Privacy Policy — T Mart Platform

Legal Entity: Tuwaiq Mart Company For Telecommunications and IT

Entity Type: Limited Liability Company (LLC)

Unified Commercial Registration Number: 7052416893

VAT Number: 314370527400003

National Address: Riyadh, Al-Olaya District, Makkah Al-Mukarramah Branch Street, Building No. 3144, Sub-number 6197, Postal Code 12221, Short Address: RHOA3144

Website: https://tuwaiqmart.com

Support Email: Support@Tuwaiqmart.com

Phone: +966 59 041 1111

Effective Date: 05/05/2026

The Arabic version is the official reference version. In case of any conflict with the English translation, the Arabic version shall prevail.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Introduction

Tuwaiq Mart Company For Telecommunications and IT (hereinafter referred to as "T Mart", "we", or "the Company") welcomes you. We operate a multi-category e-commerce display and marketing platform on tuwaiqmart.com and our associated electronic applications (collectively referred to as "the Platform").

Our Clear Legal Position: T Mart is an intermediary platform for displaying and marketing on behalf of independent sellers, and is not a seller of the goods and services offered through it (unless explicitly stated otherwise). Sellers bear full responsibility for their products.

We are committed to protecting the privacy of platform users (buyers, sellers, visitors) in accordance with the following Saudi regulations:

• The Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 dated 9/2/1443H, and its Implementing Regulations issued in September 2023, fully effective from 14/09/2024.
• The Regulation on Personal Data Transfer Outside the Kingdom issued by SDAIA in August 2024.
• The E-Commerce Law and its Implementing Regulations.
• The Anti-Cyber Crime Law.
• The Essential Cybersecurity Controls (ECC) issued by NCA.
• ZATCA regulations on retention of invoice records.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Scope

This policy applies to personal data we collect or process in connection with:

• Visiting tuwaiqmart.com or any affiliated applications.
• Creating a buyer account or seller account on the Platform.
• Browsing, purchasing, bidding, and reviewing in categories: groceries and food, electronics, furniture, fashion, perfumes, pet supplies, health and pharmaceutical products, vehicles, real estate, and others.
• Contacting us via email, phone, or technical support.
• Participating in our marketing or promotional programs.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. Definitions

Term	Definition
Personal Data	Any data that identifies an individual directly or indirectly, including name, ID, mobile, email, address, device data, IP address, and others.
Sensitive Data	Financial, health, genetic, biometric, religious, political, criminal data, and the like under Article 1 of PDPL.
Controller	Tuwaiq Mart Company For Telecommunications and IT.
Processor	Any third party that processes data on our behalf (hosting provider, shipping companies, payment processor).
Seller	Any legally licensed natural or legal person who offers their products or services on the Platform.
Buyer / User	Any person using the Platform to browse or purchase.
Display Platform	The legal description of T Mart as an intermediary that displays and markets on behalf of sellers.
SDAIA	Saudi Data and Artificial Intelligence Authority — the regulatory authority for PDPL.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. Identity of the Data Controller

Information	Details
Legal Name	Tuwaiq Mart Company For Telecommunications and IT
Entity Type	Limited Liability Company
Unified Commercial Registration Number	7052416893
VAT Number	314370527400003
National Address	Riyadh, Al-Olaya District, Makkah Al-Mukarramah Branch Street, Building 3144, Postal Code 12221, Additional Number 6197 (RHOA3144)
Unified Contact Email	Support@Tuwaiqmart.com
Phone	+966 59 041 1111

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. Data Protection Officer (DPO)

Current Status: No data protection officer has been appointed as of the date of this draft.

⚠️ Statutory Obligation: Article 32 of the Implementing Regulations of PDPL requires the controller to appoint a data protection officer when the main activity requires regular and systematic processing of personal data on a large scale, or processing of sensitive data.

Implementation Options:

• (a) Appointing an internal employee responsible for privacy.
• (b) Contracting an Outsourced DPO from a consulting firm.

Until a DPO is appointed, privacy inquiries are directed to Support@Tuwaiqmart.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. Data We Collect

a) Data You Provide to Us Directly

When creating a buyer account:

• First and last name
• Email address
• Mobile number
• Date of birth
• Short national address, city, region, country
• Password (encrypted using non-reversible Hashing)

When creating a seller account (in addition to the above):

• Trade store name
• Uploaded verification documents (Commercial Registration, VAT certificate, owner's National ID)
• IBAN bank account number for transfer of dues
• Sub-licenses for regulated activities (e.g., SFDA license for health products, MEWA for animal sales, REGA for real estate, if applicable)

When making a purchase:

• Billing and shipping data
• Order details and product list
• Payment data (processed via a payment gateway licensed by the Saudi Central Bank SAMA — card details are not stored with us, only a tokenized hash)

When participating in an auction:

• Your bidding history
• Communication between you and the listing seller

When contacting support:

• Content of your correspondence
• Call recordings (for quality and employee training purposes, after notifying you)

b) Data Collected Automatically

• Technical data: IP address, browser type, operating system, device type, device identifier.
• Approximate location data: city/country (extracted from IP for VAT and shipping fee calculation purposes).
• Usage data: pages you visit, searches, content you interact with.
• Cookie data (refer to Section 13).

c) Data We Receive from Third Parties

• Payment processors: confirmation of transaction success/failure.
• Shipping companies: order status and shipment tracking.
• Advertising platforms (Google, Meta): indicators of our marketing campaigns.
• Government entities: when verification is requested in accordance with regulations (e.g., Absher for vehicle plate transfer).

d) Sensitive Data

• Financial data: IBAN numbers for sellers, hashed payment tokens.
• Identity documents: copies of National ID or Commercial Registration for sellers (for KYC and Anti-Money Laundering purposes).
• Processing of this data is conducted with additional safeguards: AES-256 encryption, restricted access permissions, periodic audit logs.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. Legal Basis for Processing (Article 5 of PDPL)

We process your data based on one of the following grounds only:

Purpose	Legal Basis
Account creation and management	Contract execution (Terms of Use)
Facilitating display and marketing of sellers' products	Contract execution
Transferring shipping data to the seller for order fulfillment	Contract execution
Payment processing	Contract execution + Statutory obligation (SAMA and ZATCA regulations)
Issuing tax invoices	Statutory obligation (VAT system + ZATCA)
Retaining transaction records for 6 years	Statutory obligation (ZATCA regulation)
Verifying seller identity (KYC)	Statutory obligation (Anti-Money Laundering)
Fraud prevention and platform protection	Legitimate interest
Platform improvement (analytics)	Explicit consent via cookie banner
Marketing messages	Prior explicit consent (Opt-in) — separate per channel
Vehicle license plate transfer via Absher	Statutory obligation + explicit consent

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

7. Your Rights Under PDPL (Article 3)

You enjoy the following rights at any time:

The Five Fundamental Rights:

1. The right to know how your data is processed and the reasons for collecting it.
2. The right to access your personal data held by us.
3. The right to obtain your data in a machine-readable format (Portability).
4. The right to request correction of any inaccurate or incomplete data.
5. The right to request destruction (subject to statutory exceptions such as invoice records required by ZATCA).

Additional Rights:

• Right to withdraw consent at any time (for processing based on consent).
• Right to object to processing for direct marketing purposes.
• Right to file a complaint to SDAIA via dgp.sdaia.gov.sa or call 19990.

How to Exercise Your Rights:

• Email: Support@Tuwaiqmart.com (subject: "Privacy Request")
• From your account settings on the Platform

We commit to responding within 30 days from the date of receipt of your request. We may request identity verification before fulfilling any request to protect your data.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

8. With Whom We Share Data

We do not sell your data to any party for marketing purposes.

We share your data only in the following cases:

a) With Sellers on the Platform

• We share only the necessary shipping data (name, address, phone, order details) with the relevant seller to fulfill your order.
• The seller becomes an independent controller of this data after receiving it, and is legally bound to handle it in accordance with PDPL.

b) With Service Providers

• Shipping Companies: Approved Saudi and international companies (such as Saudi Post SPL, Aramex, SMSA, DHL, FedEx) — selected based on shipping destination.
• Payment Processor: Tap Payments (a regionally approved company) — processes all electronic payments (mada, Visa, Mastercard, Apple Pay, STC Pay, and others as available with Tap); in addition to direct bank transfer to the company's bank account.
• Cloud Hosting Provider: Amazon Web Services (AWS).
• Analytics and Marketing Services: Google Analytics, Meta (Facebook Pixel) — only after your explicit consent via the cookie banner.

c) With Government Entities

• SDAIA upon official request.
• ZATCA for tax obligations.
• The Public Prosecution and security entities based on a judicial order.
• SAMA in cases related to payments.
• Communications, Space and Technology Commission (CST) for regulatory obligations.
• Ministry of Commerce in consumer protection cases.

d) In Case of Company Ownership Transfer

• In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity after notifying you.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

9. Data Transfer Outside the Kingdom

Your data is hosted on Amazon Web Services servers.

When data needs to be transferred outside the Kingdom (for specific analytics or marketing services), we comply with the Regulation on Personal Data Transfer Outside the Kingdom issued by SDAIA in August 2024.

Potential Recipient Entities:

Recipient	Country	Purpose	Safeguards
Google LLC (Analytics)	United States	Website usage analytics	DPA + SCCs + User consent
Meta Platforms (Facebook Pixel)	United States / Ireland	Advertising and conversion tracking	DPA + User consent
Amazon Web Services (AWS)	United States / Ireland	Cloud hosting for the platform	DPA + SCCs + TLS 1.3 / AES-256 encryption

Applied Safeguards:

• Standard Contractual Clauses (SCCs) with each recipient entity.
• Transfer Impact Assessment before any new transfer.
• SDAIA approval when required under the regulation.
• TLS 1.3 encryption at minimum during transfer.

