Last Updated: 20 October 2026
1. Who We Are and What This Policy Covers
The Arab Investment & Trade Credit Guarantee Corporation ("Dhaman", "we", "us") is a multilateral Arab organization headquartered in the State of Kuwait (P.O. Box 23568, Safat 13096), with a regional office in Riyadh, Saudi Arabia (P.O. Box 25166, Riyadh 11466).
This Privacy Policy explains how we handle personal data and information across our digital platforms. It consolidates information practices for:
- The Dhaman Website: Public visitors, newsletter subscribers, job applicants, event registrants, and members of the Dhaman RiskWatch portal using www.dhaman.org.
- The Dhaman Employee E-Services Application: Authorized organization employees accessing internal electronic services via the mobile/web application ("Dhaman Application").
Scope Exclusions
- This policy does not cover personal data processed under an insurance contract, policy, or reinsurance agreement. Such processing is governed by the terms of the relevant agreement and Dhaman's internal data protection policy.
- This policy applies only to the English-language disclosures; authorized internal employees may find dual-language administration mappings within organizational intranet resources.
2. Platform Access & User Categories
Web Users (Public & Portals)
The public website is intended for businesses and professionals. It is not designed to knowingly collect data from individuals under 18 years of age.
Application Users (Authorized Personnel Only)
The Dhaman Application is strictly designed for authorized organization employees and is not intended for use by children. Access requires valid, organization-approved employee access credentials. Employees are responsible for:
- Keeping login credentials confidential and avoiding unauthorized sharing.
- Using the application solely for authorized institutional purposes.
- Reporting any suspected unauthorized access or security incidents immediately through approved institutional support channels.
3. Information We Process and Collect
We process information given directly by users, data provided by an employee's managing organization, and limited technical data transmitted automatically by web browsers or devices. Please do not send sensitive personal data (such as health data or religious beliefs) unless explicitly required. If you share personal data about another individual, ensure you are legally entitled to do so.
A. Information Provided Directly or Maintained via Registration
| Platform Component / Context | Information Processed / Collected | Data Source |
|---|---|---|
| Newsletter Subscription | Email address. (Note: Sign-up IP addresses are recorded to mitigate automated abuse and are deleted after 2 days). | Provided by you |
| Careers & Job Applications | First and last name, email, mobile number, country code, targeted position, referral source, CV, cover letter, and any embedded details. | Provided by you |
| Event & Seminar Registration | First and last name, email, mobile number, country code, company name, and job title. | Provided by you |
| Direct Institutional Email | Name, contact details, message body, and attached media. | Provided by you |
| Insurance & Broker Forms | Names, job titles, institutional contact details of representatives, applicant company identity, and transaction data (via downloaded and returned PDFs). | Provided by you or your employer organization |
| Dhaman RiskWatch Portal | Profile name, account email, hashed password strings, valid sign-in dates, and failure log IP addresses. | Created by Dhaman/organization; updated by you at sign-in |
| Employee E-Services (App) | Employee Credentials: Employee name, unique employee ID, system username, and credentials necessary for identity authentication/authorization. | Synchronized from organization credentials or input by employee |
| Employee E-Services (App) | Service Request Details: Specific information entered into electronic service requests, transactional profiles, and application forms. | Submitted by the employee |
| Employee E-Services (App) | Uploaded Files: Digital documents and attachment files selected and explicitly transmitted as evidence for institutional services. | Uploaded by the employee |
B. Automatically Collected Technical Data
- General Website Visits: Server logs automatically record your IP address, browser vendor, device type, visited pages, date/time timestamps, referring landing page, and search text queries entered into the website search tool. This is powered by system architecture, cookies, and analytics tracking tags.
- Dhaman Application Infrastructure: The App processes necessary technical diagnostics, application telemetry, operation strings, and infrastructure logs required for application up-time, system security, and runtime troubleshooting.
- Notification Telemetry: If push notifications are actively enabled on the Dhaman Application, the platform registers device tokens and localized push-notification string targets required to deliver timely transactional alerts.
