The privacy policy of the Muder platform, operated by Ghanem First Information Technology.
Last updated: September 2026
Ghanem First Information Technology ("the Company") is a Saudi simplified joint-stock closed company established under the laws of Saudi Arabia, commercial registration no. (1009203129), unified number (7049166916), dated 26/02/2025.
Muder ("the Platform") is a website (muder.sa) and a smartphone app operated by the Company.
The Company provides innovative real estate opportunities that let users subscribe and earn returns from them, targeting individuals and legal entities across Saudi Arabia.
The Company works to protect users' privacy rights and secure their personal data while using the Platform.
Please read this policy alongside the Platform's terms and conditions carefully before submitting any information.
Continuing to use the Platform after a notice of changes to this policy is published constitutes consent to the updated policy from its publication date.
You can reach the Company through:
This privacy policy was last updated on 20/07/2025; you can view the update history on the Platform.
This policy aims to protect the user, preserve their privacy, and explain the data-collection controls and procedures used on the Platform, including how data is collected, used, protected, and disclosed.
The Company collects and processes the following data directly from you:
| Data type | Data collected | Optional or mandatory | Purpose of collection | Collection method |
|---|---|---|---|---|
| Account data (account creation) | – Name. – National ID/iqama number. – Address. – Email. – Mobile number. | Mandatory | To create a personalised account, verify your identity, and contact you regarding services or requests. | Directly from you via the Platform's registration form. |
| Identifying personal data | – Education level. – Occupation. – Approximate annual income. – Potential subscription amount. | Optional | To help offer opportunities matching your financial capacity and interests, and assess suitability. | Directly from you via the registration form or your profile. |
| Subscription preferences | – Target subscription size. – Prior real estate experience. – Preferred areas. – Target yield. – Preferred term. | Optional | To offer opportunities matching your preferences and improve your experience. | Directly from you via the registration form or preferences survey. |
| Bank account data | – IBAN. – Bank name. – Account holder name. | Mandatory | To transfer entitlements such as returns or liquidation proceeds to your bank account. | Directly from you via the bank account registration form. |
| Payment data | – Card number. – Cardholder name. – Expiry date. | Optional | To facilitate payment each time you subscribe, and complete orders faster. | Directly from you via the payment form; processed and stored by a licensed PCI-DSS payment provider; the Company never retains the CVV. |
| Contract documentation data | – E-signature. – Identity information. – Deed/document images (in some cases). | Mandatory | To document subscription, ownership or usufruct contracts, and secure parties' legal rights. | Directly from you via the contract documentation form. |
| Contact data | – Written contact via the unified form or email. – Technical support inquiries. | Mandatory | For development, service quality, accuracy of information, and R&D purposes. | Directly from you via the contact form or email. |
The Company also collects and processes the following data indirectly:
| Data type | Data collected | Optional or mandatory | Purpose of collection | Collection method |
|---|---|---|---|---|
| Subscription transaction data | – Subscription value. – Transaction date. – Reference number. – Opportunity details. | Mandatory | To track your subscriptions, provide periodic performance reports, ensure distribution of returns, and post-subscription services. | Indirectly via our operations-management systems. |
| Financial transaction data | – Deposit dates and amounts. – Withdrawal dates and amounts. – Wallet balance. – Returns history. | Mandatory | To track financial transactions in your wallet and maintain accurate records for regulatory compliance. | Indirectly via the Platform's payment and accounting systems. |
| Contact data | – Voice calls with the customer service centre. – Live chat conversations. | Mandatory | For development, service quality, information accuracy and effective issue resolution. | Indirectly via recording systems and call recordings. |
| Identity verification data | – ID number. – Validity date. – Accuracy of submitted data. | Mandatory | To verify the applicant's identity, protect subscribers' rights, and meet AML/CTF requirements. | Indirectly via Absher, Nafath and Yaqeen services, or by requesting an ID image in some cases. |
| Technical data | – IP address. – Operating system. – Browser and version. – Approximate location. | Partially mandatory | To provide the best experience, improve Platform performance, and personalise services; user identity is anonymised during processing. | Indirectly via cookies and third parties analysing user behaviour. |
| Data about your visits | – Full click-path and pages viewed. – Response times and load errors. – Visit duration and opportunities viewed. | Partially mandatory | To improve user experience, offer personalised content and opportunities, and improve Platform performance. | Indirectly via cookies and user-behaviour analytics systems. |
We may disclose your personal data to the following parties:
You grant us the right to allow our employees and service providers to handle your data within the required purposes; any other third party's use of your data is governed by its own privacy policy.
