Privacy Policy

Ghwaish Commerce is a digital B2B procurement platform operated in the Kingdom of Saudi Arabia (the "Operator", "we", "us", or "our"). The Operator acts as the controller for personal data processed through the Platform for the purposes described in this Policy, unless a specific feature states otherwise. You can reach us about this Policy or your personal data at privacy@ghwaishco.com.

This Policy is issued in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (the "PDPL") and its Implementing Regulations, and describes what we collect, why, where it is processed, how long it is kept, and the rights you have.

Company and business data: company name, commercial registration details you or your administrator provide, company type (buyer, supplier, or both), city, website, and procurement profile information such as typical volumes and categories of interest.

Account and identity data: full name, email address, phone number, job title, department, and password (stored as a salted hash, never in plain text); invitation records for users invited by an existing company administrator.

Procurement data: RFQs you create or receive, items, quantities, specifications, delivery terms and locations, submitted quotations and pricing, comparisons, approval records, awards, and purchase orders.

Communications and notification data: in-platform notifications and their delivery/read status, and transactional emails sent to you about your account or procurement activity.

Uploaded documents: attachments you add to an RFQ, quote, or purchase order (for example specification sheets, certificates, or pricing sheets), stored in our file storage together with a record of who uploaded them and when.

Audit and security logs: records of security-relevant account and procurement actions (sign-in, RFQ/quote/purchase-order changes, approval decisions), each with an actor reference, outcome, IP address, browser information, and timestamp, kept for accountability and investigation.

Enquiry data: if you submit a request through our public enquiry form, the contact and business details you enter there.

Session, device, and cookie data — see the cookies section below.

AI and voice data, only where you use an optional AI-assisted feature — see the Decision Intelligence and optional Tala sections below.

We do not collect sensitive personal data as defined in the PDPL (such as health, biometric, genetic, credit, or religious data), and we ask you not to include it in any content you upload.

Most of this information comes directly from you or from your company’s administrator when they register your company, invite you, or use the Platform. Some information — RFQ/quote history, audit records, notification delivery status, decision and savings records — is generated automatically by the Platform as a record of what happened. Where an optional AI-assisted feature analyzes information you provide (for example a document you upload), the output it produces is also stored as part of your account’s or company’s records.

Company name, company type, a working email address, and a password are required to create an account; without them the account cannot be created. Fields such as phone number, job title, department, website, and procurement-preference details are optional and only requested to improve how the Platform works for you — declining to provide them may limit certain features but will not prevent basic use of the Platform.

We process personal data to: operate the procurement workflow (create and manage RFQs, invite suppliers, submit and compare quotes, record decisions, issue purchase orders); create, secure, and authenticate accounts; review and approve companies and users before activation; send account, RFQ, quote, and notification communications; maintain audit, security, and support records; provide optional AI-assisted and voice features you choose to use; and meet legal, regulatory, or law-enforcement obligations.

Depending on the activity, the legal basis is one or more of: performance of an agreement to which you or your company is a party; a legitimate interest of the Operator or another user that does not unduly prejudice your rights (for example fraud detection and network and information security, which the PDPL Implementing Regulations expressly recognize); your consent, where consent is the applicable basis (for example an optional AI or voice feature you actively choose to use); or a legal obligation. Where consent is the basis, you may withdraw it at any time as described in the rights section below, without affecting processing already carried out based on that consent.

We do not use advertising or analytics cookies and do not run third-party trackers on the Platform. Two mechanisms keep you signed in and remember your language: a strictly necessary, first-party cookie that stores your selected interface language (English/Arabic) for one year, and a session token stored in your browser’s local storage (not a cookie) that keeps you signed in; the token is never shared with a third-party site. Because neither mechanism is used for advertising, analytics, or cross-site tracking, no cookie-consent banner is presented. Standard web-server and security logs (IP address, browser/device information, request timestamps) are recorded for security and troubleshooting.

