1. Introduction & Legal Basis

Marsa ("we," "our," or "us") is committed to protecting your personal data in accordance with the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 dated 9/2/1443H (September 16, 2021) and its Executive Regulations in the Kingdom of Saudi Arabia.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our B2B marketplace platform (marsatijarah.com). By using our platform, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal data is:

Entity: Marsa (Marsatijarah)
Address: King Fahd Road, Riyadh, Kingdom of Saudi Arabia
Email: info@marsatijarah.com
Data Protection Contact: privacy@marsatijarah.com

3. Personal Data We Collect

In accordance with Article 6 of the PDPL, we collect only the minimum personal data necessary for the stated purposes:

Data you provide directly:

Account information (full name, email address, phone number)
Business details (company name, Commercial Registration number, address)
Product listings and catalog information
Messages and communications on the platform
RFQ (Request for Quotation) submissions and transaction history
Identity verification documents (for sellers, as required by Saudi law)

Data collected automatically:

Device and browser information
IP address and approximate geolocation
Usage patterns, preferences, and interaction data
Cookies and similar tracking technologies (subject to your consent)

4. Legal Basis for Processing

Under the PDPL, we process your personal data based on the following legal grounds:

Consent (Article 6): You have given explicit consent during registration for the processing of your personal data.
Contractual necessity: Processing is necessary to fulfill our contractual obligations to provide marketplace services.
Legal obligation: Processing is required to comply with Saudi Arabian laws, including commercial registration verification and tax obligations.
Legitimate interest: Processing for platform security, fraud prevention, and service improvement, provided it does not override your rights.

5. Purposes of Processing

We use your personal data for the following specific purposes:

Provide and maintain our B2B marketplace services
Process transactions and RFQ requests
Verify seller identities and business credentials (CR verification)
Send account notifications and transaction updates
Improve platform functionality and user experience
Prevent fraud and ensure platform security
Comply with legal and regulatory obligations in KSA
Send marketing communications (only with your separate consent)

6. Data Sharing & Disclosure

In accordance with Articles 23–25 of the PDPL, we may share your personal data only in the following circumstances:

With other users as necessary for transactions (e.g., buyer-seller communications)
With authorized service providers who assist our operations under data processing agreements
With government authorities when required by Saudi law or court order
With business partners only with your explicit prior consent

We do not sell your personal data to third parties under any circumstances.

7. Cross-Border Data Transfer

In compliance with Article 29 of the PDPL, we do not transfer your personal data outside the Kingdom of Saudi Arabia unless:

The transfer is necessary for the performance of a contract between you and Marsa
The receiving country provides an adequate level of data protection as determined by the Saudi Data & AI Authority (SDAIA)
Appropriate safeguards are in place (standard contractual clauses or binding corporate rules)
You have provided explicit consent for the specific transfer

Our cloud infrastructure providers (including Supabase/PostgreSQL hosting) are contractually bound to protect your data in accordance with PDPL standards.

8. Your Rights Under PDPL

In accordance with Articles 18–22 of the PDPL, you have the following rights regarding your personal data:

Right to be informed: You have the right to know what data we collect and why (fulfilled by this policy).
Right of access: You may request a copy of your personal data held by us.
Right to rectification: You may request correction of inaccurate or incomplete data.
Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
Right to restrict processing: You may request limitation of processing in certain circumstances.
Right to data portability: You may request your data in a structured, machine-readable format.
Right to object: You may object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: You may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@marsatijarah.com. We will respond within 30 days as required by the PDPL Executive Regulations.

9. Data Security

In compliance with Article 19 of the PDPL, we implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction, including:

End-to-end encryption for data in transit (TLS 1.3)
Encryption at rest for stored personal data
Role-based access controls and authentication
Regular security audits and vulnerability assessments
Row-Level Security (RLS) policies on all database tables

10. Data Breach Notification

In the event of a personal data breach that may compromise your rights or freedoms, we will:

Notify the Saudi Data & AI Authority (SDAIA) within 72 hours of becoming aware of the breach
Notify affected individuals without undue delay if the breach poses a high risk to their rights
Document all breaches and remediation measures taken

11. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and provide personalized content. In compliance with the PDPL, we obtain your consent before placing non-essential cookies. You can manage your cookie preferences through our cookie consent banner or your browser settings.

Essential cookies: Required for platform functionality (no consent needed)
Analytics cookies: Help us understand usage patterns (consent required)
Marketing cookies: Enable personalized advertising (consent required)

12. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by Saudi Arabian law:

Account data: Retained while your account is active, deleted within 90 days of account closure
Transaction records: Retained for 10 years as required by Saudi commercial law
Communication logs: Retained for 3 years
Marketing consent records: Retained until consent is withdrawn

13. Minors' Data

Our platform is intended for business users aged 18 and above. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor without parental/guardian consent, we will delete such data promptly in accordance with Article 16 of the PDPL.

14. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email or platform notification at least 30 days before the changes take effect. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

15. Regulatory Authority

This policy is governed by the laws of the Kingdom of Saudi Arabia. The Saudi Data & Artificial Intelligence Authority (SDAIA) through the National Data Management Office (NDMO) oversees compliance with the PDPL. If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with SDAIA.

16. Contact Us

For privacy-related inquiries, data subject access requests, or to exercise your rights under the PDPL, please contact:

Data Protection Contact: privacy@marsatijarah.com
General Inquiries: info@marsatijarah.com
Address: King Fahd Road, Riyadh, Kingdom of Saudi Arabia