| Recipient | Data that may be disclosed | Purpose of disclosure |
|---|---|---|
| Regulatory and supervisory authorities (Ministry of Municipal and Rural Affairs and Housing, Real Estate General Authority) | Name, ID number, subscription information, subscription value. | Regulatory compliance for leasing and real estate activities, and AML/CTF. |
| The real estate registry | Name, ID number, property data, deed information, ownership/in-rem right details. | Registering in-rem rights, partial-ownership contracts and usufruct rights. |
| Ejar and other government platforms | Name, ID number, property data, deed information, ownership/usufruct details. | Documenting lease or usufruct contracts and complying with government requirements. |
| Banks and payment providers | Name, payment data, amount paid, email, mobile number. | Completing payments and transfers, and distributing rental-income returns. |
| Law firms and legal consultants | Name, ID number, contact data, contract information, subscription details. | Legal disputes over real estate transactions, or legal support drafting contracts. |
| Notarisation offices | Name, ID number, deed information, property data, ownership/usufruct contract details. | Documenting partial-ownership or usufruct contracts and proving subscribers' rights. |
| Technical infrastructure and cloud-computing providers | Technical data, account information, browsing data. | Hosting and operating the Platform, technical support and maintenance, secure storage. |
| Real estate valuation firms | Property data, location, area, subscription type. | Professional valuations and fair market value, without disclosing subscribers' personal data. |
| Professional service providers to the Company | Data specific to the service type and related financial transactions. | Financial audit, tax consulting, digital marketing, software development, customer service — limited to what is necessary. |
| Specialised government platforms | Identity-verification data, contract information, related transaction data. | Regulatory and legal compliance and documenting transactions government bodies require. |
| Property owners and end tenants | Name, ID number, property/deed data (for tenants), related contract details. | Executing and managing agreements and securing all parties' rights. |
Under the Personal Data Protection Law, we rely on the following legal bases:
Your data is stored securely at the Company's premises and with an approved cloud provider inside Saudi Arabia, applying up-to-date security and encryption standards. Retention periods by data type:
After the retention period, data is securely deleted so it cannot be recovered; paper records (if any) are destroyed via specialised shredders.
| Personal data type | Retention period |
|---|---|
| Registration and identity data | For the life of the active account + 24 months after closure |
| Payment data | 24 months after the last transaction |
| Subscription and contract data | For the subscription term + 60 months after it ends (for audit and compliance) |
| Financial transaction records | 120 months (per ZATCA requirements) |
| Contact and inquiry data | 12 months from the last contact |
| Browsing and technical data | 6 months |
Under the Personal Data Protection Law, you have the following rights:
The Platform may include links to third-party websites, apps or ads not affiliated with or controlled by us; clicking them may let those parties collect or share your data under their own privacy policies.
This policy does not apply to data submitted to third parties; please review their policies before engaging with them.
Cookies are small text files saved on your device to track and store data about your interactions with the Platform.
We may use cookies and other tracking technologies for marketing, bug-fixing and Platform-development purposes.
You can control cookie settings from your browser or device; declining them may limit access to parts of the Platform.
We may amend this policy from time to time; updates and their date will be published on the Platform along with a notice.
Continued use of the Platform constitutes full acceptance of the latest version of this policy.
You can file a complaint with the Company's Data Protection Officer via:
Need clarification?
Write to our compliance team and we will reply the same business day.
Create your account in minutes and start browsing the available contracts.
