Loading…
Disty Company for Marketing (شركة دستي للتسويق), commercial registration number 1009005133, VAT registration number 312200046700003, with its address at Building 7027, Al Olaya Street, Al Olaya District, Secondary No. 2455, Riyadh 12244, Kingdom of Saudi Arabia (“Disty”, “we”, “us” or “our”), is the controller responsible for the personal data processed for the purposes described in this Privacy Policy.
This Policy explains how we collect, use, store, disclose and otherwise process personal data in connection with our websites, mobile applications, B2B marketplace, Disty AI, account management, WhatsApp and other communication channels, and related procurement and support services (together, the “Services”). It applies to visitors; business and retailer account holders and their authorised representatives; delivery recipients; prospective customers; and individual contacts at sellers, suppliers and other business partners.
Personal data means information that identifies an individual or allows an individual to be identified directly or indirectly. Information about a company is covered by this Policy to the extent that it also constitutes personal data, including information about sole proprietors and company representatives.
We process personal data in accordance with the Saudi Personal Data Protection Law, issued under Royal Decree No. M/19 and amended under Royal Decree No. M/148, its Implementing Regulation, the Regulation on Personal Data Transfer Outside the Kingdom, and other applicable Saudi laws (“Applicable Law”).
This Policy is a notice of our processing practices. It does not, by itself, constitute your consent to optional processing or waive any rights under Applicable Law. Where consent is required, we obtain it separately for the relevant purpose. A supplementary notice may provide more specific information for a particular feature, credit application, campaign or interaction.
The data collected depends on your relationship with Disty, the Services used and the choices you make. The categories below describe data that may be processed where relevant; they do not mean that every category is collected from every person.
Names, job titles, business contact details, mobile and WhatsApp numbers, email addresses, account identifiers, authentication and sign-in records, authorised-user roles, permissions, language and communication preferences, and business and delivery addresses. Verification records may include relevant information from commercial registrations, VAT certificates, National Address records and authorisation letters, and information needed to verify representatives or signatories. We copy official documents identifying individuals only where Applicable Law permits, including where required by law or requested by a competent public authority.
Requests for quotations, specifications, quotations, orders, invoices, credit notes, purchased products, negotiated arrangements, payment status, wallet transactions, discounts, promotional participation, wish lists, requested price or stock alerts, delivery instructions, returns, refunds and warranty claims. Payment records may include payment-method type, masked card details, payment tokens or references, and bank details supplied for transfers or refunds. Delivery records may include recipient details and appropriate proof of delivery, such as a delivery confirmation code, signature, stamp or photograph.
Where credit or deferred-payment arrangements are requested or used, relevant applications, financial statements, outstanding amounts, credit limits, repayment records and guarantor or signatory information may be processed. Personal credit data and credit-bureau information are subject to additional requirements described in Section 3. We distinguish a business’s financial information from personal data about an individual.
Enquiries, complaints, emails, support chats, account-manager correspondence, WhatsApp messages, feedback, surveys and call-related records. Where a call is recorded, we provide the required recording notice and obtain consent where required. Disty AI interactions may include prompts, voice messages, audio transcripts, images, uploaded documents, conversation history and related product or order context. Reviews or other content submitted for public display may include the name or attribution disclosed at submission.
IP addresses, browser and device characteristics, operating system and app versions, device and advertising identifiers, approximate location inferred from IP address, timestamps, referral sources, searches, product views, clicks, cart and checkout events, purchases, diagnostic information, crash reports and security logs. Marketing records may include campaign interactions, installation and conversion events, audience segments, consent records and suppression preferences. Where permitted, we may derive relevant purchasing preferences or likely interests from interactions with the Services.
We obtain information directly from you when you register, transact, communicate, upload content or use a feature; automatically through our systems and the technologies described in Section 4; and, where lawfully permitted, from your organisation or its account administrator, delivery recipients, marketplace sellers, carriers, payment and credit providers, licensed credit bureaus, official verification sources, publicly available business sources, and analytics or advertising partners. We may reconcile information from these sources for the specified purposes and subject to the applicable legal basis. Public availability does not remove the protections required by Applicable Law.
If you provide another person’s data, disclose only what is necessary, ensure you are entitled to provide it, and make this Policy available to that person. Your organisation’s permission does not replace an individual’s consent where that consent is legally required. We remain responsible for notices and other obligations that apply to our own processing.
