1. Data controller
MySupplier Trading Co. (LLC), King Fahd Road, Al Olaya District, Riyadh 12211, Saudi Arabia, is the controller of personal data processed on MySupplier. Contact our data protection officer at privacy@mysupplier.sa.
2. What we collect
- Account data: name, work email, phone number, role, preferred language, password (stored hashed).
- Company data: company name, CR number, VAT number, city, contact details, verification status.
- Transaction data: RFQs, bids, orders, delivery addresses, invoices and payment status. Card numbers are processed by our payment provider and are never stored on our systems.
- Technical data: IP address, device and browser information, pages visited and error logs, used to keep the service secure and reliable.
- Communications: support requests, notifications you receive and push-notification tokens for devices you register.
3. Why we process it
- To operate the marketplace: matching RFQs with suppliers, processing orders and issuing ZATCA-compliant tax invoices (performance of a contract).
- To verify suppliers’ CR and VAT registration and prevent fraud (legitimate interest and legal obligation).
- To send transactional notifications about bids, orders and payments by email, push or in-app (performance of a contract). Marketing messages are sent only with your consent and can be stopped at any time.
- To meet accounting, tax and anti-fraud obligations under Saudi law (legal obligation). Invoices are retained for the statutory period.
4. Who sees your data
Buyers see the company profile of suppliers who bid; suppliers see the RFQ and delivery details of buyers who publish them. We share data with processors who help us run the service — cloud hosting, email and push-notification delivery, and our payment service provider — under contracts that restrict their use of the data. We do not sell personal data.
Where data is processed outside the Kingdom we apply the safeguards required by the PDPL and its implementing regulations.
5. Cookies and local storage
We use strictly necessary browser storage for your session token, language preference and shopping cart. We do not use advertising cookies. Optional analytics run only after you accept the consent banner; you can change your choice by clearing site data in your browser.
6. Retention
Account data is kept while your account is active and for 12 months after closure. Orders, invoices and payment records are retained for the period required by ZATCA and the Saudi Commercial Law (currently 10 years). Logs are retained for up to 12 months.
7. Your rights
Under the PDPL you may request access to, correction of, or deletion of your personal data, object to certain processing, and withdraw consent. You can edit your profile and delete your account from the Account page; other requests can be sent to privacy@mysupplier.sa. We respond within 30 days. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).
8. Security
Data is encrypted in transit (TLS) and at rest, access is role-based and logged, passwords are hashed, and card payments are handled by a PCI-DSS Level 1 provider. No system is perfectly secure; please use a strong, unique password.
9. Changes
We will notify you of material changes by email or in-app before they take effect. Continued use after the effective date means you accept the updated policy.