Privacy Policy for Robot PoC Operations — Khuzam Compound
This Privacy Policy (“Policy”) explains how NAVER Arabia Regional Headquarter (“we”, “us”, “our”, or “the Company”) collects, uses, processes, and protects Personal Data in connection with the temporary Proof of Concept (PoC) operations of our outdoor delivery robot and related activities within the Kingdom of Saudi Arabia.
In this Policy, “you” means the relevant Data Subject (including residents, visitors, and any individuals whose personal data may be temporarily captured or processed during our robot PoC operations). This Policy is intended to inform Data Subjects of their rights and our Personal Data processing practices in accordance with the Saudi Personal Data Protection Law and its Implementing Regulations.
1. Entity Name and Activity
NAVER ARABIA REGIONAL HEADQUARTER conducts a temporary Proof of Concept (PoC) for an autonomous outdoor delivery robot service within a restricted residential community/compound in the Kingdom of Saudi Arabia.
• PoC Period: September 6, 2026 – September 17, 2026
• Operating Hours: 8:00 AM – 11:00 PM
This PoC operation is strictly limited to the designated pathways within the restricted residential community/compound and does not operate on public roads or in open public spaces. In the course of operating these autonomous robots on designated community pathways, the robots utilize onboard cameras and sensors solely for navigation, obstacle detection, safety, and real-time remote monitoring.
Involved Department/Team: RHQ Management
Address: 4F, Spring Towers B, 4124 Prince Muhammed Ibn Salman Ibn Abdulaziz Street, Ar Rabie District, Riyadh
Phone Number: 0118046618
Unified National Number: 7043636567
2. Legal Basis for Collection and Processing of Personal Data
Prioritizing the rights and interests of Data Subjects, we collect and process Personal Data only where a valid legal basis applies under the Saudi Personal Data Protection Law issued pursuant to Royal Decree No. (M/19) dated 09/02/1443H, as amended from time to time (“PDPL”) and its Implementing Regulations.
The applicable legal basis depends on the specific purpose of processing and may include one or more of the following:
Achieving Legitimate Interests: Where collection and processing is necessary to achieve our legitimate interests (such as ensuring safe navigation of robots, preventing safety accidents, protecting physical assets, and preventing unauthorized access), provided that it does not prejudice the rights and interests of the Data Subject, and no Sensitive Data is to be processed.
3. Personal Data to Be Collected, Methods, and Purposes
Your Personal Data shall be processed securely and solely for the purposes that have been notified to you and on the legal basis identified in this Policy. The categories of Personal Data collected, the methods of collection, and the purposes of processing are set out below.
Data Collected via Robot Camera Operations (Visual Data)
During the temporary PoC navigation of our robots within the restricted community, onboard cameras capture real-time surrounding video and images.
Data Captured (Temporary) : Real-time video footage which may temporarily contain identifiable faces of residents/visitors and vehicle license plates.
Collection Method : Automatically captured by the robot’s cameras during autonomous driving and real-time remote control streams.
Processing Purpose :
Autonomous Navigation : To detect obstacles and ensure the safe driving of robots.
Real-time Remote Control : To stream video to local Saudi control operators for safety monitoring and manual intervention when necessary.
Strict Storage and Blurring Policy :
On-Robot Storage : Raw (unblurred) video files are stored locally on the robot's secure, encrypted storage media for a maximum of four (4) hours solely for navigation analysis and automated anonymization (blurring) processing. Raw video is automatically and permanently overwritten/deleted after this period.
Off-Robot Storage : If any video, image, or stream captured by the robot is stored or transmitted to any system, server, database, or space other than the physical robot itself, only the irreversibly blurred (anonymized) video data is stored. Under no circumstances is raw, identifiable video stored in any external system or cloud storage.
Real-time Streaming : Real-time streaming data for remote control is strictly relayed to the remote control PC via a relay server, and no data is stored on the relay server. Furthermore, blurring is applied immediately upon reception by the remote control PC, ensuring that the operator can only view de-identified footage. Throughout the entire process, raw, personally identifiable video information is neither accessed nor stored.
Advance Transparency Notice Regarding Surrounding Environment Filming
To ensure public awareness, the Company implements transparency notice measures before and during robot operations as follows:
On-Site Notice Signs: Informational signs are installed in PoC operation areas (e.g., residential complex entrances, major transit paths, pedestrian walkways) stating the fact of robot operation, filming purposes, items collected, and contact information.
