Privacy Statement

First Issued: 11 December 2023
Last Updated: Not Applicable

National Bank of Kuwait-KSA (hereafter referred to as "we" or "our" or "us" or "NBK-KSA") respects your right to privacy. In this Notice, "You" refers to data subject (customers, employees, website visitors or contingent workers) whose personal data is processed by NBK-KSA.

This Privacy Notice explains who we are, how we collect, share and use personal data about you, and how you can exercise your privacy rights. This Privacy Notice only applies to personal information that we collect through nbk.com/ksa ("Website"), or through our Branches.

If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided under the "How to contact us" heading below.

We recommend that you read this Privacy Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section.

NBK-KSA is a bank which services its own clients in Saudi Arabia and services clients of its Kuwaiti parent company when those clients want banking services in Saudi Arabia.

NBK-KSA is headquartered in Jeddah, but its parent, National Bank of Kuwait S.A.K.P., has branches, subsidiaries and representative offices in a number of countries, including most of the Gulf Cooperation Council (GCC) countries, UK and France. 

The personal information that we may collect about you broadly falls into the following categories:

Generally, our Website is not designed to collect information from visitors, however when we ask you for personal information online, it will only be in response to you applying for or using one of our online products or services. Alternatively, we will collect such information when you visit our branches.

The types of information we ask you to provide, and the reasons why we ask you to provide it, include:

If we ask you to provide any other personal information not described above, we will explicitly explain the reason for requesting this information.

From time to time, we may receive personal information about you from third party sources (including credit reference agencies, World Checking services, other banks who provide references on you), but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

The types of information we collect from third parties includes:

​From time to time, and after obtaining your consent, we may share your personal information with third party sources for many purposes including: marketing, advertising, surveying, collecting and telephone or electronic communications, in addition to other service providers contracted by NBK-KSA.

When you visit our Website, we may collect certain information automatically from your device. In some countries, this information may be considered personal information under applicable data protection laws.

Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

Some of this information may be collected using cookies and similar tracking technology, as explained further in our Cookies Notice.

We allow access to your personal data only to third party service provider who require such access to perform specific services who have a legitimate purpose for accessing it. We implement appropriate measures to ensure the data is used in a manner consistent with this Privacy Notice and ensure that the confidentiality, availability and integrity of the data is maintained.

We may also disclose your personal data, where we have your consent to do so, to contingent workers on other lawful grounds, including:

• Background checking or other screening providers (with your consent) and relevant local criminal records checking agencies
• Data storage, shared services platform providers, IT developers and support providers
• Where we have requested your consent to process your personal data, you have the right to withdraw your consent
• To comply with legal obligations, including where necessary to abide by applicable laws, regulations or contractual obligations, or to respond to a court order, administrative or judiciary processes, including, but not limited to, a subpoena, government audit or search warrant
• In response to lawful requests by public authorities or government agencies (including for tax, immigration, health and safety, national security or law enforcement purposes)
• As necessary to establish, exercise or defend against potential, threatened or actual legal claims or litigations
• Where necessary to protect your vital interests or of another data subject
• In connection with the sale, assignment or other transfer of all or part of our business

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you or from third parties (such as to comply with anti-money laundering or immigration laws and fraud prevention) or may otherwise need the personal information to protect your vital interests or those of another person.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the "How to contact us" heading below.

Your personal information may be transferred to and processed outside KSA. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective). NBK-KSA will only disclose your personal information to Group companies and third parties that have agreed in writing to provide privacy protection in line with this privacy notice.

We may need to transfer this data outside KSA for providing uninterrupted services to you (e.g., core banking through our group companies and affiliates overseas). We minimize the personal information that is transferred outside KSA.

We use appropriate technical and organizational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include, however not limited to:

• physical access control systems
• a physical security presence
• logical access controls (such as passwords)
• perimeter security systems (such as firewalls)
• Information Classification and Handling Measures

Additionally, Data is shared within NBK-KSA (including employees, contractors, agents, etc.) on a need-to-know basis and under strict confidentiality arrangements.

We have put in place procedures to deal with any suspected personal data breach. In the event that we are required by law to inform you of any unauthorized access to your personal data we may notify you electronically, in writing, or by telephone. We will also notify any applicable regulator of a data breach where we are legally required to do so.