4. How and Why We Use Information
We process personal data and operational information only for legitimate business purposes aligned with the context in which it was collected. We do not sell personal information.
| Purpose / Operational Context | Specific Data Utilized | Lawful Basis / Core Objective |
|---|---|---|
| Newsletter & Publications Delivery | Subscriber email address | Freely given consent (withdrawable at any time) |
| Job Application Assessment | Career forms, CV data, and cover letters | Pre-contractual steps taken at the candidate's explicit request |
| Inquiry Resolution | Sender contact details and message history | Legitimate interest in responding to incoming queries |
| Event Planning & Management | Registration form inputs | Fulfillment of your registration request |
| Insurance & Brokerage Compliance | Application forms and company representative records | Contract execution steps; compliance with our Establishing Convention and internal compliance rules |
| RiskWatch Portal Administration | Member credentials and account security history | Execution of the organization’s corporate membership agreement |
| App Security & User Access Control | Employee profile elements, security usernames, and system credentials | Authentication of authorized employee identity and control of system access |
| E-Service Transaction Management | Employee transactional inputs and submitted files | Processing, tracking, and completing internal employee service requests |
| App Alerts & Push Communication | Push tokens and device registry identifiers | Dissemination of system-critical and transactional service notifications |
| Web & App Operations Optimization | Technical metadata, platform server logs, and diagnostic files | Legitimate institutional interest in maintaining platform availability, fixing bugs, and ensuring security |
| Marketing Optimization & Web Metrics | Google Analytics cookies, LinkedIn Insight tags, and X conversion pixels | User consent provided via our website cookie choice banner |
Note: Automated decision-making processes that produce legal or similarly significant effects are not utilized on this website.
5. Specific Rules for Document Uploads (App)
Employees utilizing the Dhaman Application must upload only documents strictly required for the relevant electronic service and ensure they possess authorization to submit them.
- Uploaded files may contain personal or confidential information.
- Access to these documents is restricted to authorized personnel responsible for processing the specific service request.
6. Cookies and Analytics (Website)
The public website uses a limited number of cookies to manage core operations and analyze performance. You can modify your choices at any time via the Cookie Settings link located at the bottom of our web pages.
| Cookie Classification / Identifier | Operational Purpose | Can You Refuse It? |
|---|---|---|
| Essential Cookies (e.g., PHPSESSID, dh_consent, RiskWatch login tokens) | Maintains core website functionality, remembers language preferences (English/Arabic), safeguards web forms from malicious submission, and keeps RiskWatch portal members securely authenticated. | No. The site cannot function properly without these essential tokens. |
| Performance Analytics (e.g., Google Analytics 4: _ga variants) | Tracks aggregate, non-identifying visitor counts and maps out page navigation trends. | Yes. You can opt out via the cookie banner or your browser's security settings. |
| LinkedIn Insight Tag (e.g., li_sugr, bcookie, lidc) | Measures the effectiveness of LinkedIn professional content and allows targeted informational visibility for relevant professionals. | Yes. You can opt out via the cookie banner or your browser's security settings. |
| X (Twitter) Conversion Pixel (e.g., _twpid, _twsid) | Compiles mathematical conversion trends regarding informational campaigns running on the X platform. | Yes. You can opt out via the cookie banner or your browser's security settings. |
| Social Platform Hyperlinks (e.g., YouTube, Facebook, Threads, TikTok) | These icons are implemented as plain outbound links. The respective networks place tracking cookies only if you click to visit their external platform. | Yes. Simply refrain from clicking the external outbound links. |
7. Storage, Hosting, and Data Sharing
Data Hosting Ecosystem
- Public Website Infrastructure: The public-facing website architecture is hosted via Amazon Web Services (AWS) using data centers based in India. Third-party tracking providers like Google, LinkedIn, or X may process analytical telemetry within the United States or other global data centers.
- Employee E-Services (App) Infrastructure: The backend software infrastructure, databases, and application data supporting the internal employee portal are securely hosted on Oracle Cloud Infrastructure (OCI).
International Transfers & Confidentiality
Where data is transferred across borders, we use contracts and security measures designed to protect it to the standards described in this policy. Data access within OCI is strictly limited to authorized personnel based on explicit job responsibilities.
Permitted Information Sharing Categories
We disclose information to external and internal parties only when necessary, restricted to the following entities:
1. Authorized Personnel: Dhaman staff members managing requests within respective departments across our offices in Kuwait and Riyadh.
2. Contracted Service Providers: Enterprise vendors managing website hosting, system infrastructure, email distribution systems, newsletter tools, or application development. These vendors operate under strict agreements that limit data use to their specific function.
3. Core Code Libraries & Font Providers: The website dynamically loads specialized assets from public distribution networks (Google Fonts, jsDelivr, unpkg). These public endpoints receive your device IP address when your browser requests the fonts or scripts.
4. Institutional Insurance Partners: External reinsurers, co-insurers, export credit agencies, and brokers, when required to assess or place an insurance application you submit.
5. Professional Advisers: External auditors and legal counsel operating under strict professional duties of confidentiality.
6. Regulatory Authorities: Relevant legal authorities where disclosure is required, without waiving any privileges or immunities held by Dhaman.