Where we collect your data from another party, such as your organisation, a partner platform, a Seller or a carrier, we shall take the necessary steps to provide the required information, including the categories of data and their source, without undue delay and within 30 days of collection, unless a specific statutory exception applies. We shall document any exception on which we rely. Asking you or your organisation to make this Policy available does not discharge our own notification obligations.
Mandatory and optional information. For each form or feature, we shall identify the mandatory and optional information, the purpose for which it is requested and the consequences of not providing mandatory information. Depending on the activity, required information may include account and authority verification details, invoice information, and the recipient’s address and contact number necessary for delivery. The relevant activity may not be available without that information. Marketing choices, tracking permissions and optional inputs shall be presented separately; declining them shall not prevent use of unrelated core Services.
Sensitive information. The Services do not ordinarily require health information, religious beliefs, biometric identification data or other legally defined sensitive data. Do not submit such information unless specifically requested through an appropriate process. If processing is necessary, we first establish the applicable legal basis and safeguards, including explicit consent where required. Personal credit data has its own statutory protections and explicit-consent requirements.
We use personal data for the purposes below only where the applicable legal conditions are met. A reference to several grounds identifies grounds for different activities or circumstances; it does not allow us to disregard a requirement for consent.
We process relevant identity, account, transaction, payment and delivery data to establish and verify accounts and authority; manage users and permissions; source products; distribute RFQs to relevant sellers; prepare quotations; process orders and payments; maintain wallets; arrange delivery; and handle refunds, returns, warranty claims and support. We also send authentication codes, security notices, invoices, account notices and transaction updates.
Where processing implements an existing agreement to which the individual is a party, we rely on that agreement. Where an individual acts for a corporate customer and is not personally a party, we rely on a documented legitimate interest in administering that business relationship, or another applicable legal ground. We rely on legal requirements for mandatory verification, invoicing and recordkeeping.
We may analyse relevant usage, transaction and feedback data to evaluate demand; improve assortment, search, recommendations and procurement tools; test features; diagnose faults; measure performance; and develop products and operational processes. We may personalise navigation and product recommendations using relevant account activity and preferences.
We rely on documented legitimate interests for necessary, proportionate processing within reasonable expectations, where those interests do not prejudice individuals’ rights or interests. Processing for marketing or tracking that requires consent is conducted on that basis instead. We use anonymised or aggregated information where it can fulfil the purpose, and apply data minimisation to any identifiable information.
We process relevant records to authenticate users; detect fraud, account misuse, promotion abuse and suspicious payments; protect systems and people; investigate incidents; reconcile accounts; manage suppliers; conduct audits; comply with lawful authority requests; recover debts; and establish, exercise or defend legal claims. The grounds are applicable legal requirements and, where permitted, documented legitimate interests. These grounds do not remove special requirements for personal credit data, sensitive data or direct marketing.
Where available and requested, we may process relevant data to evaluate, arrange, administer and collect credit or deferred-payment facilities, including through appropriately authorised third parties. Processing of personal credit data requires the applicable explicit consent and compliance with the Credit Information Law and relevant Saudi Central Bank requirements. We provide required notices relating to credit-data disclosures. An organisation’s application does not automatically authorise access to an individual’s credit report or a guarantor’s data.
We may process the information you submit, together with relevant account, product and order context, to interpret requests, transcribe voice messages, identify products, prepare responses and assist with procurement and support. Relevant information may be processed by contracted AI and infrastructure providers. Depending on the activity and your relationship with Disty, the legal ground is implementation of an existing agreement, a documented legitimate interest in providing the requested assistance, or consent where required.
Interactions may be subject to limited review by authorised personnel or contracted providers for troubleshooting, safety and quality evaluation, to the extent necessary and lawful. Acceptance of this Policy or the general Terms does not authorise the use of personal or confidential content to train general-purpose models. Training or fine-tuning using interactions that permit identification shall take place only after the purpose and legal basis have been established, an appropriate separate notice provided, and consent obtained where required. We shall contractually require processors to comply with the approved instructions and restrictions. This Policy does not authorise them to reuse data for undisclosed independent purposes.
