Issued by Al-Markaba Al-Idafiya Company Limited ("Spare"), effective from the date of its publication on the Platform.

Preamble Al-Markaba Al-Idafiya Company Limited ("Spare") — hereinafter the "Company" or the "Platform" — is committed to protecting the privacy of the users of its Platform, each of whom is referred to as the "User" or the "Data Subject". This Policy has been prepared in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended by Royal Decree No. (M/148) dated 5/9/1444H (the "Law"), its Implementing Regulations and any amendments thereto, and the related laws in force in the Kingdom of Saudi Arabia; the terms and definitions set out in the Law apply to this Policy. This Policy explains how the Users' personal data is collected, the purposes of its processing, their rights in respect of it, and related provisions. This Policy forms an integral part of the Spare Platform Use Agreement, and the User acknowledges its acceptance upon registering on the Platform.

Clause One: Scope of Application of the Policy 1. This Policy applies to all personal data the Company collects and processes concerning: (a) Clients registered on the Platform, whether individuals or commercial establishments. (b) Visitors to the Platform who do not register. (c) Representatives of clients that are legal persons. (d) Any other user who interacts with the Platform in any manner. 2. This Policy does not apply to: (a) Data collected from the user by third parties outside the Platform. (b) External websites or applications linked from the Platform.

Clause Two: Data the Company Collects The Company collects the following data about the user, in all its types and categories: 1. Basic identity data: full name, national ID number for citizens, Iqama number for residents, commercial registration for establishments, passport number where required, sex, date of birth, nationality, marital status, and a copy of the identity document and supporting documents. 2. Contact data: mobile number, email, national address, home address, work address, and any other means of communication. 3. Vehicle data: vehicle type, model, year of manufacture, plate number, vehicle identification number (VIN), odometer reading, vehicle registration (Istimara) date, its registered owner, its photographs, and any technical data relating to it. 4. Usage and activity data on the Platform: service request history, correspondence and chats, uploaded photographs, reviews and ratings, notifications exchanged, registration date, date of last login, the pages visited by the User, and the time spent on each. 5. Financial data: payment method details (the last four digits of the credit card or its equivalent), the history of financial transactions, invoices, and tax records. 6. Geolocation data: the vehicle's location when inspection or transport is requested, and the user's location where permitted through its device settings. 7. Device and connection data: device type, operating system, browser type, internet protocol (IP) address, device identifier, language settings, the network used, and usage logs. 8. Cookies and similar technologies: the Company uses these technologies to facilitate the user experience and analyse the User's behaviour on the Platform; the User may disable them through its browser settings, noting that this may affect certain features of the Platform. 9. Any other data: the Company collects any additional data it considers necessary to provide the service, to protect its interest or to comply with the laws, and notifies the User of this when requesting it.

Clause Three: Sources of Data Collection The Company obtains data from the following sources: 1. Directly from the user: upon registration, completing forms, submitting requests, corresponding, or uploading documents and photographs. 2. From its interaction with the Platform: through automatic activity logs, cookies and device data. 3. From external parties: such as maintenance centers, transport companies, payment providers, identity issuers and governmental verification systems. 4. From publicly available sources: such as public commercial registers, official announcements or public social media, in respect of legal persons.

Clause Four: Purposes of Collecting and Processing the Data The Company processes the user's data for the following purposes: 1. Providing the Platform's services, performing service requests, and completing maintenance, repair and inspection operations. 2. Verifying the user's identity and eligibility to register. 3. Communicating with the user regarding its requests and account through electronic channels. 4. Processing payments and issuing statutory tax invoices. 5. Engaging centers, approved technicians, assessors and transporters, and referring the necessary data to them. 6. Handling complaints, objections and observations. 7. Developing the Platform and its services, and carrying out statistical analyses and market research. 8. Personalizing the user experience and displaying content and advertisements suited to it. 9. Sending operational notifications, and marketing notifications after the User's prior consent to them, with the User's right to stop them at any time. 10. Protecting against fraud and misuse and securing the Platform. 11. Complying with statutory obligations and responding to the requests of competent official authorities. 12. Protecting the Company's rights in existing or potential disputes and defending its interests. 13. Retaining records evidencing performance of the service and averting any subsequent claims.

