1. Data Controller
The data controller responsible for your personal data is:
- Al Amanah International Logistics Company
- Entity type: Limited Liability Company (One person)
- National Number: 7054112292
- Jurisdiction: Kingdom of Saudi Arabia
- Email: info@alamanah-intl.com
For any privacy matter, including data subject requests, you may contact our Data Protection Officer (DPO) at the email above.
2. Scope
This policy applies to personal data of website visitors, prospective and existing clients, consignees, drivers, suppliers, and any individual whose personal data we process in connection with our logistics, freight, warehousing, and transportation services.
3. Categories of Personal Data We Collect
- Identification data: full name, national ID / Iqama number (where required for KYC or regulatory reasons), passport number.
- Contact data: phone number, email address, postal address, company name, job title.
- Service data: shipment details, pickup/delivery address, consignee information, cargo description, and delivery records.
- Financial data: billing address, VAT number, IBAN/payment details (for invoicing).
- Technical data: IP address, device type, browser type, operating system, referring URLs, pages visited, date/time of access.
- Communications data: records of calls, emails, WhatsApp, and support tickets.
- Location data: vehicle and route data collected for dispatch, driver safety, and operational purposes (applicable to our drivers and fleet operations).
We do not knowingly collect sensitive personal data (as defined under the PDPL) unless strictly necessary and with your explicit consent or another lawful basis permitted by law.
4. Legal Basis for Processing
Under Article 5 of the PDPL, we process personal data only where one or more of the following legal bases apply:
- Consent — where you have given us your explicit consent (e.g., marketing communications, non-essential cookies).
- Contractual necessity — to perform a logistics contract with you or take steps at your request prior to entering a contract.
- Legal obligation — to comply with Saudi laws and regulations (customs, tax, Zakat, anti-money-laundering, road-transport regulations).
- Legitimate interests — to secure our systems, prevent fraud, and improve our services, where not overridden by your rights.
- Vital interests — where processing is necessary to protect life or health in an emergency.
5. Purposes of Processing
- Providing quotations, booking shipments, and fulfilling logistics services.
- Communicating with you about orders, deliveries, and support.
- Issuing invoices and managing payments.
- Complying with tax, Zakat, and road-transport regulatory obligations in the Kingdom of Saudi Arabia.
- Operating our fleet, routing, and dispatch systems.
- Improving our website, services, and customer experience.
- Marketing — with your prior consent, which you can withdraw at any time.
7. Cross-Border Data Transfers
Although our transportation services operate only inside the Kingdom of Saudi Arabia, some of the IT, cloud-hosting, analytics, and communications providers we rely on are located abroad. In those cases we may transfer personal data outside the Kingdom. Such transfers are made only in compliance with Article 29 of the PDPL and its Implementing Regulations, which include one or more of the following safeguards:
- Transfer to a country providing an adequate level of data protection as determined by SDAIA.
- Binding contractual clauses or standard contractual clauses approved by SDAIA.
- Your explicit consent after being informed of the risks.
- Necessity for the performance of a contract to which you are a party.
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, or reporting requirements. Typical retention periods:
- Customer & shipment records: 10 years (tax/commercial code requirement).
- Marketing consents: until withdrawn by you.
- Website analytics (aggregated): up to 26 months.
- CCTV / GPS telematics: up to 90 days unless required for an incident.
9. Your Rights as a Data Subject
Under the PDPL, you have the following rights, which you may exercise free of charge:
- Right to be informed about how your data is processed.
- Right of access to your personal data.
- Right to request correction of inaccurate or incomplete data.
- Right to request destruction of your data when it is no longer needed or when you withdraw consent (subject to legal retention requirements).
- Right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
- Right to object to processing based on legitimate interests or for direct marketing.
- Right to data portability, where technically feasible.
To exercise any of these rights, email info@alamanah-intl.com. We will respond within 30 days in accordance with the PDPL. You also have the right to lodge a complaint with SDAIA at sdaia.gov.sa.
10. Data Security
We implement appropriate organisational and technical measures aligned with the PDPL and SDAIA’s Data Management and Personal Data Protection Standards, including access control, encryption in transit (TLS), logical segregation, periodic backups, staff training, and incident response procedures. In the event of a personal data breach likely to cause serious harm, we will notify SDAIA and affected individuals without undue delay, as required by law.
11. Children
Our services are directed to businesses. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this Policy
We may update this policy from time to time. The “Last updated” date at the top indicates when it was last revised. Material changes will be communicated through the website or by email where appropriate.
14. Contact Us
For any questions regarding this Privacy Policy or our processing of your personal data, please contact our Data Protection Officer:
- Email: info@alamanah-intl.com
- Subject line: “PDPL Data Subject Request”