Automated rules or scoring may assist fraud detection, account checks and initial credit assessments. Before making a decision about an individual solely through automated processing of personal data, we provide the required information and obtain explicit consent where required. You may contact us to question an outcome and request review. Do not submit authentication codes, payment credentials, unnecessary identity documents or unrelated personal information in an AI conversation.
Consent is requested in a clear, specific and verifiable form, separately for each purpose where required. You may withdraw it using the relevant control or the contact details in Section 10. Withdrawal does not affect lawful processing before withdrawal or processing that continues on a separate, valid legal ground.
Before relying on legitimate interests, we assess and document necessity, reasonable expectations, effects on individuals and appropriate safeguards. We do not rely on legitimate interests to process sensitive data or to bypass a specific consent requirement. New purposes are assessed separately, with further notice and consent where required.
We may use cookies, pixels, local storage, software development kits (“SDKs”), device identifiers and server-side integrations to support the Services and the purposes described below.
Essential operation. Technologies necessary for authentication, security, cart operation, load balancing and remembering privacy choices are used on the legal ground applicable to those functions. A technology is not essential merely because it is commercially useful.
Preferences and analytics. Technologies may support saved settings, recently viewed products, usage measurement, feature evaluation and diagnostics. The applicable ground depends on the actual purpose, data and implementation. Where consent is required, the technology must remain inactive for that purpose until consent is obtained.
Advertising, audiences and attribution. With the required consent, we may measure advertising performance; associate ad interactions and app installations with registrations and purchases; personalise advertising on our own or third-party services; retarget interested users; create, match or exclude audiences; and improve campaign delivery. These activities may involve advertising identifiers, IP and device information, campaign events, product identifiers and relevant transaction values.
Server-side measurement may involve sending partners an email address or mobile number transformed using a hashing function to match records, measure conversions or manage audiences. Hashing is a pseudonymisation measure, not anonymisation: matched or otherwise identifiable records remain personal data. Server-side processing is subject to the same applicable consent and disclosure requirements as other tracking. Sensitive data, personal credit information and confidential negotiated commercial terms are not provided for advertising purposes.
The technology and consent notices available for the relevant Service shall identify the tools and providers actually used, the purpose of each tool, the categories of data processed, the duration of identifiers or the criteria determining it, the recipient’s capacity and the relevant processing locations. This information shall be updated when tools or purposes change. Some partners process data on our instructions, while others act as independent controllers for disclosed purposes under their own notices. A reference to a category of providers does not constitute consent to activate an undisclosed tool.
You may manage your choices through the privacy or consent controls presented for the relevant Service, browser and device settings, or by contacting us. Where processing is based on consent, we shall provide a withdrawal method that is no more difficult than giving consent and shall cease the processing concerned without undue delay. Device permissions, including Apple’s App Tracking Transparency, are additional controls and do not replace consent required under Saudi law. Browser settings alone may not stop server-side processing or remove data previously disclosed. Refusing optional tracking does not prevent use of unrelated core Services; blocking essential technologies may affect functionality.
Identifiers may last for a session or a longer period depending on purpose and provider. We limit their duration and related records to what is justified under Section 8. You may request information about relevant technologies, providers and retention.
Subject to the required consent, we may communicate offers, promotions, product news and relevant commercial opportunities through email, SMS, WhatsApp, telephone, push or web notifications, and other selected channels. We may use information collected directly from you to tailor marketing within your consent. Sensitive data is not used for marketing.
We record consent and identify Disty as the sender. Direct marketing is subject to the PDPL and applicable communications and anti-spam requirements; an existing customer relationship or acceptance of this Policy does not itself establish marketing consent.
You may unsubscribe without charge through the method provided with a communication, a relevant preference control, or info@disty.app. We stop the affected marketing without undue delay following withdrawal and maintain only the necessary suppression information to respect your choice. You do not need to close your account to stop marketing.
Necessary security, account, order, payment, delivery and legal notices may continue on their applicable non-marketing ground. A price, stock or product alert is assessed by its actual content and purpose. Requesting a specific alert does not enrol you in unrelated promotions; marketing alerts remain subject to marketing consent.