The Decision view shown to buyers ("Decision Intelligence") is produced by deterministic, rule-based logic applied to the RFQ and quote data already in your account — it does not use a machine-learning or generative-AI model, and no external AI provider sees this data. It restates facts already in your records (such as price, delivery, validity, and history with your company) and applies a fixed, published set of rules to suggest a quote; it does not decide, and the final award, rejection, or purchase decision remains entirely yours.

Separately, we may offer optional AI-assisted features (an in-app or voice assistant, referred to as "Tala") that can help track buying needs, review supplier offers, or analyze a document you share with it. When you actively use such a feature, the text you type, the documents you share with it, and the responses it generates are processed by that feature — which may call a third-party AI model, see the data-sharing section below — and stored as part of your account’s records. These features are assistive only: they can be wrong, incomplete, or based on outdated information, and any resulting business or procurement decision remains your responsibility. Availability of these features varies by account.

Where an optional voice or telephony feature is enabled for your account, a call you place or receive through it may be transcribed to text, and the resulting transcript, call metadata (for example duration, direction, and status), and any recording made for quality or dispute-resolution purposes may be processed by our telephony and speech-processing providers (see the data-sharing section below) and stored as part of your account’s records. You will be informed when a call involves this feature, and, where legally required, a call will be recorded only with the consent applicable under the circumstances. This feature is optional and is not required to use the core RFQ, quote, or purchase-order workflow.

Where Ghwaish NOW is enabled for your account, it tracks which suppliers have reported that a catalog item is currently available, using records already in the Platform (catalog items, companies) plus outreach records: an availability request you raise, records of contacting a supplier about it, and the supplier’s response (including price, quantity, and the freshness of that information). Contact and response records are kept as part of the Platform’s operational and audit trail; the resulting availability information carries a freshness state and is not a continuously live feed.

Information is visible according to your company’s role and account permissions: buyers and suppliers do not see each other’s internal notes, decision reasoning, or documented savings, and a supplier sees only quotes and purchase orders it submitted or was sent. Authorized Operator personnel may access account and procurement data to operate, support, secure, and review the Platform, including during company and user onboarding review.

We use service providers (processors) to run the Platform, currently: Amazon Web Services (AWS) for application hosting, database, caching, application logs, and encrypted file storage, and for transactional email delivery via Amazon Simple Email Service (SES). Where you use an optional AI-assisted or voice feature (see above), the relevant AI, speech-to-text/text-to-speech, or telephony provider processes only the data needed to deliver that specific feature, and is identified to you when the feature is enabled for your account. We do not sell your or your company’s personal data, and we do not use it for third-party advertising. We may disclose personal data where required by law, a court or regulatory order, or to investigate a security incident or a violation of our terms.

Our infrastructure — database, file storage, backups, cache, application logs, and transactional email service — is hosted by Amazon Web Services in the AWS Europe (Frankfurt, Germany) region, under a contract with Amazon Web Services EMEA SARL (Luxembourg), which acts as our processor. As a result, personal data is regularly transferred outside Saudi Arabia and stored there on a continuous basis. The purpose of this transfer is to perform our agreement with you and your company and to carry out the central operational processing needed to run the Platform (PDPL Article 29(1)(c); Regulation on Personal Data Transfer Outside the Kingdom, Article 2), and it is limited to the data described in this Policy.

AWS processes this data as our processor under the AWS Data Processing Addendum, which binds it to act only on our documented instructions, keep the data confidential, maintain the security measures it describes, publish and give advance notice of its sub-processors, and notify us of security incidents without undue delay; AWS also commits not to move data out of the region we selected except as needed to provide the service or where required by law. AWS’s parent company is established in the United States, and AWS may be legally required to disclose data to a governmental body; its terms commit it to first redirect such a request to us and to notify us where legally permitted.

