Privacy Policy — Digital B2B Integration Platform

Effective Date: September 20, 2026 | Version: 1.0 — Built in compliance with the Saudi Personal Data Protection Law (PDPL) and its Executive Regulations.

1. Introduction and Scope

This policy explains how the Digital B2B Integration Platform ("the Platform", "We") collects, processes, stores, shares, and protects the personal data of users (suppliers, merchants, delivery representatives, delivery companies, marketers, and their users). This is done in compliance with the Personal Data Protection Law issued by Royal Decree No. M/19, its Executive Regulations, and any instructions issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

Using the Platform constitutes consent to this policy to the extent permitted by law, subject to the data subject rights outlined in Section 8 below.

2. Data Control Entity

• Entity: Your Ideas a Reality Holding Company (شركة أفكارك واقع القابضة)

• Commercial Registration (CR): 7053992264

• Address: Jeddah, Kingdom of Saudi Arabia

• Data Protection Contact: privacy@afkwq.com

3. Data We Collect

Data Category	Examples
Identity and Registration Data	Name, National ID/Iqama number, Commercial Registration, Authorized representatives' details.
Contact Data	Mobile number, Email address, Physical address.
Entity and Activity Data	Business activity type, Licenses, Commercial category.
Transaction Data	Purchase orders, Contracts, Invoices, Payment history, Balances and credit terms.
Geographic Location Data	When using delivery services or determining the geographical range of nearby suppliers/merchants.
Device and Usage Data	Device type, IP address, Login logs, Cookies (if applicable).
Limited Financial Data	Basic billing data; complete payment card data is not stored except within approved security standards (PCI DSS) via payment providers licensed by SAMA.

4. Purposes of Data Processing

We use data for specific and legitimate purposes, including:

• Creating accounts and verifying identity and legal eligibility.

• Enabling and executing commercial transactions (purchase orders, contracts, invoices, payments).

• Executing delivery services and tracking their status.

• Complying with Saudi regulations (e-invoicing, anti-money laundering, requests from competent authorities).

• Cybersecurity, fraud prevention, and misuse mitigation.

• Improving platform performance, user experience, and usage analytics.

• Operational communications (account notifications, invoices, security alerts) and marketing communications with user consent where required by law.

Data is never used outside these purposes or sold to third parties for marketing purposes without a legal basis or explicit consent.

5. Legal Basis for Processing

Processing is based on one or more of the following: the data subject's consent, the necessity to perform a contract concluded with them, compliance with a legal obligation (such as e-invoicing or anti-money laundering), or the legitimate interest of the Platform in operating and protecting the service without prejudice to the rights of the data subject.

6. Data Sharing

Limited data may be shared, only to the extent necessary, with:

• Other transaction parties: (e.g., sharing delivery details with the delivery company, or invoice details with the buying party).

• Technical service providers: (Cloud hosting, licensed payment gateways, identity verification services) under data processing agreements that require them to maintain confidentiality.

• Governmental and regulatory authorities: Upon a binding legal request (e.g., Zakat, Tax and Customs Authority, security agencies, judiciary).

• Affiliated company or legal successor: In the event of restructuring or transfer of ownership of the Platform, while maintaining the same level of protection.

Data is never shared with any entity outside these categories without a legal basis or explicit consent from the data subject.

7. Transfer of Data Outside the Kingdom

Should the nature of the service (such as external cloud hosting) require transferring personal data outside the Kingdom of Saudi Arabia, this will be done strictly in accordance with the rules issued by the Saudi Data and Artificial Intelligence Authority (SDAIA). This includes ensuring an adequate level of protection in the receiving country or establishing approved contractual safeguards, and transfers will be limited to what is necessary to provide the service.

8. Rights of the Data Subject

In accordance with the Personal Data Protection Law and its Executive Regulations, the data subject has the right to:

• Request access to their personal data held by the Platform.

• Request a copy of their data in a readable format (where applicable).

• Request correction or updating of inaccurate data.

• Request the destruction or deletion of their data when the legal grounds for retaining it cease to exist, taking into account accounting, commercial, and legal obligations that may require retaining it for a specified period (such as the electronic invoice archiving period).

• Withdraw consent to processing based on consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) if they believe a violation has occurred.

Requests should be submitted via: privacy@afkwq.com, and will be processed within the legally mandated timeframe.

9. Data Retention Period

Data is retained for the duration of the account's activity and after its closure for whichever is longer: the period necessary to achieve the purpose of collection, the period required by law (such as at least 6 years for financial records and electronic invoices in accordance with VAT regulations), or the period necessary to protect the rights of the Digital B2B Integration Platform or resolve an existing dispute.

10. Data Security

The Platform implements reasonable technical and organizational measures to protect data from unauthorized access, disclosure, alteration, or destruction, including encryption during transit, access control, and security monitoring logs. In the event of a breach affecting personal data in a manner that poses a material risk, the Platform commits to notifying the competent authority and affected data subjects in accordance with the timelines and mechanisms specified by the Executive Regulations.

11. Cookies and Similar Technologies (If applicable to the website)

The Platform may use cookies for operational, security, and analytical purposes. Users can manage their preferences via browser settings or available platform tools.

12. Minors' Data

The Platform is intended for commercial use between entities and individuals with full legal capacity. Registration by individuals under the legal age for contracting is prohibited, and the Platform does not knowingly collect minors' data.

13. Amendments to the Policy

This policy may be updated from time to time, and amendments take effect from the date of their publication. Users will be notified of material changes through approved communication channels.

14. Interconnection of this Policy with Terms & Conditions and Special Agreements

This policy is an integral part of the Platform's General Terms and Conditions and any special agreement (Supplier, Merchant, Delivery Company/Representative, Marketer) entered into by the user. No special agreement may provide a lower level of personal data protection than what this policy stipulates. In the event of a conflict between a provision in this policy and a provision in the General Terms and Conditions specifically regarding data protection, the provision offering greater protection to the data subject shall apply.

15. Contact

For privacy and data protection inquiries: privacy@afkwq.com | +966 500 863 430

Last Updated: September 20, 2026 | Policy Version: 1.0