We retain personal information we collect from you as long as necessary for the purpose for which it is collected and to meet legal, regulatory and operational requirements (for example, to provide you with a service you have requested or to comply with applicable regulatory, legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Automated decisions are decisions concerning you which are made automatically on the basis of a computer determination (using software algorithms), without human review. We do not use automated decision-making.

You have the following data protection rights:
If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the "How to contact us" heading below. 

We are required by law to confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights) prior to processing any requests from you, to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

It is important that the Personal Data we hold about you is accurate and up to date. It is your obligation to keep us informed if your Personal Data changes during your relationship with us.

We may update this Privacy Notice from time to time in response to changing regulatory, legal, technical or business developments. You can see when this Privacy Notice was last updated by checking the date displayed at the top of this Privacy Notice.

If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer using the following details: DataPrivacyOffice@nbk.com.sa

First Issued: 11 December 2023
Last Updated: Not Applicable

This Notice explains how National Bank of Kuwait-KSA (hereafter referred to as "we" or "our" or "us" or "NBK-KSA") uses cookies in the web pages of our website at nbk.com/ksa ("Website"). It explains what these cookies are and why we use them.

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used to do different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving your browsing experience. Some cookies are deleted when you close down your browser. These are known as session cookies. Others remain on your device until they expire or you delete them from your cache. These are known as persistent cookies and enable us to remember things about you as a returning visitor. This website uses both session and persistent cookies.

If you visit our website, we collect information about your use of this site, information about the device or browser you use to access etc.

As well as the cookies we use on our website, we use cookies and similar technologies in emails. These help us to understand whether you have opened an email and how you have interacted with it. Cookies may also be set if you click on a link within the email.

We use a limited number of cookies for several reasons. One is to provide an online service more suited to the device you connect from, as well as to enhance your online experience by keeping track of your behavior within the site and to make sure you do not see the same special offers repeatedly. Some cookies are required for technical reasons in order for our Websites to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track the use of our Website. This is described in more detail in the table below.

Our Website contains links to other websites. If you access those other websites they may use cookies. Please read any cookie privacy notices on those websites if you wish to know what cookies are being used.

You can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our website though your access to some functionality and areas of our website may be restricted. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information.

New regulations may change the way in which the use of cookies is governed in the future. We may update this Cookie Notice from time to time in order to reflect these changes. 

Please therefore re-visit this Cookie Notice regularly to stay informed about our use of cookies and related technologies.

The date at the top of this Cookie Notice indicates when it was last updated.

If you have any questions about our use of cookies or other technologies, please contact our Data Protection Officer using the following details: DataPrivacyOffice@nbk.com.sa

First Issued: 11 December 2023
Last Updated: Not Applicable

This Notice explains how National Bank of Kuwait (hereafter referred to as "we" or "our" or "us" or "NBK-KSA") uses cookies in the web pages of our website at nbk.com/ksa ("Website"). It explains what these cookies are and why we use them.

We respect the data privacy rights of individuals and are committed to handling personal data appropriately and in accordance with applicable laws. It is important that you read this Recruitment Notice along with the Privacy Notice and Cookie Notice carefully as it sets out how we handle your personal data when you apply for a job or other role with us and the rights you have in connection with that data collected. The term "applicants" is used in this Recruitment Notice to refer to anyone who applies for a job role, or who otherwise seeks to work with or for us (whether on a permanent or temporary basis). 

The types of personal data we collect and process when you apply for a role with NBK-KSA includes (but is not limited to):

• Identification data and contact details - including your name, address, email address, phone number and other contact information, gender, date of birth, nationality/ies, national identifiers (such as national ID / passport, Civil ID etc.).
• Employment history - such as previous employers and job titles / positions.
• Background information - such as academic / professional qualifications, job qualifications, education, details included in your CV / resume (which might include details of any memberships or interests constituting "Sensitive Personal Information (SPI)", a term which we define below), transcripts and employment references.
• Details of your nominated references (including their name, contact details, employer and job role).
• Details of your immigration / visa status.
• Previous applications / roles such as data relating to previous applications you have made to us. This could include data on any previous employment history with us or NBK Group.
• Other data you voluntarily provide throughout the process, including through assessment centers / exercises and interviews. 

Generally, during the recruitment process, we do not ask for or process any "Sensitive Personal Information (SPI)": data that reveals your racial or ethnic origin, religious, political or philosophical beliefs or trade union membership; genetic data; biometric data for the purposes of unique identification; or data concerning your health / personal life unless required by applicable laws or where necessary to comply with applicable laws. 