We disclose relevant personal data only for a specified lawful purpose and limit disclosure to what is necessary and permitted. We do not sell personal data as a standalone product. The following disclosures may occur:
Disclosure shall also comply with the specific provisions applicable to the transaction, including Article 5 of the E-Commerce Law where applicable. Where those provisions require consent to disclosure or a specific statutory basis, that requirement shall be satisfied before disclosure. A legitimate interest, membership of a corporate group or a proposed transaction is not, by itself, sufficient to override that requirement. Acceptance of the Terms does not replace the required consent.
Marketplace sellers, suppliers and service centres: relevant RFQ requirements, business and transaction details, delivery contacts and claim information to prepare quotations, fulfil orders, issue documents and administer returns, repairs and warranties. Receiving order information does not authorise a seller to add you to unrelated marketing lists.
Carriers, warehouses and fulfilment partners: recipient and contact details, delivery instructions, order and parcel details, tracking events and appropriate delivery confirmation information to fulfil deliveries, collect returns and investigate shipment claims.
Payment, banking and credit partners: information necessary for payments, reconciliation, refunds, risk checks and requested credit arrangements. Personal credit disclosures remain subject to the consents and controls in Section 3.
Technology and operational providers: information needed for hosting, storage, authentication, security, communications, customer support, analytics, AI processing and other contracted functions. Providers acting as processors are subject to appropriate written instructions, confidentiality, security and data-processing requirements, including controls for subprocessors.
Advertising and measurement partners: identifiers, permitted audience information and events for the purposes and subject to the choices in Sections 4 and 5.
Disty group entities: where relevant, entities within our corporate group supporting operations, systems, security, finance or administration, on the applicable lawful ground. Group affiliation does not remove disclosure or international-transfer requirements.
Professional advisers and authorised recipients: relevant information for legal, accounting, tax, audit, insurance, debt-recovery and dispute-related services, and disclosures made at your valid direction.
Authorities and parties to legal proceedings: information required by law, a binding order or a properly established statutory disclosure ground. Protection of Disty’s interests does not, by itself, authorise unrestricted disclosure.
Transaction counterparties: relevant information in connection with an actual or proposed investment, financing, merger, acquisition, restructuring, insolvency or transfer of business or assets, subject to a lawful disclosure ground, proportionate due diligence and appropriate confidentiality and access controls. A transaction does not remove existing data-protection obligations.
Organisation administrators: information appropriate to administer a business account, its authorised users, approvals, transactions and activity. Business-account activity may be accessible to your organisation according to roles and permissions.
Some recipients, including sellers, banks, credit bureaus and certain technology or advertising partners, may act as independent controllers for their own disclosed purposes. Their notices apply to that processing. This does not reduce Disty’s responsibility for its own collection and disclosure. Third-party links and independently operated services should be reviewed before you provide information to them.
Personal data may be stored in electronic systems and, where relevant, physical records. Access by a provider or personnel outside Saudi Arabia may constitute an international transfer even where the primary system is hosted in the Kingdom.
We may use overseas infrastructure, group support, communications, analytics, advertising and AI providers only where the transfer or disclosure complies with Article 29 of the PDPL, the applicable transfer regulation and any additional sector-specific or localisation requirements.
Before a transfer, we establish a permitted purpose and transfer route. Depending on the circumstances, this may involve a recognised adequate level of protection, an applicable safeguard or exemption satisfying its specific conditions, or another route expressly permitted by Applicable Law. Relevant safeguards may include SDAIA standard contractual clauses, binding common rules or an authorised accreditation mechanism, where available and applicable. A contract or your acceptance of this Policy alone does not establish that every transfer is permitted.
We shall apply the required data-minimisation, security, onward-transfer and risk-assessment measures before transfer where required. Additional restrictions concerning personal credit data and specially regulated records remain applicable. The hosting and provider notice associated with the Service shall identify the countries or regions in which data is actually stored or processed, including relevant support and remote-access locations, the categories of recipients, the purpose of transfer, and the applicable safeguard or lawful transfer route. Further information may be requested using the contact details in Section 10, subject to lawful confidentiality and security restrictions. Required disclosure shall not be limited to information available on request where it must be provided at collection.
We retain identifiable personal data for the period justified by its purpose and any applicable legal obligation. We determine that period by considering the nature of the record, the activity involved, account status, unresolved obligations, applicable accounting and tax rules, warranty and claim periods, security risks, and the establishment or defence of legal claims.
