1. Identity of the Data Controller
Procurement Network Trad Company (شركة شبكة المشتريات التجارية) (“ProcureNet”, “we”, “us” or “our”) is the data controller for your personal data collected via this website.
2. Definitions
For the purposes of this Privacy Policy:
- Personal Data: Any information relating to an identified or identifiable individual, including name, email address, phone number, identification number, IP address, or device information.
- Processing: Any operation on personal data, whether automated or manual, including collection, storage, use, disclosure, transfer, or destruction.
- Data Subject: The individual to whom the personal data relates.
- Cookies: Small text files stored on your device to improve website functionality and user experience.
- Minor: Any individual under the age of 18 years.
- Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
3. Data Protection Principles
We adhere to the following PDPL principles:
- Lawfulness and Fairness: All processing is conducted lawfully and fairly
- Data Minimization: We collect only personal data that is necessary for the specified purposes
- Purpose Limitation: Data is processed only for the purposes for which it was collected
- Accuracy: We maintain accurate and up-to-date personal data
- Storage Limitation: Data is retained only as long as necessary
- Security: Appropriate security measures protect personal data
- Accountability: We demonstrate compliance with PDPL requirements
4. Purposes of Data Collection and Processing
We process personal data for the following purposes:
- To provide, manage, and improve our website services
- To respond to inquiries, support requests, or applications submitted through the website
- To send newsletters or promotional communications (with your explicit consent)
- To ensure website security and prevent fraud or unauthorized access
- To comply with legal obligations under Saudi law
- To conduct analytics and improve user experience
- To provide customer support and technical assistance
- To process transactions and manage business relationships
5. Legal Basis for Processing
We process personal data under PDPL using one or more of the following lawful bases. You may withdraw consent at any time for processing activities based solely on your consent by contacting us using the details provided in Section 20.
- Consent: Where you have explicitly agreed to the processing (e.g., subscribing to newsletters, marketing communications)
- Contractual Necessity: Processing necessary to provide requested services or fulfill contractual obligations
- Legal Obligation: Processing required to comply with applicable laws and regulations
- Legitimate Interest: Processing to protect website security, improve services, or manage internal business operations, provided it does not override your fundamental rights and freedoms
6. What Personal Data Do We Collect?
We may collect various categories of personal data to provide and improve our services:
- Identification Information: Your full name, job title, company name, and when legally required, government identification numbers.
- Contact Information: Email addresses, phone numbers, mailing addresses, and your preferred communication methods.
- Technical Information: IP addresses, browser types and versions, operating systems, device identifiers, and general geographic location data.
- Website Interaction Data: Information gathered through cookies and analytics tools, including pages visited, time spent on our platforms, search queries, user preferences, and download or upload activities.
- Business Information: Your industry sector, specific business requirements, procurement preferences, and transaction history to better serve your professional needs.
7. Methods of Collection
We collect personal data through various methods depending on how you interact with our services:
- Direct Collection: Information collected directly from you through website forms and applications, email communications, phone conversations, in-person meetings, and account registration processes.
- Automated Collection: Data gathered indirectly through cookies and analytics tools that track website behavior, as well as through social media interactions when you engage with our platforms.
- Third-Party Sources: Information obtained from service providers acting on our behalf, publicly available sources, and business partners, but only where we have an appropriate legal basis and the necessary permissions to do so.
8. Data Sharing and Transfers
We do not sell, trade, or rent your personal data to third parties. Personal data may be shared only in the following circumstances:
- Service Providers: With trusted third-party service providers who perform functions on our behalf under strict confidentiality and data processing agreements, including:
- IT service providers and hosting companies
- Analytics and marketing service providers
- Payment processors
- Customer support platforms
- Legal Requirements: With government authorities, courts, or law enforcement when required by applicable law or legal process
- Corporate Affiliates: With affiliates or subsidiaries of ProcureNet for legitimate business purposes under the same data protection standards
- Business Transfers: In connection with any merger, acquisition, or sale of business assets, subject to equivalent data protection commitments
- Cross-Border Transfers: Any international transfers of personal data will only occur:
- To countries with adequate data protection levels as determined by SDAIA
- With appropriate safeguards such as Standard Contractual Clauses
- With your explicit consent for the specific transfer
- When necessary for contract performance or legal compliance
9. Data Retention and Deletion
We retain personal data only as long as necessary for the purposes described above or to comply with legal obligations:
- General Website Data: 2 years from last website activity
- Customer Account Data: 7 years from account closure or last transaction Marketing
- Communications: Until consent is withdrawn or 3 years of inactivity
- Legal Compliance Data: As required by applicable Saudi laws (typically 5-10 years)
- Security Logs: 1 year from creation
- Children’s Data: Deleted immediately upon discovery unless parental consent is obtained
After retention periods expire, personal data is securely destroyed or anonymized using industry-standard methods. You may request earlier deletion subject to legal and contractual obligations.
