdrawal webpage on our website, or alternately contact us by sending a request using the contact details specified at the end of this Privacy Policy. In addition, each marketing communication we send by email will also have an unsubscribe option which will allow you to stop receiving further marketing emails.
Please note that if you tell us that you do not wish to send further marketing communications, you will still receive service communications (as described above) that are necessary, for example, to notify you of your account or payment status or Competition.
2.7 How Long Do We Keep Personal Data?
We will retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Your information will be retained for a period of 10 years to ensure effective support, operational continuity, and compliance across all business functions. This period also enables us to handle or respond to any complaints, queries, or concerns relating to your account or application, including meeting any applicable statutory requirements.
If you stop interacting with us as a participant, we will remove or anonymize your information after the passing of the statutory requirements. On the expiry of the applicable data retention periods, we will delete it securely, or in some cases anonymize it.
If you wish to know more about our retention policy and retention periods that apply to your personal data, please send a request using the contact details specified at the end of this Privacy Policy.
2.7.1 Who Do We Share Your Personal Data With?
For the purposes referred to under this Privacy Policy, we share your personal data with processors, acting on our behalf and upon our instructions, providing us with the services necessary for the achievement of the purposes described above. our third-party Providers are:
Marketing Platform Provider – We engage a marketing platform to deliver targeted campaign communications. Disclosures occur on an occasional basis, aligned with scheduled marketing activities.
Platform Development Partner – We share required data to support the ongoing development, functionality, and maintenance of the StartSmart platform. This transfer is regular and essential to the platform’s operational integrity.
These third parties are only permitted to use your personal data to the extent necessary to enable them to provide their services to us. They are required to follow our instructions and to comply with appropriate security measures to protect your personal data
Your personal data may also be shared with other entities acting as independent controllers, i.e.:
any legal or government authorities or agencies, or third parties such as law firms and courts, in connection with claims, disputes, litigations or investigations.
third parties, such as the police and regulatory authorities, to protect our rights, property, or the safety of our customers, staff and assets.
anti-fraud screening service providers to process payments and (where necessary) to carry out fraud-screening; other websites so that they know that you have visited our websites (Cookie Notice)
any other third party pursuant to your express consent.
For further information, you should consult the privacy policies of these independent controllers as provided to you. We do not sell personal data to third parties, and we only allow third parties to send you marketing information where we have your consent to do so.
2.8 Do we Transfer Your Personal Data Outside KSA?
When we share your personal data with the entities mentioned above, it may imply transfers of your personal data outside KSA, namely to the UAE for executing targeted marketing campaigns, and to Egypt for the development and maintenance of the StartSmart platform
We seek to ensure such transfers satisfy the conditions set out under the applicable privacy laws. We have in particular limited the transfer to the minimum personal data needed and implemented sufficient guarantees for preserving confidentiality of the personal data transferred, so that the standards of protection of your personal data is not less than the standards set forth in the applicable privacy laws.
2.9 What Are Your Legal Rights In Relation To The Personal Data We Hold About You?
Under KSA PDPL , you have certain rights regarding your personal data. We retain your personal data for a period of 10 years, after which it will be securely deleted or anonymized unless a longer retention period is required by law. Responses to any requests to exercise your rights will be provided within 30 days (or within any other period required under applicable law).
Under the applicable privacy laws, you have certain rights in relation to your personal data. Responses to exercise your rights will be provided within 30 days (or such other period under applicable law). You can exercise your rights by contacting via email at brjdpooffice@ALJ.COM
We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise, and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. Further explanation of those rights and the exceptions to them are set out below.
Details of how to exercise your rights are set out in the section below “How can you exercise your legal rights and change how we use your data”.
Your rights include the following:
Right of access to your personal data.
Right to request access.
Right to be informed about our processing of your data.
Right to obtain personal data in a readable and clear format.
Right to request correction, completing or updating personal data.
Right to request the destruction/erasure of personal data.
Right to withdraw consent
In any case, you also have the right to lodge a complaint with the competent data protection authority in accordance with applicable law if you consider that the processing of your personal data carried out by us infringes the applicable privacy laws.
2.10 How Can You Exercise Your Legal Rights And Change How We Use Your Data?
In order to exercise any of your rights mentioned above, or if you have any questions or complaints about our use of your personal data, please send a request using the contact details specified at the end of this Privacy Policy
We may ask for some additional information to confirm your identity, which will only be used to process your request.
In your request, please try to make clear which right(s) you would like to enforce and provide any details which may help us answer to your request.
Where you fully or partially lack legal capacity (for example you are a child under 18) your legal guardian may be required by applicable law to exercise your rights on your behalf.
2.11 Security of Your Personal Data
To protect against the loss, misuse and alteration of the information under our control, we have in place appropriate physical, electronic and managerial procedures. For example, our servers are accessible only by authorized personnel and your information is shared with respective personnel on need to know basis to complete the transaction and to provide the services requested by you.
Although we will endeavor to safeguard the confidentiality of your personal data, transmissions made by means of the Internet cannot be made absolutely secure.
To make sure your access to our services is secure, you should not share your log-in details with anyone else. When you finish using our services, you should log out if others may be able to access your computer or device. This is especially important if you are using a publicly accessible computer.
Be aware that there is an Internet fraud practice known as ‘phishing’ which is the illegal gathering of personal data by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a cloned or illegal copy website.
3. How will we inform you of changes to this privacy policy?
If we change this Privacy Policy, we will let you know about the changes by publishing the updated version on our website. If such a change to the Privacy Policy requires your consent, you will have a choice to consent as to whether or not we may use your personal data in this different manner.
We are committed to protecting and respecting your privacy and will continue to do so in any future changes we make to this Privacy Policy.
The Privacy Policy was last updated on 03/06/2025
4. How to get in touch with us and your right to complain to our supervisory authority?
4.1 How to get in touch with ALJ?
If you want to exercise any of your rights, or if you have any questions about this policy or our use of your personal data, please contact the Data Protection Officer.
The Data Protection Officer for BRJ can be contacted via email at brjdpooffice@ALJ.COM
4.2 How to get in touch with SDAIA?
If you are not satisfied with how we handle your complaint, or if we fail to respond within 30 days, you have the right to file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).
Email -Info@sdaia.gov.sa.