Privacy Policy

The Platform is committed to full compliance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and the regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

• Data Controller: Rekoura Information Technology, Commercial Registration No. 00000, which is the entity responsible for determining the purposes and means of processing personal data on the Platform.

• Types of data: We collect business verification data (such as the commercial registration and tax certificate), data of company representatives (such as name, email address and phone number), transaction and request-for-quotation (RFQ) data, as well as basic technical usage data (such as login records and IP address) for security purposes.
• Purpose of processing: Data is used exclusively to verify the identity of companies, activate accounts, facilitate procurement automation, and improve and protect the Platform’s performance.

The Platform processes personal data on the basis of one or more of the following legal grounds:

• Performance of a contract: Processing the data necessary to create the account and provide the agreed Platform services.
• Legal obligation: Retaining the records and documents required by Saudi laws (such as tax and commercial requirements).
• Legitimate interest: Protecting the Platform against fraud and misuse and improving the quality of services, without prejudice to the rights of data subjects.

In accordance with the Personal Data Protection Law, company representatives and personal data subjects have the following rights:

1. Right to be informed: To know how their data is collected and the legal basis for its processing.
2. Right of access: To request a copy of their personal data held by the Platform, free of charge.
3. Right to rectification: To request the correction, updating or completion of inaccurate data.
4. Right to destruction (erasure): To request the deletion of personal data once the purpose for which it was collected no longer applies, subject to statutory retention periods.
5. Right to withdraw consent: To withdraw consent to processing that is based on consent at any time, without retroactive effect on prior processing.

To exercise any of these rights, please contact us by email at privacy@rekoura.com. Requests will be answered within the applicable statutory period. If dissatisfied with the processing, the data subject may escalate the matter to the competent authority (SDAIA).

• General principle: The Platform retains personal data for as long as the account remains active, and only to the extent necessary to fulfil the purposes of processing.
• After account closure: Personal data is deleted or anonymized within twelve (12) months of the closure of the account, except for data that Saudi laws require to be retained for longer periods (such as financial records and tax invoices, which are retained in accordance with the requirements of the Zakat, Tax and Customs Authority).

• Hosting location: Platform data is hosted with accredited cloud service providers within the Kingdom of Saudi Arabia.
• Transfer outside the Kingdom: No personal data is transferred outside the Kingdom except in accordance with the controls and conditions set out in the Personal Data Protection Law and the data transfer regulations issued by SDAIA, and in a manner that ensures a level of protection no lower than that prescribed by law.

• Cybersecurity: The Platform is committed to encrypting and storing data in accordance with the national cybersecurity standards and to applying access and monitoring controls, and undertakes not to sell or share users’ data with any third party for marketing purposes.
• Data processors: The Platform may engage technical service providers (such as cloud hosting providers) as data processors, under data processing agreements that bind them to the same levels of protection and confidentiality.
• Incident reporting: In the event of a leak or breach affecting personal data, the Platform undertakes to notify the competent authority (SDAIA) within the prescribed statutory periods, and to notify affected data subjects without undue delay where the incident poses serious harm to them.

For any enquiry or complaint relating to privacy and data protection, please contact the Platform’s Data Protection Officer at:

privacy@rekoura.com