Clause Five: Legal Basis for Processing The Company relies, in its processing of personal data, on one of the following bases, in accordance with the Personal Data Protection Law: 1. The user's express consent to the processing, given by electronic click on the Platform. 2. The necessity of the processing to perform the user's contract with the Company, or to take steps prior to contracting at its request. 3. The necessity of the processing to achieve the Company's legitimate interest, provided the user's rights are not prejudiced. 4. The necessity of the processing to perform a statutory obligation on the Company. 5. The necessity of the processing to protect life or health or to prevent serious harm.

Clause Six: Sharing Data with Third Parties The Company shares the user's data with the following parties, to the extent necessary to achieve the stated purposes: 1. Approved maintenance centers: the data necessary to perform the service is shared with them, such as the vehicle data and the collection location, while the user's identity is withheld to the extent possible. 2. Transport companies: the data necessary to transport the vehicle is shared with them, such as the collection and delivery locations and contact details. 3. Payment providers and banks: the data necessary to process payments is shared with them, in accordance with their security requirements. 4. Cloud and technology service providers: such as storage and hosting servers and communication and analytics systems, under agreements ensuring the confidentiality of the data. 5. Marketing partners: after anonymizing the user's identity — unless it expressly permits otherwise — for the purpose of displaying suitable advertisements. 6. Governmental and judicial authorities: where required by the laws or requested by order of a competent authority, or to protect the Company in an existing or potential dispute. 7. Subsidiaries or affiliates: to the extent necessary to fulfil the stated purposes. 8. A potential acquirer: in the event of any merger, acquisition or sale of the Company's assets, the data is transferred to the acquiring entity with the same protection obligations. 9. Aggregated statistical data: to research or analytical entities, after aggregation and anonymization such that individuals cannot be identified. 10. Approved technicians and approved assessors: the data necessary to perform mobile maintenance or technical assessment is shared with them, such as the vehicle data, the User's location and, where needed, contact details.

Clause Seven: Storage and Security of Data 1. Personal data is stored on secure servers, as required by the Personal Data Protection Law and its Implementing Regulations, which may be inside the Kingdom of Saudi Arabia or on external servers, depending on the technical infrastructure adopted by the Company at each stage. 2. Where data is stored or transferred outside the Kingdom, the Company complies with the statutory requirements in that regard, including obtaining the necessary approvals and ensuring an adequate level of protection. 3. The Company takes the technical and organizational measures necessary to protect the data from loss, leakage or unlawful access, commensurate with the nature of the data and the level of risk. 4. The Company does not give an absolute guarantee against breaches, as no information system is entirely immune, and it undertakes to notify the User and the competent authorities upon becoming aware of any leakage affecting the User's data, as required by the Law.

Clause Eight: Data Retention Period 1. General rule: the Company retains the User's data for the period necessary to achieve the purpose of its processing, or for the period required by the laws, throughout the period in which the User maintains an active account on the Platform and after its closure to the extent necessary, subject to the retention exceptions set out in this Clause. 2. The user's right to request deletion: the user may at any time request the Company to delete its personal data, through its account settings on the Platform or by a written request to the Company. 3. Exceptions to deletion: the Company retains — even after receipt of a deletion request — everything that preserves its rights among data and records, including: (a) Records of requests, technical quotations, invoices and financial transactions. (b) Correspondence, chats, calls and notifications exchanged between the user and the Company. (c) Receipt and delivery records, service performance logs, assessors' technical reports and field inspection reports. (d) Photographs of the vehicle before, during and after maintenance, transport photographs upon collection and delivery, and photographs of the replaced parts. (e) Photographs of the vehicle registration and its official documents, and copies of the identity and documents provided by the user. (f) Records of the electronic approvals and acknowledgments issued by the user. (g) Any data the laws require to be retained, foremost the commercial and tax records for the period prescribed by law. (h) Any data necessary to establish the Company's right or to defend against any existing or potential claim or action. 4. Continued retention after a deletion request: the Company continues to retain the data set out in paragraph (3) for the period required by the laws, or until the expiry of the period within which any action or claim relating to it may be heard or until such action or claim is decided, and it is not obliged to delete it before then merely upon the User's request. 5. Notifying the user: upon receiving a deletion request, the Company notifies the user of the data that will be deleted and of the data it will retain, together with the reason for retention.