However, in certain circumstances, you may provide, on a voluntary basis, "Sensitive Personal Information (SPI)" during the recruitment process, for example your CV may state that your interests include activities involving a particular religious group or a group which espouses particular political of philosophical views.

• References provided by references
• Other background data provided or confirmed by academic institutions and training or certification providers
• Criminal records data obtained through criminal records checks. (We will not carry out such checks without your explicit consent unless required for any legitimate purpose or lawful processing)
• Data provided by recruitment or executive search agencies

Our legal basis for processing your personal data as part of the recruitment process is: 

• our legitimate interests (which are not overridden by your data protection interests or fundamental rights and freedoms, particularly taking into consideration the safeguards that we put in place);
• to comply with applicable immigration and / or employment laws and regulations and legal obligations; 
• to take steps prior to entering into an employment contract with you, where you are considered for employment;
• where processing is required for your vital interest of another data subject;
• in circumstances where you have made the data public or tasks carried out in public interest;
• where we have your consent to do so. Where we have requested your consent to process your personal data, you have the right to withdraw your consent.

If we request you to provide personal data to comply with any legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not (as well as of the possible consequences if you do not provide your personal data). 

We allow access to your personal data only to those who require such access to perform their tasks and duties, and to contingent workers who have a legitimate purpose for accessing it. Whenever we allow a contingent worker to access personal data, we will implement appropriate measures to ensure the data is used in a manner consistent with this Privacy and Recruitment Notice and ensure that the confidentiality, availability and integrity of the data is maintained.

We may share your personal data with other Group companies as part of our recruitment processes. Where we do share personal data with other Group companies, this will include sending your personal data outside KSA.

We may make certain personal data available to contingent workers who provide services relating to the recruitment process to us:

• recruitment or executive search agencies involved in your recruitment
• background checking or other screening providers (with your consent) and relevant local criminal records checking agencies
• data storage, shared services and recruitment platform providers, IT developers and support providers
• contingent workers who provide support and advice including in relation to legal, insurance, health and safety, security and intel and whistleblowing / reporting issues

We may also disclose your personal data to contingent workers on other lawful grounds, including:

• where we have your consent to do so. Where we have requested your consent to process your personal data, you have the right to withdraw your consent
• To comply with legal obligations, including where necessary to abide by applicable laws, regulations or contractual obligations, or to respond to a court order, administrative or judiciary processes, including, but not limited to, a subpoena, government audit or search warrant
• In response to lawful requests by public authorities or government agencies (including for tax, immigration, health and safety, national security or law enforcement purposes)
• As necessary to establish, exercise or defend against potential, threatened or actual legal claims or litigations
• Where necessary to protect your vital interests or of another data subject
• In connection with the sale, assignment or other transfer of all or part of our business

We use appropriate technical and organizational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include, however not limited to:

• physical access control systems
• a physical security presence
• logical access controls (such as passwords)
• perimeter security systems (such as firewalls)
• Information Classification and Handling Measures

We have put in place procedures to deal with any suspected personal data breach. In the event that we are required by law to inform you of any unauthorized access to your personal data we may notify you electronically, in writing, or by telephone. We will also notify any applicable regulator of a data breach where we are legally required to do so.

We collect and process the personal data for recruitment purposes, in particular, to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications and background for a particular role, verifying your data, carrying our reference checks or background checks (where required) and generally to manage the hiring process and communicate with you about it.

If you are accepted for a role at NBK-KSA, the data collected and processed during the recruitment process will form part of your ongoing staff member record and will be processed in accordance with our Privacy and Recruitment Notice. 

If you are not successful, we may still keep your personal data to allow us to consider you for other suitable openings within NBK-KSA in the future unless you request that we delete your personal data. We will hold onto such data until we destroy it is securely accordance with our data retention practice.

When we have no ongoing legitimate need to retain or process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Automated decisions are decisions concerning you which are made automatically on the basis of a computer determination (using software algorithms), without human review. We do not use automated decision-making.

You have the following data protection rights:
If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the "How to contact us" heading below.

We may update this Recruitment Notice from time to time in response to changing regulatory, legal, technical or business developments. The date at the top of this Recruitment Notice indicates when it was last updated.

If you have any questions or concerns about our use of your personal information, please contact our Data Protection Officer using the following details: DataPrivacyOffice@nbk.com.sa