Exterior Robot Identification and QR Code: The exterior of the robot features notices indicating that cameras are in operation, along with a QR code linking directly to this Privacy Policy. This allows pedestrians to immediately recognize the processing of personal data and access the policy on-site.
4. Personal Data Disclosure
We may disclose Personal Data to third parties only where necessary to operate our PoC services, or as permitted or required under applicable laws and regulations. In all cases, only the minimum amount of Personal Data necessary to achieve the relevant purpose is shared.
We do not disclose Personal Data to third parties in the course of conducting our PoC.
5. Transfer and Disclosure of Personal Data Outside the Kingdom
We do not transfer or disclose any Personal Data outside the Kingdom of Saudi Arabia.
All personal data processing activities, including real-time video streaming and local storage, are strictly processed and retained exclusively within the territory of the Kingdom of Saudi Arabia.
Data Shared Internationally (Non-Personal Data): While processed video recordings may be transferred to our development teams in the Republic of Korea for system optimization and algorithm training, only irreversibly blurred and fully anonymized video files (from which no individual faces or license plates can be reconstructed or identified by any means) are exported.
6. Personal Data Storage, Retention Period, and Destruction
Personal Data Storage
Your Personal Data is processed and stored securely. Physical access to robot data and backend storage is strictly restricted. All Personal Data is protected using appropriate technical and organizational security measures, including encryption in transit, access controls limited to authorized personnel, and regular security assessments.
Personal Data Destruction
We will destroy the Personal Data without delay after the purpose is achieved (e.g., PoC termination) or after storing it for the specified retention period.
1) Electronic file format: Permanently deleted so that access to or recovery of the data is not possible by any technical means.
2) Printed and written format: Physically destroyed by shredding or incineration.
7. Personal Data Subjects' Rights
Protecting your privacy is our priority. In accordance with the PDPL and its Implementing Regulations, we inform you of your rights as a Data Subject and how to exercise them.
The Company shall notify the data subject without delay of the action taken or the implementation plan regarding their request within 30 days from the date of receipt, in writing or via email. However, if there are legitimate reasons, such as the complexity of the request or a high volume of simultaneous requests, the response period may be extended by up to an additional 30 days. In such cases, the Company will notify the data subject without delay within the initial 30-day period, specifying the reasons for the extension and the expected completion date.
Right to Be Informed : You have the right to be informed of the legal basis and the purpose for the collection and processing of your Personal Data, the retention period, and the entities to which the Personal Data will be disclosed or transferred.
Right of Access to Your Personal Data : You have the right to request access to your Personal Data and obtain details on how it is processed by contacting us.
Right to Request Provision : You have the right to request your information in a readable and clear format consistent with the records (e.g., as an electronic file).
Right to Request Correction : You have the right to request correction of your Personal Data if it is incorrect, incomplete, or outdated.
Right to Request Destruction : You have the right to request the destruction (erasure) of your Personal Data when it is no longer necessary for the purposes of collection.
Right to file a complaint to the Competent Authority : You have the right to submit any complaint related to the application of the provisions of the Law to the Competent Authority (SDAIA).
Whether Decisions Are Made Solely by Automated Processing (Automated Decision-Making)
Non-Application of Automated Decision-Making: The Company’s autonomous robots and control systems utilize video data solely for the purposes of safe navigation, obstacle avoidance, and emergency monitoring. We do not perform any decisions based solely on automated processing—including profiling—that produce legal effects concerning the data subject or similarly significantly affect them.
Human Intervention (Human-in-the-Loop): In the event of an anomaly during real-time monitoring, local control operators in Saudi Arabia intervene manually to make the final determination and take appropriate action.
8. Complaint or Objection Filing Mechanism
If you have any concerns regarding the protection of your Personal Data, or if you believe we are not complying with the relevant laws, you can file a complaint using the contact details provided in [Section 1. Entity Name and Activity].
If you are not satisfied with how we process your complaint, or if we fail to respond within 30 days, you may file a complaint or request an investigation to the Competent Authority below.
Entity : Saudi Data and Artificial Intelligence Authority (SDAIA), Riyadh, Kingdom of Saudi Arabia
Website URL : sdaia.gov.sa
Complaint Portal : National Data Governance Platform (DGP)
Portal URL : dgp.sdaia.gov.sa
9. Date of Last Update (Update Record)
This Privacy Policy was last revised on September 1, 2026.