This transfer is subject to the requirements of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom issued by the Saudi Data & AI Authority (SDAIA). We keep our hosting location and transfer safeguards under review against those requirements and will update this Policy if they change. Where an optional AI or voice feature is enabled, the AI, speech, or telephony provider it uses may also process data outside the Kingdom; each such provider is identified to you when the feature is enabled for your account.

We keep personal data for as long as your account is active and for as long as needed to maintain accurate procurement, audit, security, and decision records. RFQs, quotes, approvals, awards, and purchase orders are business records kept with their actor references even after the individuals involved change roles or leave a company, because they document a transaction the parties relied on. Data may also be kept as needed to handle a dispute or to meet a legal, regulatory, or tax obligation.

Specific periods that apply today: database backup copies are retained for up to fourteen (14) days; superseded versions of uploaded files are retained for up to ninety (90) days after being replaced; one-time verification codes expire within minutes; and application log records are retained for a fixed operational period and then deleted. Where data is no longer needed for any of the purposes above, it is deleted or its identifying details are removed.

You can request an export of the personal data your account directly holds — your profile details, your company’s summary information, your notifications, your own audit trail, and the RFQs and quotes you personally created or submitted — through the account data-export feature in the Platform (rate-limited, and capped per data category so the export completes reliably). The export reflects what is tied to your own account; it does not include another user’s or company’s internal records.

You can close your own account from the Platform, confirmed with your password and an explicit confirmation step. Closing your account deactivates it, signs it out of every active session, and minimizes the direct personal identifiers on your user record — your name is replaced with a generic label, your email is replaced with a non-reachable placeholder, and your phone number and job title are cleared. It does not delete the underlying procurement and audit records that reference your (now-minimized) account, for the reasons described in the retention section above. If you are the last active administrator of your company’s account, you will need to assign another administrator, or request closure of the company account, before your own account can be closed.

We apply access controls (role-based permissions, tenant-scoped data access, one-time invitation links), encryption in transit, encryption at rest for stored data and files, rate-limiting and lockouts on authentication, and a restrictive browser security policy (Content-Security-Policy and related headers) to reduce the risk of common web attacks. Uploaded files are checked against an allowed file-type list and their actual file signature — not just the extension you gave them — and a size limit before being stored, and are served back only to authorized, tenant-scoped requests. No online system can guarantee absolute security, and we do not claim one.

Subject to the exceptions the PDPL allows (including the retention needs described above), you have the right to: be informed about how your personal data is processed; access it; request a copy of it; request correction or completion of inaccurate or incomplete data; request its deletion or destruction; withdraw your consent where consent is the basis for processing, without affecting what was already done based on that consent; and lodge a complaint. Some requests may be limited where the data forms part of a procurement, audit, security, or legal record that must be retained, as explained above.

Contact us at privacy@ghwaishco.com with your company name, your account email, and the nature of your request. We may verify your identity and your authorization to act for your company before responding. We will act on a valid request within 30 days of receiving it, as the PDPL Implementing Regulations require; if a request needs unusual effort or you have made several requests, we may extend this once by up to 30 further days and will tell you in advance, with the reason. Exercising these rights is free of charge unless the law provides otherwise.

You may raise a privacy question or complaint through the contact above. If you believe your rights under the PDPL have not been respected and the matter has not been resolved through that contact, or you have not received a response within the period above, you may lodge a complaint with the Saudi Data & AI Authority (SDAIA), Riyadh, Kingdom of Saudi Arabia — the regulatory authority responsible for the PDPL — through its official channels, including the National Data Governance Platform (dgp.sdaia.gov.sa).

Ghwaish Commerce is a business-to-business platform intended for use by adults acting on behalf of a registered company; it is not directed to, and should not be used by, individuals under the age of majority under applicable Saudi law. We do not knowingly collect personal data from minors.

We may update this Policy as the Platform, its features, and its service providers evolve. Material changes will be published with a new version number and effective date, and, where a change significantly affects how your data is used, we will take reasonable steps to bring it to your attention.

Version history: 2026-09 (this version, effective 2026-09-20); 2026-07-10 (initial version).