You have the right to request a copy of the transfer safeguards via Support@Tuwaiqmart.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

10. Data Retention Periods

Data Category	Retention Period	Legal Basis
Invoice and VAT records	6 years after end of tax year	ZATCA regulation
Active accounts	For the duration of account activity + 5 years after closure	Statute of limitations
Payment records	10 years	SAMA requirements
Seller KYC documents	For the duration of the business relationship + 10 years thereafter	Anti-Money Laundering
Marketing data	Until consent is withdrawn	Consent
Analytical cookies	12 months	Consent
Abandoned carts	48 hours	Legitimate interest
Support and complaint records	5 years	Legitimate interest
Auction records	10 years after auction closure	Proof of rights
Call recordings	12 months	Service quality
Vehicle plate transfer records	10 years	Traffic Law

After the period expires, we either destroy the data or permanently anonymize it.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

11. Children's Privacy (Article 7 of PDPL)

• Our platform is not directed at children under 13.
• We do not intentionally collect personal data of children.
• Registration on the Platform is restricted to those who have reached 18 years of age (the legal age of majority).
• If you are a guardian and learned that your child provided us with data, please contact Legal@Tuwaiqmart.com and we will promptly destroy it.
• Some products (such as children's perfumes or children's supplies) are directed at parents, not at children themselves.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

12. Direct Marketing (Article 25 of PDPL)

We adhere to the prior explicit Opt-in system before sending any marketing message:

• Separate consent for each channel: email, SMS, WhatsApp, app notifications, calls.
• You may withdraw consent at any time via:
  • The "Unsubscribe" link in each email.
  • Replying with the word "STOP" to any SMS.
  • From your account settings on the Platform.
  • Contacting Support@Tuwaiqmart.com
• Transactional messages (order confirmation, shipping notification, password reset, invoices) are not marketing and do not require separate consent, as they are part of contract execution.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

13. Cookies

On your first visit to the Platform, the cookie banner appears allowing you to:

• Accept All
• Reject All (except essential cookies)
• Customize categories

Category	Description	Consent Required?
Essential	Login, cart, security	No
Functional	Saving language and region preferences	No
Analytical	Google Analytics and understanding user behavior	Yes
Marketing	Meta Pixel, advertising retargeting	Yes

Executive Notice to the Company: An effective cookie banner must be deployed on the website — in the current review no banner was found, which is a direct violation of PDPL requirements and approved Saudi practices.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

14. Data Security

We apply security controls compliant with the Essential Cybersecurity Controls (ECC) issued by NCA:

Technical Controls:

• TLS 1.3 encryption for all data transmission.
• AES-256 encryption for sensitive data storage.
• Multi-Factor Authentication (MFA) for administrative accounts.
• Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS).
• Daily encrypted backups.
• Periodic penetration testing.
• Compliance with PCI DSS standards for payments provided by the service provider.

Organizational Controls:

• Access permissions based on the "Least Privilege" principle.
• Employee training on data protection.
• Non-Disclosure Agreements (NDAs) with all employees and contractors.
• Periodic security reviews.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

15. Data Breach Notification

In the event of a potential breach of your data:

• We notify SDAIA within 72 hours of becoming aware of the breach, in accordance with Article 24 of the Implementing Regulations of PDPL.
• We notify you without delay if the breach poses a serious risk to your data.
• We maintain an internal breach log for audit purposes.
• We take immediate measures to contain the breach and prevent its recurrence.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

16. Amendments to This Policy

For any material amendment:

• We notify you via registered email 30 days in advance.
• We display a prominent banner on the Platform.
• We update the "Last Updated Date" at the top of the policy.
• We may request new consent when needed.

Your continued use of the Platform after the amendments take effect is considered implicit acceptance, unless the amendments require explicit consent.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

17. Governing Law and Jurisdiction

• This policy is governed by the laws of the Kingdom of Saudi Arabia.
• Saudi courts have jurisdiction over any dispute.
• This does not prejudice your right to file an administrative complaint to SDAIA or other regulatory authorities.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

18. Contact

Inquiry Type	Contact
Privacy inquiries	Support@Tuwaiqmart.com (Subject: "Privacy Request")
General technical support	Support@Tuwaiqmart.com
Legal	Legal@Tuwaiqmart.com
Phone	+966 59 041 1111
Postal Address	Riyadh, Al-Olaya District, Makkah Al-Mukarramah Branch Street, Building 3144, Postal Code 12221, Additional Number 6197 (RHOA3144)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

19. Filing a Complaint to SDAIA

If we do not handle your request satisfactorily, you have the right to file a complaint to the Saudi Data and Artificial Intelligence Authority:

• Website: https://sdaia.gov.sa
• Complaints Portal: https://dgp.sdaia.gov.sa
• Call Center: 19990

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Arabic version is the official reference version in case of any conflict with any other translation.