What is the Riyadh Timber privacy policy?
The privacy policy governs how we collect and use your personal data when you order from us or visit our site. We comply with the Saudi Personal Data Protection Law (PDPL) issued under Royal Decree M/19 of 2023 and the implementing regulations published by SDAIA.
The policy applies to all digital and paper interactions: the website, quote-request forms, email and WhatsApp correspondence, and documents handed over at our showroom.
We review this policy annually to align with any Saudi regulatory updates; revisions are published on this page with a notice to active customers.
What personal data does Riyadh Timber collect?
We collect five categories of data: identity (name, commercial registration number), contact details (phone, email, WhatsApp), project address and coordinates, encrypted payment data via the gateway, and order history. We do not collect sensitive data such as health records or beliefs.
Payment data is not stored on our servers. It is processed by a Saudi Central Bank (SAMA) licensed gateway compliant with PCI DSS, retaining only the last 4 card digits for verification.
Cookies on the site include essential session cookies and anonymised Google Analytics 4 cookies. Visitors manage consent through the consent banner shown on first visit.
How long is data retained?
Invoice and accounting records are retained for 5 years in line with the Saudi VAT Law and Zakat, Tax and Customs Authority requirements. Marketing contact data is deleted 12 months after the last interaction, and unregistered visitor data after 24 months.
After retention expires, data is permanently deleted from live systems and encrypted backups are archived for an additional 12 months before final destruction.
In case of an active legal dispute, we may retain the relevant data until a final ruling is issued, as permitted by the Saudi Law of Procedure before Sharia Courts.
How do I exercise my rights under PDPL?
PDPL grants you five rights: access your data, correct it, delete it (right to be forgotten), restrict processing, and withdraw consent. Submit requests to [email protected], and we will respond within 30 working days per Article 22 of the law.
- Right of access: request a copy of the personal data we hold within 30 working days at no charge.
- Right of correction: amend any inaccurate data; processed immediately upon supporting documentation (invoice, ID, project contract).
- Right of deletion: delete data not bound by a legal retention obligation; executed within 30 days.
- Right to restrict processing: stop processing your data for marketing while keeping it for accounting only.
- Right to withdraw consent: revoke consent to data processing at any time, without affecting prior lawful processing.
Who do you share my data with?
We share data with only three categories of partners: logistics carriers for delivery, payment gateways licensed by the Saudi Central Bank, and accounting firms for e-invoicing under ZATCA. We do not sell data to any third party for marketing.
All processing partners sign confidentiality and data processing agreements (DPAs) compliant with PDPL, bound to the same protection standards we apply internally.
If data is requested by a competent authority (Ministry of Interior, Public Prosecution, ZATCA) under formal court order, we comply and notify the customer when legally permitted.
How do I contact you for privacy requests or breach reports?
Contact our Data Protection Officer (DPO) at [email protected] with "Privacy Request" in the subject line. For breach reports, we notify SDAIA and affected parties within 72 hours of discovery, per Article 20 of PDPL.
If you are dissatisfied with the handling of your request, you may file a complaint directly with SDAIA through its official portal or by calling 19111.
Postal address for formal privacy correspondence: Riyadh Timber, King Fahd Road, Al Olaya District, Riyadh 12214, Saudi Arabia.
Frequently asked questions about privacy
No. Data is processed and stored in local data centres compliant with PDPL and SAMA requirements. If a global cloud provider is needed, we obtain explicit consent under Article 29 of the law.
Yes, we use essential session cookies and anonymised analytics. The consent banner appears on first visit, and you can manage or revoke consent from your browser settings at any time.
No. Our services target enterprises, contractors, and individuals over 18 years old. We do not knowingly collect children's data; if such data is found, it is deleted immediately.
We respond to privacy requests within a maximum of 30 working days per Article 22 of PDPL. Complex requests may require an additional 30-day extension with prior written notice.
We apply TLS 1.3 in transit, AES-256 at rest, role-based access controls, and an independent annual security review to maintain protection levels aligned with Saudi national cybersecurity standards.
Yes. You can opt out of all marketing communications by clicking "unsubscribe" in any email or by emailing [email protected], without affecting your active commercial transactions.
Need to file a privacy request?
Send your request under the subject "Privacy Request" with your invoice or customer reference. Our Data Protection Officer responds within 10 working days.