Account and verification records shall be retained during the relationship to the extent necessary to administer the account and permissions. Upon account closure or termination of an authorisation, we shall review the data, delete what is no longer necessary and retain only information supported by a statutory obligation or a specific, documented lawful purpose. Transaction, invoice and accounting records shall be retained for the period required for each record under the applicable tax and accounting requirements. This does not justify retaining all account or tracking data for the same period.
The retention period for a credit file shall be linked to the facility, repayment, dispute and applicable statutory requirements. For support correspondence, call records and AI interactions, retention shall be linked to closure of the request or conversation and the specific follow-up, quality or security need, followed by deletion or anonymisation unless a separate lawful ground for retention exists. Separate periods shall be established for conversation content, uploaded files and technical logs held by Disty and its providers. Removing a visible conversation does not necessarily immediately delete a separate transaction record, evidence subject to a lawful preservation requirement or all backup copies.
Analytics, advertising and security retention periods shall be determined by purpose, necessity, risk and the applicable consent, with separate periods for identifiers and their associated events and records. The retention notice associated with the Service shall specify the approved period for each category, or the criteria used to determine it where a fixed period cannot be specified, and the event from which that period runs. Consent and marketing-suppression records shall be retained only to the proportionate extent necessary to demonstrate and respect choices. Suppression records shall not be used to send new offers. Provider settings or a possible future benefit do not justify indefinite retention.
When a retention ground ends, we securely destroy personal data or irreversibly anonymise it. Use of data subject to a lawful preservation requirement is restricted to the relevant purpose. Residual backup copies are protected and removed through the applicable deletion cycle, subject to lawful retention requirements; if restored, applicable deletion instructions are reapplied.
We may use and disclose genuinely anonymised statistics and business insights for research, planning, benchmarking and service development without an identification-based retention limit. Data that can reasonably be linked back to a person, including merely hashed or pseudonymised data, remains subject to this Policy and Applicable Law.
We apply appropriate organisational, administrative and technical safeguards proportionate to the nature of the data and processing risks. Relevant measures include access restrictions, authentication controls, confidentiality requirements, protected transmission and storage where appropriate, monitoring, provider oversight and incident-response procedures.
Payment processing is subject to the security and regulatory requirements applicable to the relevant service and provider. Do not send card security codes, full payment credentials or sign-in codes through support chats, WhatsApp or Disty AI.
No transmission or storage system can provide absolute security. This does not exclude any responsibility imposed on Disty by Applicable Law. If a personal data breach meets the statutory notification conditions, we notify the competent authority within the prescribed period, including within 72 hours of awareness where applicable, and notify affected individuals without undue delay where required.
Protect your devices and authentication codes, maintain accurate user permissions, remove access that is no longer authorised and report suspected misuse promptly using the contact details below.
Subject to Applicable Law, you may request information about the legal basis and purposes of processing; access to your personal data; a copy in a clear and readable format; correction, completion or updating; and destruction in the circumstances provided by law. You may withdraw consent for consent-based processing and submit a privacy complaint.
Send requests to info@disty.app or contact 920027744. Please describe the request and the relevant relationship or account without sending unnecessary identity documents. We may take proportionate steps to verify identity and authority and protect other individuals’ information. You may contact us directly even where your organisation administers the account.
If Disty appoints a personal data protection officer, clear and accessible contact details shall be provided in the published privacy information and updated when they change. The address info@disty.app remains a channel for receiving privacy requests and directing them to the responsible person. Merely stating that address does not announce the appointment of a data protection officer or confirm that the appointment requirements have been satisfied.
We act on rights requests without undue delay and within 30 days. Where the statutory conditions for an extension are met, we may extend by up to a further 30 days and notify you in advance, explaining the reason. Exercising these rights is free of charge.
Rights are subject to statutory conditions and exceptions. For example, a destruction request may not require removal of records that must lawfully be retained, and access must protect others’ rights and confidential information. We explain a restriction, refusal or available alternative to the extent permitted by law. Repetitive, manifestly unfounded or disproportionate requests are handled only as Applicable Law permits.
Withdrawal of consent does not cancel outstanding payment obligations or prevent necessary processing on another lawful ground. We explain where withdrawal means a directly related optional feature can no longer be provided. Changes to your role or departure from a company do not automatically require destruction of its legally retained transaction records.
