Privacy policy

Bona (بونا) is a private real estate brokerage in Jeddah, Saudi Arabia, operating under REGA FAL licence 1100313556, with its office in Al Rawdah District, Jeddah 23432. For the purposes of the PDPL, Bona is the controller of the personal data described here.

Reach us on WhatsApp at +966 59 329 6933. An email address will be added once our bona.com.sa mailbox is live.

Almost nothing. This site is a set of static pages: no accounts, no server-side forms, no database, no login. Browsing it creates no record of you with Bona.

We set no cookies and run no analytics or advertising tags. Google Analytics 4 and the Meta Pixel are built in but switched off; if we ever enable them, this policy will be updated first and you will be able to decline.

As with any website, the pages are served by a hosting provider (GitHub Pages) and the photographs by a server operated for us and delivered through Cloudflare. They may keep short-lived technical logs (IP address, browser type, page requested) to keep their service secure. We do not receive those logs or use them to identify you.

Every enquiry form on this site composes a message from what you type, then opens WhatsApp on your device. The website itself sends and stores nothing; the message travels from your WhatsApp account to our WhatsApp Business number only when you press send.

WhatsApp is operated by Meta. Once you message us, Meta's WhatsApp Terms of Service and Privacy Policy govern how the conversation is transmitted and stored on their side, including on servers outside Saudi Arabia.

The concierge on this site — the chat panel and the browser voice call with Dana, our AI assistant — runs on Bona's own concierge service. What you write or say, the page you are on and your language are sent to it, and onward to Retell AI, Inc. (United States), which carries out both the voice and the chat processing, and to the large-language-model provider that composes Dana's answers (Anthropic), reached through Retell. Calls may be recorded and transcribed so that we can check the quality of the service.

While you are talking to Dana the conversation is also kept in your own browser, in its session storage, so that it survives moving from page to page. It is held there for at most two hours, it stays on your device, and it is erased when you choose “New conversation” or close the tab.

If you leave a name, a number and what you are looking for, Bona stores that as an enquiry so a principal can follow it up, and handles it exactly like a WhatsApp enquiry — see “The data we hold, and why” below. Dana is not a person, gives no valuation and quotes no price that is not published on this site; a principal is always one WhatsApp message away instead. To have a concierge conversation, a recording, or the enquiry it produced deleted, write to us on WhatsApp at +966 59 329 6933.

When you contact us we keep what you give us: name, phone number, the property or area you are interested in, your budget or requirements if you share them, and the messages exchanged. If we arrange a viewing or act for you in a transaction, we also hold the documents it requires, such as a copy of your national ID or iqama, the title deed and the terms agreed.

We use this data to answer your enquiry; to arrange and record viewings; to represent you as buyer, seller, landlord or tenant; to prepare brokerage and lease agreements; and to meet our obligations as a licensed broker, including REGA record-keeping, Ejar registration of tenancies and anti-money-laundering checks where the law requires them.

We do not sell personal data, we do not build marketing profiles, and we will not add you to any mailing list without asking.

Under the PDPL we rely on: your consent, given when you choose to contact us and withdrawable at any time; the steps you ask us to take before a contract, and the performance of a contract with you; our legal obligations as a REGA-licensed broker; and, for basic non-sensitive contact details only, our legitimate interest in replying to people who write to us, never applied in a way that overrides your rights.

We do not ask for sensitive data (health, religion, biometrics and the like); please do not send it to us.

Enquiries that do not lead to a viewing or a transaction are deleted within 24 months of the last message between us. Records of viewings and of transactions we have brokered are kept for as long as REGA and Saudi commercial and tax rules require, normally ten years from the end of the transaction, then destroyed.

You can ask us to delete your data sooner at any time. We will, unless a law requires us to keep it, in which case we will tell you which law and for how long.

Property owners and developers: only with your consent, and only what is needed to progress a viewing or an offer, such as your name and when you can visit. We never pass your number to an owner or developer without telling you.

Service providers: GitHub (hosting of these pages), our image storage provider (property photographs) and Meta (WhatsApp Business), each processing data only to provide its service to us. We currently use no analytics, advertising or email-marketing provider. When you choose to open a 3D tour, the tour is served by Matterport, Inc. (United States), which then receives your IP address and may set its own cookies; nothing from Matterport loads until you press play. Property photographs are stored on a server operated for us and delivered through Cloudflare, whose network receives your IP address and technical request logs and may set security cookies.

Authorities: REGA, the courts or other Saudi authorities when the law requires it, and only to the extent required.

The /dashboard/ page is an internal working page for Bona staff, not linked from the site and excluded from search engines. Anything entered into it, such as a note about an enquiry, is stored only in the browser of the staff member using it, on their own device. It is not uploaded to any server and is not visible to anyone else.

Some of the providers above store data outside the Kingdom: GitHub hosts these pages in the United States, and Meta stores WhatsApp messages on its own infrastructure abroad. A WhatsApp conversation with us, and the technical logs of your visit, may therefore be processed outside Saudi Arabia. Matterport (3D tours, loaded only on request) is also based in the United States. These pages are hosted by GitHub and delivered through its global content-delivery network, and photographs are delivered through Cloudflare’s global network, so both may process your data on servers outside the Kingdom.

The PDPL permits such transfers where they are necessary to provide a service you have asked for and appropriate safeguards are in place. We keep what leaves the Kingdom to the minimum, keep no client records on those platforms beyond the conversation itself, and keep our own files under our control in Saudi Arabia.

Under the PDPL you have the right to know what personal data we hold about you and how we use it; to receive a copy in a clear, readable form; to have it corrected, completed or updated; to have it deleted or destroyed; and to withdraw any consent you have given, at any time, without affecting what was done before.

To use any of these rights, message us on WhatsApp. We will confirm your identity and respond within 30 days, at no charge.

If you are not satisfied with our answer, you may complain to the competent authority for personal data protection in Saudi Arabia, the Saudi Data & AI Authority (SDAIA), through its published channels.

Our services and this site are intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has sent us personal data, tell us and we will delete it.

Client records are kept on access-controlled devices and accounts used only by Bona principals, with two-step verification on our WhatsApp Business account and our hosting. Property documents are shared only through channels we control, and copies of ID documents are deleted once the transaction they were needed for is complete, unless the law requires us to keep them.

No method of transmission is perfectly secure. If we learn of a breach affecting your data, we will notify you and the competent authority as the PDPL requires.

We will update this page when our practices change, for example if we enable analytics, add an email address or move to bona.com.sa. The date at the top shows the current version; material changes will be flagged here for 30 days.