Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect only the data necessary to respond to your inquiries and fulfil supply orders. This includes:

We do not collect sensitive personal data (PDPL Article 23 categories) such as health information, biometric data, or religious beliefs.

3. How We Use Your Data

We process your personal data for the following purposes, each supported by a lawful basis under PDPL Article 14:

• →Responding to RFQs and enquiries — to prepare quotations and supply proposals in response to your request (contractual necessity).
• →Order processing and fulfilment — to execute purchase orders, issue ZATCA-compliant e-invoices, coordinate logistics, and deliver goods (contractual necessity).
• →Financial and tax compliance — to comply with ZATCA VAT regulations, GAZT requirements, and Saudi accounting law obligations (legal obligation).
• →Supplier and customer verification — to verify business credentials including CR, VAT numbers, and authorized signatories for B2B compliance (legitimate interest).
• →After-sales support — to handle warranty claims, material test certificate requests, and post-delivery queries (contractual necessity / legitimate interest).
• →Website analytics — to understand how visitors use the site and improve our content and user experience (legitimate interest). Analytics data is aggregated and not used to identify individuals.

4. Data Sharing

We do not sell, rent, or trade your personal data. We share data only where necessary:

• Logistics and freight partners — delivery address and contact details shared with carriers to complete your delivery.
• ZATCA / GAZT — e-invoice and VAT data submitted as required by Saudi tax law.
• Banks and payment processors — payment reference and invoice data for financial settlements.
• IT and cloud service providers — data may be processed by our hosting and ERP providers (StartPOS) under data processing agreements that require equivalent protection standards.
• Regulatory authorities — when required by Saudi law or an official government request.

All third parties are required to maintain confidentiality and to process data only for the purpose for which it was shared.

5. Cross-Border Data Transfers

Where data is transferred outside Saudi Arabia (for example, to cloud infrastructure providers), we ensure that the transfer meets the conditions of PDPL Article 29: either the destination country provides an adequate level of protection, or appropriate contractual safeguards are in place. No personal data is transferred internationally without a lawful basis.

6. Data Retention

After the applicable retention period, data is securely deleted or anonymised.

7. Your Rights Under PDPL

Under Saudi Arabia's Personal Data Protection Law (Royal Decree No. M/19, 9/2/1443H), you have the following rights:

To exercise any of these rights, email us at info@gulfunionozone.com with the subject line "PDPL Data Request". We will respond within 30 days. Identity verification may be required before we can action your request. Some rights may be limited where we have a legal obligation to retain data (e.g., ZATCA requirements).

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include encrypted communications (HTTPS/TLS), access controls, and regular security reviews. In the event of a personal data breach that risks harm to data subjects, we will notify the Saudi Data & AI Authority (SDAIA) and affected individuals in accordance with PDPL Article 20 within the required timeframe.

9. Cookies and Analytics

Our website uses cookies and similar technologies to ensure basic site functionality and to understand how visitors engage with our content. We use:

• Essential cookies — required for the website to function (language preference, navigation). No consent needed.
• Analytics cookies — aggregated, anonymised usage data to improve site performance. These do not identify you personally.

We do not use advertising or third-party tracking cookies. You can disable cookies in your browser settings; this may affect some site features.

10. Minors

Our website and services are directed at business professionals and are not intended for use by minors under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically. Material changes will be communicated via the website.

12. Contact & Complaints

For any questions about this policy or your personal data, contact us at:

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA) at sdaia.gov.sa or the National Data Management Office (NDMO).