Privacy Notice
Cenomi Centers Privacy Policy
Last Updated: November 28th, 2025
Introduction
This Privacy Policy explains how Arabian Centers Company (“Cenomi”, “we”, “us” or “our”) collects, uses, discloses and protects personal data that you submit through the Unibail-Rodamco-Westfield (“Westfield”) operated webpages dedicated to Westfield Cenomi malls in the Kingdom of Saudi Arabia (the “Cenomi Webpage”).
We are a publicly listed company established in the Kingdom of Saudi Arabia with our full name Arabian Centers Company a registered office at King Saud University, Prince Turki Bin Abdulaziz AlAwal Street; Uwalk Riyadh, and registered company number 1010209177. This Privacy Policy details how we process personal data that we collect from the Cenomi Webpage, and we are the data controller of such information.
If you have any questions about this Privacy Policy or our privacy practices, please contact us at privacy@cenomi.com.
Changes to this Privacy Policy and Your Duty to Inform us of Changes
We may modify this Privacy Policy from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Policy. We encourage you to periodically review this privacy policy to stay informed about how we are protecting your personal data. Please check back regularly to ensure you are aware of the latest updates as your continued use of our services signifies agreement to any changes. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Third-Party links
The Cenomi Webpage may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the Cenomi Webpage, we encourage you to read the privacy policy of every website you visit.
Relationship with Westfield
The Cenomi Webpage is hosted within Westfield’s website. Westfield’s Privacy Policy applies to your broader use of the Westfield website. However, this Privacy Policy exclusively governs the collection and processing of personal data by Cenomi through the Cenomi Webpage.
What is Personal Data and what Personal Data is Collected?
In line with the Kingdom of Saudi Arabia Personal Data Protection Law, including its Implementing Regulations (collectively, the PDPL) of the Kingdom of Saudi Arabia, personal data is “Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature.”
We may collect, use, store and transfer different kinds of personal data about you including:
Name, address, contact details, email address.
IP address.
Communications and interactions with our support team.
Purpose and Legal Basis
We may process your information in order to perform our contract with you, such as:
Provide you with our services and other content via the Cenomi Webpage.
In order to be responsive to you, to provide effective services to you, and to maintain our business relationship, as a matter of our legitimate interests, we may use your information to:
Administer the Cenomi Webpage and related services, and for internal operations, in order to conduct troubleshooting, data analysis, testing, research, statistical and survey analysis.
Maintain the safety and security of our users, the Cenomi Webpage, our services, and business.
Send you announcements in relation to security, privacy or administrative related communications (these communications are not marketing orientated, and we do not rely on consent, so you may not opt-out).
Remember your preferences and settings.
Personalize the Cenomi Webpage and our services to ensure content is presented in the most effective manner for you and your device.
Improve and develop our services.
In addition, we may use some or all of the above information to comply with applicable legal obligations (including compliance with the PDPL), to enforce our contractual arrangements and our policies, and to protect or defend the services, our rights, the rights of our users, or others.
Data Retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances you can ask us to delete your data: see What Are Your Rights at section 11 below for further information.
How Do We Collect Your Personal Data?
We may collect personal data through direct input from you on the Cenomi Webpage.
Is Your Personal Data Disclosed or Shared/Stored?
We may disclose your information with third parties in certain circumstances, subject to this Privacy Policy, including:
With service providers and vendors (including data analytics vendors, payment processors, security vendors, and website hosting vendors) that assist us to provide the Cenomi webpage and services to you.
When you request us to share certain information with third parties with your consent or to perform a contract with you.
With professional advisors (including auditors, law firms, or accounting firms) in our legitimate interests or as required by law.
For legal and security reasons and to protect our services and business, in our legitimate interests or as required by law. We will share your information with regulators, law enforcement agencies, public authorities, or any other relevant organisations: to comply with applicable law or obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries; to protect the interests of, and ensure the safety and security, of us, our users, a third party or the public; to exercise or defend legal claims; and to enforce our terms and conditions or other agreements.
With our affiliates or otherwise within our corporate group, in our legitimate interests.
With a prospective buyer, seller, new owner, or other relevant third party in connection with or anticipation of an asset sale or purchase, a share sale, purchase or merger, bankruptcy, or other business transactions or re-organisation (including while negotiating or in relation to a change of corporate control), in our legitimate interests.
International Data Transfers
The information that we collect from you may be accessed from, transferred to, and stored and used in countries outside the country in which you are located or the Kingdom of Saudi Arabia (if different), by us and by our third-party service providers or partners. We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this Privacy Policy.
Where legally required, transfers of personal data outside the Kingdom of Saudi Arabia will take place to jurisdictions deemed to provide an adequate level of protection for personal data by the relevant competent authority in the Kingdom of Saudi Arabia, or alternatively will take place on the basis of an appropriate safeguard or exception.
For personal data transferred outside of the Kingdom of Saudi Arabia, we ensure compliance with PDPL by implementing necessary safeguards and legal agreements.
How Do We Protect Your Personal Data?
Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the services or otherwise interacting with us via the Cenomi Webpage, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.
What Are Your Rights?
Under the PDPL, you have several rights regarding the processing of your personal data. These rights may vary depending on the purpose of data collection and processing:
Right to be informed. You have the right to be informed about how we collect, process, store, and destroy your personal data, as well as the legal basis for these activities and to whom your data may be disclosed. This information is available in this Privacy Policy. Note that there may be certain restrictions to this right, such as when disclosure would compromise the privacy of others or when legal obligations prevent full disclosure.
Right of access to your personal data.
You are entitled to request access to your personal data in a clear and readable format. Please be aware that there may be restrictions to this right, such as when access would reveal personal data about another individual or when access is restricted by law.
Right to request correction of your personal data.
If you believe that any personal data we hold about you is inaccurate, incorrect, or incomplete, you have the right to request its correction.
Right to request destruction of your personal data.
In certain circumstances, you have the right to request the destruction of your personal data. This right is subject to legal bases and obligations that may require us to retain certain data.
Right to withdraw consent to processing of your personal data.
Where you have provided your consent for processing, you may withdraw your consent for the processing of your personal data at any time, unless there are overriding legal bases that require continued processing.
Objection to marketing : You can object to marketing at any time by opting-out using the unsubscribe/opt-out function displayed in our communications to you.
To exercise any of these rights, please contact us at privacy@cenomi.com.
In addition, you have the right to lodge complaints with us or with the competent regulatory authority in the Kingdom of Saudi Arabia, being the Saudi Data & AI Authority.
Protection of Children's Personal Data
We do not knowingly collect or process personal data of individuals under 18 years of age without parental consent.
Complaints and Inquiries
If you have concerns regarding data privacy or wish to file a complaint, contact us at privacy@cenomi.com.
Language
Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Policy, the English language version will prevail.