10. Security Measures
We implement comprehensive safeguards to protect your personal data through multiple layers of security controls:
- Technical Safeguards: Encryption of data both in transit and at rest using industry-standard protocols, secure transmission protocols such as HTTPS/TLS, regular security assessments and vulnerability testing, robust access controls and authentication systems, and continuous network security monitoring with intrusion detection capabilities.
- Administrative Safeguards: Regular staff training on data protection and privacy, systematic privacy impact assessments, thorough vendor due diligence and contract management, established incident response procedures, and privacy-by-design implementation across all our systems.
- Physical Safeguards: Secure data centers with restricted access controls, appropriate environmental monitoring, and secure equipment disposal procedures.
- Regulatory Compliance: All security practices comply with standards established by the National Cybersecurity Authority (NCA) and National Data Management Office (NDMO) of Saudi Arabia.
11. Data Subject Rights
Under PDPL, you have the following rights regarding your personal data:
- Right of Access: Request access to personal data we hold about you and information about how it is processed
- Right of Rectification: Request correction or updating of inaccurate or incomplete data
- Right of Erasure: Request deletion of personal data that is no longer required or unlawfully processed
- Right to Restrict Processing: Request limitation of processing in certain circumstances
- Right to Withdraw Consent: Withdraw consent for processing where consent is the legal basis
- Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
- Right to Data Portability: Receive your personal data in a structured, commonly used format
- Right to Lodge a Complaint: File a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA)
To exercise any of these rights, contact us using the details in Section 1. We will respond within 30 days as required by PDPL, or inform you if an extension is necessary.
12. Automated Decision-Making and Profiling
We may use automated processing and profiling for:
- Website personalization and content recommendations
- Fraud detection and security monitoring
- Marketing campaign optimization
- Service improvement analytics
You have the right to:
- Be informed about automated decision-making
- Request human intervention in automated decisions
- Express your point of view regarding automated decisions
- Contest automated decisions that significantly affect you
13. Children’s Data Protection
Our services are intended for business use by adults aged 18 and over. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected personal data from a minor, we will promptly delete such information. Parents or guardians who believe their child’s information has been collected may contact us for immediate removal.
14. Data Breach Notification
In the event of a personal data breach, we will:
Notification to SDAIA:
- Report the breach to SDAIA within 72 hours of becoming aware of the breach
- Provide details of the nature, scope, and impact of the breach
- Describe measures taken to address the breach
Notification to Data Subjects:
- Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
- Provide clear information about the nature of the breach and recommended protective measures
- Offer assistance and support as appropriate
Internal Procedures:
- Immediate containment and assessment of the breach
- Investigation of the cause and scope
- Implementation of corrective measures
- Documentation of the incident and response
15. Cookies and Tracking Technologies
We use only necessary cookies to operate this platform and its related services, to ensure easy access and a better browsing experience.
- Essential Cookies: Necessary for website functionality and cannot be disabled
- Functional Cookies: Enhance website performance and user experience
- Analytics Cookies: Help us understand website usage and improve services
You can manage cookie preferences through your browser settings. Please note disabling certain cookies may affect website functionality.
16. Third-Party Links and Services
Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We recommend reviewing their privacy policies before providing personal information.
17. Updates to this Policy
We may update this Privacy Policy periodically to reflect:
- Changes in our data processing practices
- Legal or regulatory requirements
- Technological developments
- Business operations changes
Notification of Changes:
- Material changes will be prominently announced on our website
- We will email registered users about significant changes
- The updated policy will include a new “Last Updated” date
- Previous versions will be archived and available upon request
18. International Users
While our primary operations are in Saudi Arabia, users from other countries should be aware:
- This policy is governed by Saudi Arabian law and PDPL
- Data processing occurs primarily within Saudi Arabia
- International transfers follow PDPL requirements
- Users in other jurisdictions may have additional rights under local laws
19. Relevant legislation
The relevant policies and regulations referred to in this policy can be accessed via the following links:
Personal data protection system
Policies issued by the National Data Management Office
Controls issued by the Cybersecurity Authority
20. Contact Information
For questions about this Privacy Policy, please contact:
ProcureNet
PO Box 31775
Al-Khobar 31952, KSA
Email: info@procurenet.co
To file a complaint with authorities, please contact:
Saudi Data & Artificial Intelligence Authority (SDAIA)
Website: www.sdaia.gov.sa
Email: info@sdaia.gov.sa
Response Times:
General inquiries: 5 business days
Data subject rights requests: 30 days
Complaints: 10 business days
Urgent security matters: 24 hours
Last Updated: 20 June 2025
Version: 1.0
