Privacy Policy & Data Protection

Legal version v1

1. Introduction and Regulatory Compliance

Entlaqa Sahm is committed to safeguarding the privacy and integrity of business entities and authorized corporate representatives. This policy is governed by the Saudi Personal Data Protection Law (PDPL) promulgated under Royal Decree No. (M/19) and its Implementing Regulations, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).

2. Categories of Data Collected

We collect information necessary to deliver business-to-business (B2B) procurement and wholesale commerce services:

  • Commercial Entity Data: Legal trade name, Commercial Registration (CR) number, VAT number (ZATCA compliance), registered national address, and licensed industry scope.
  • Authorized Representative Data: Full name, national identity/Iqama number, corporate mobile number, corporate email address, and job title.
  • Operational & Transactional Data: Warehouse and delivery location coordinates, order history, official tax invoices, and payment records.
  • Technical Metadata: IP address, device telemetry, authentication audit trails, and security logs.

3. Lawful Basis and Processing Purposes

Your data is processed strictly for legitimate corporate purposes, including:

  • Commercial entity verification and compliance onboarding in accordance with Ministry of Commerce regulations.
  • Procurement order fulfillment and issuance of electronic tax invoices approved by ZATCA.
  • Warehouse logistics, route management, and proof-of-delivery reconciliation.
  • Assessment and administration of approved credit terms and post-dated payment facilities.
  • Fraud prevention, platform integrity, and statutory compliance under applicable Saudi laws.

4. Limited Disclosure and Data Sharing

We do not sell, rent, or lease corporate or personal data. Disclosures are restricted to:

  • Contracted logistics and freight partners solely for order delivery to verified locations.
  • Licensed payment processing gateways regulated by the Saudi Central Bank (SAMA).
  • Judicial and regulatory authorities in compliance with applicable statutory orders.

5. Data Storage and Cyber Security Safeguards

All data is hosted securely in accredited data centers located within the Kingdom of Saudi Arabia, adhering to Essential Cybersecurity Controls (ECC) defined by the National Cybersecurity Authority (NCA). We apply enterprise TLS 1.3 transport encryption and AES-256 rest encryption.

6. Data Subject Rights

Under the Saudi PDPL, verified business representatives retain the right to:

  • Request confirmation of processing and access to held business/personal data.
  • Request rectification or completion of incomplete or inaccurate data.
  • Request data deletion or processing restriction subject to statutory commercial retention obligations.

7. Data Protection Inquiries

For inquiries or to exercise statutory privacy rights, contact our Data Protection Office at: [email protected] or unified hotline: 920033221.