8. Data Security
We implement appropriate technical and organizational safeguards designed to protect personal information against unauthorized access, loss, alteration, or disclosure. These measures include:
- Encrypted connections via HTTPS across our web domains.
- Restricting data access to staff members with a clear business need.
- Enforcing security controls on internal servers that store CVs and application files.
- Storing passwords for the RiskWatch portal and employee platforms in hashed form only.
- Storing CVs and cover letters in separate folders that cannot be accessed directly from the public web.
- Protecting submission forms against automated abuse.
Reminder: No electronic storage method or transmission over the internet is completely secure. Please avoid sending highly sensitive information by unencrypted email. If a data breach occurs that puts your rights at high risk, we will notify you without undue delay.
9. Data Retention and Deletion Schedules
Information is retained only as long as necessary to provide the requested services, meet legitimate business requirements, maintain corporate records, and comply with legal or regulatory obligations.
Website Data Retention Model
- Newsletter Database: Maintained continuously until a user submits an unsubscription request.
- Anti-Abuse Log IP Addresses: Automatically deleted after 2 days.
- Unsuccessful Job Applications: Retained temporarily for active recruitment purposes and deleted sooner upon explicit candidate request.
- Successful Job Applications: Permanently transferred into the official employee file managed under internal HR policies.
- General Email Inquiries: Retained while the matter is active, and deleted sooner upon request.
- Event Registrations: Deleted 12 months after the event concludes, unless you consent to receive future event updates.
- RiskWatch Member Accounts: Maintained throughout the duration of active corporate membership, and deleted 12 months after membership termination.
- Insurance & Brokerage Application Files: Retained according to statutory record-keeping and compliance frameworks.
- Standard Infrastructure Server Logs: Maintained for 90 days, unless required to support an active security investigation.
- Google Analytics Data: Retained for 14 months in accordance with analytics platform retention rules.
- Cookie Preference Storage (dh_consent): Retained for 12 months, after which the consent banner will reappear.
Application Data Retention & Account Deletion
Employees who need to request the deletion of an application account or its associated personal information must contact the organization's authorized administrator or privacy team.
- Requests will be evaluated and handled in accordance with institutional data retention policies and applicable regulatory obligations.
- Information that must be retained by law or organizational rules will not be deleted until the retention period expires.
- Important: Deleting or disabling an employee account does not automatically delete related transaction histories, official service records, or documents previously uploaded to support active workflows.
10. Your Rights & Requests
You have the right to request the following actions regarding your personal data:
- Access and Copying: Request access to the personal data we hold about you and receive a copy.
- Correction: Request updates or corrections to inaccurate or incomplete data.
- Deletion: Request the removal of your data when it is no longer needed or when you withdraw your consent.
- Restriction and Objection: Object to or restrict our use of your data, including opting out of newsletters or marketing communication.
- Consent Withdrawal: Withdraw your consent at any time (e.g., by clicking the unsubscribe link in a newsletter or emailing our privacy team).
Request Submission
Please send your data requests to privacy@dhaman.org. To safeguard your privacy, we may ask you to confirm your identity before processing the request. We aim to respond to all valid requests within 30 days. Note that certain rights may be limited where we are required to maintain records to meet our compliance or legal obligations.
11. Institutional Status, Privileges, and Immunities
Dhaman is an international organization established by Arab states under its founding Establishing Convention.
- Nothing contained in or relating to this Privacy Policy shall be deemed a waiver, express or implied, of any privilege, immunity, or exemption enjoyed by Dhaman under its Establishing Convention or under international law.
- Dhaman follows this policy voluntarily as a matter of good administrative practice and in alignment with recognized international data protection standards.
- This policy does not constitute a submission to the jurisdiction of any national data protection law, regulatory authority, or national court system.
12. Policy Updates and Contact Information
Policy Changes
We may update this Privacy Policy from time to time to reflect modifications to our website, updates to the Dhaman Application, or changes in our data handling practices. The revision date at the top indicates the most recent update. Material changes will be highlighted on our public website or communicated directly within the application infrastructure.
Contact Points
For questions about this policy, or to submit a privacy request, please contact us through the appropriate channels:
Corporate & Website Privacy Inquiries:
- Email: privacy@dhaman.org
- Postal Address: Legal Affairs & Compliance, The Arab Investment & Trade Credit Guarantee Corporation, P.O. Box 23568, Safat 13096, State of Kuwait
- Phone: +965 24959555
Employee E-Services Application Support:
- Support Email: itapps@dhaman.org
- Website Portal: https://www.dhaman.org/