Clause Nine: The User's Rights in Its Data The Personal Data Protection Law guarantees the user — as the data subject — the following rights, with which the Company complies as prescribed by law: 1. Right to be informed: to know the legal basis and purpose of collecting and processing its personal data, the retention period, and the parties with whom it is shared. 2. Right of access to the data: to view its personal data held by the Company and to obtain a copy of it as guaranteed by law. 3. Right to request correction: to correct any personal data that is inaccurate, incomplete or out of date. 4. Right to request deletion: to delete its data, subject to the exceptions set out in Clause Eight. 5. Right to withdraw consent: to withdraw its consent to the processing of its data at any time, noting that withdrawal of consent may require closure of its account, as processing is necessary to provide the service. 6. Right to complain: to complain to the Saudi Data and Artificial Intelligence Authority if it considers that the processing of its data breaches the law. 7. Mechanism for exercising the rights: the User may exercise its rights through its account settings on the Platform, or by sending a written request to the Company through the contact channels set out in Clause Thirteen, and the Company undertakes to respond to the request within the period prescribed by the Law.

Clause Ten: Sensitive Data and Minors 1. The Company does not collect sensitive data about the user — such as health, racial or religious data — except where the nature of the service requires it and with the user's express consent. 2. The Company does not intentionally collect personal data about minors without the guardian's consent, and where it becomes aware that data in its possession belongs to a minor without such consent, it deletes it immediately. 3. For legal persons, the data of their representatives is collected in their functional capacity, and the provisions of this Policy apply to them.

Clause Eleven: Cookies and Similar Technologies 1. The Company uses cookies and similar technologies (web beacons, pixel tags) to improve the user experience, identify the login session, analyse usage behaviour and display suitable content. 2. Types of files used: (a) Essential files necessary to operate the Platform (which cannot be disabled). (b) Performance and analytics files to measure and improve use of the Platform. (c) Functional files to remember the user's preferences. (d) Marketing files to display suitable promotional content (which may be disabled). 3. The user may manage these files through its browser settings, noting that disabling some of them may affect the operation of the Platform.

Clause Twelve: Amendment of the Privacy Policy 1. The Company has the right to amend this Policy at any time to keep pace with regulatory or operational developments, or to enhance the protection of users' data. 2. The Company notifies the user of any amendment via the Platform, email or mobile. 3. The amendment shall not be effective against the User until the User has been notified and its express consent obtained through the Platform, particularly where the amendment materially expands the scope of data collection or processing. 4. If the user rejects the amendment, it has the option to close its account without any further obligations.

Clause Thirteen: Contact and Enquiries For any enquiry, request or complaint relating to this Policy or to the processing of personal data, the Company — or the officer responsible for personal data protection — may be contacted through the contact channels available on the Platform.

Clause Fourteen: Governing Language This Policy has been drawn up in Arabic and English; the official language is Arabic, and the Arabic text shall prevail in the event of any discrepancy between the two texts. This Policy was published and takes effect from 24/6/2026G. The Company may update it from time to time as needed, and publishes any amendment to it on the Platform including the date of the update; the User should check for updates from time to time.