You may raise a concern with us or complain directly to the competent authority, currently the Saudi Data and Artificial Intelligence Authority (“SDAIA”), through its official personal data protection channels at dgp.sdaia.gov.sa. Contacting Disty first is not a condition for exercising a statutory complaint right. Nothing in this Policy limits any right to a remedy or compensation available under Applicable Law.
The Services are primarily intended for professional use by adults authorised to act for their organisations. Where a purchasing programme for individuals or employees is made available, or an Order is fulfilled through a partner platform, this Policy applies to our processing of those purchasers’ and recipients’ data, together with an appropriate supplementary notice identifying the parties’ roles. The Services are not directed at persons under 18. If you believe that a child has provided personal data, please contact us. We shall assess the circumstances and take appropriate action, including destruction or obtaining valid guardian authorisation where legally applicable.
We may update this Policy to reflect changes in the Services, processing practices or Applicable Law. The revision date appears above. We provide additional notice where required and, before processing for a new purpose, provide the applicable information and obtain fresh consent where required. Continued use does not replace consent that must be obtained separately.
Where matching Arabic and English versions of this Policy are published, the Arabic version prevails in the event of inconsistency, subject always to mandatory Saudi law. Language precedence does not expand processing permissions or reduce statutory protections.
Privacy enquiries and rights requests: info@disty.app
General support: info@disty.app | 920027744
Controller: Disty Company for Marketing (شركة دستي للتسويق), CR 1009005133
Postal address: Building 7027, Al Olaya Street, Al Olaya District, Secondary No. 2455, Riyadh 12244, Kingdom of Saudi Arabia.
Disty Company for Marketing (شركة دستي للتسويق), commercial registration number 1009005133, VAT registration number 312200046700003, with its address at Building 7027, Al Olaya Street, Al Olaya District, Secondary No. 2455, Riyadh 12244, Kingdom of Saudi Arabia (“Disty”, “we”, “us” or “our”), is the controller responsible for the personal data processed for the purposes described in this Privacy Policy.
This Policy explains how we collect, use, store, disclose and otherwise process personal data in connection with our websites, mobile applications, B2B marketplace, Disty AI, account management, WhatsApp and other communication channels, and related procurement and support services (together, the “Services”). It applies to visitors; business and retailer account holders and their authorised representatives; delivery recipients; prospective customers; and individual contacts at sellers, suppliers and other business partners.
Personal data means information that identifies an individual or allows an individual to be identified directly or indirectly. Information about a company is covered by this Policy to the extent that it also constitutes personal data, including information about sole proprietors and company representatives.
We process personal data in accordance with the Saudi Personal Data Protection Law, issued under Royal Decree No. M/19 and amended under Royal Decree No. M/148, its Implementing Regulation, the Regulation on Personal Data Transfer Outside the Kingdom, and other applicable Saudi laws (“Applicable Law”).
This Policy is a notice of our processing practices. It does not, by itself, constitute your consent to optional processing or waive any rights under Applicable Law. Where consent is required, we obtain it separately for the relevant purpose. A supplementary notice may provide more specific information for a particular feature, credit application, campaign or interaction.
The data collected depends on your relationship with Disty, the Services used and the choices you make. The categories below describe data that may be processed where relevant; they do not mean that every category is collected from every person.
Names, job titles, business contact details, mobile and WhatsApp numbers, email addresses, account identifiers, authentication and sign-in records, authorised-user roles, permissions, language and communication preferences, and business and delivery addresses. Verification records may include relevant information from commercial registrations, VAT certificates, National Address records and authorisation letters, and information needed to verify representatives or signatories. We copy official documents identifying individuals only where Applicable Law permits, including where required by law or requested by a competent public authority.
Requests for quotations, specifications, quotations, orders, invoices, credit notes, purchased products, negotiated arrangements, payment status, wallet transactions, discounts, promotional participation, wish lists, requested price or stock alerts, delivery instructions, returns, refunds and warranty claims. Payment records may include payment-method type, masked card details, payment tokens or references, and bank details supplied for transfers or refunds. Delivery records may include recipient details and appropriate proof of delivery, such as a delivery confirmation code, signature, stamp or photograph.
Where credit or deferred-payment arrangements are requested or used, relevant applications, financial statements, outstanding amounts, credit limits, repayment records and guarantor or signatory information may be processed. Personal credit data and credit-bureau information are subject to additional requirements described in Section 3. We distinguish a business’s financial information from personal data about an individual.
Enquiries, complaints, emails, support chats, account-manager correspondence, WhatsApp messages, feedback, surveys and call-related records. Where a call is recorded, we provide the required recording notice and obtain consent where required. Disty AI interactions may include prompts, voice messages, audio transcripts, images, uploaded documents, conversation history and related product or order context. Reviews or other content submitted for public display may include the name or attribution disclosed at submission.
IP addresses, browser and device characteristics, operating system and app versions, device and advertising identifiers, approximate location inferred from IP address, timestamps, referral sources, searches, product views, clicks, cart and checkout events, purchases, diagnostic information, crash reports and security logs. Marketing records may include campaign interactions, installation and conversion events, audience segments, consent records and suppression preferences. Where permitted, we may derive relevant purchasing preferences or likely interests from interactions with the Services.
We obtain information directly from you when you register, transact, communicate, upload content or use a feature; automatically through our systems and the technologies described in Section 4; and, where lawfully permitted, from your organisation or its account administrator, delivery recipients, marketplace sellers, carriers, payment and credit providers, licensed credit bureaus, official verification sources, publicly available business sources, and analytics or advertising partners. We may reconcile information from these sources for the specified purposes and subject to the applicable legal basis. Public availability does not remove the protections required by Applicable Law.
If you provide another person’s data, disclose only what is necessary, ensure you are entitled to provide it, and make this Policy available to that person. Your organisation’s permission does not replace an individual’s consent where that consent is legally required. We remain responsible for notices and other obligations that apply to our own processing.
Where we collect your data from another party, such as your organisation, a partner platform, a Seller or a carrier, we shall take the necessary steps to provide the required information, including the categories of data and their source, without undue delay and within 30 days of collection, unless a specific statutory exception applies. We shall document any exception on which we rely. Asking you or your organisation to make this Policy available does not discharge our own notification obligations.
Mandatory and optional information. For each form or feature, we shall identify the mandatory and optional information, the purpose for which it is requested and the consequences of not providing mandatory information. Depending on the activity, required information may include account and authority verification details, invoice information, and the recipient’s address and contact number necessary for delivery. The relevant activity may not be available without that information. Marketing choices, tracking permissions and optional inputs shall be presented separately; declining them shall not prevent use of unrelated core Services.
Sensitive information. The Services do not ordinarily require health information, religious beliefs, biometric identification data or other legally defined sensitive data. Do not submit such information unless specifically requested through an appropriate process. If processing is necessary, we first establish the applicable legal basis and safeguards, including explicit consent where required. Personal credit data has its own statutory protections and explicit-consent requirements.
We use personal data for the purposes below only where the applicable legal conditions are met. A reference to several grounds identifies grounds for different activities or circumstances; it does not allow us to disregard a requirement for consent.
We process relevant identity, account, transaction, payment and delivery data to establish and verify accounts and authority; manage users and permissions; source products; distribute RFQs to relevant sellers; prepare quotations; process orders and payments; maintain wallets; arrange delivery; and handle refunds, returns, warranty claims and support. We also send authentication codes, security notices, invoices, account notices and transaction updates.
Where processing implements an existing agreement to which the individual is a party, we rely on that agreement. Where an individual acts for a corporate customer and is not personally a party, we rely on a documented legitimate interest in administering that business relationship, or another applicable legal ground. We rely on legal requirements for mandatory verification, invoicing and recordkeeping.
We may analyse relevant usage, transaction and feedback data to evaluate demand; improve assortment, search, recommendations and procurement tools; test features; diagnose faults; measure performance; and develop products and operational processes. We may personalise navigation and product recommendations using relevant account activity and preferences.
We rely on documented legitimate interests for necessary, proportionate processing within reasonable expectations, where those interests do not prejudice individuals’ rights or interests. Processing for marketing or tracking that requires consent is conducted on that basis instead. We use anonymised or aggregated information where it can fulfil the purpose, and apply data minimisation to any identifiable information.
We process relevant records to authenticate users; detect fraud, account misuse, promotion abuse and suspicious payments; protect systems and people; investigate incidents; reconcile accounts; manage suppliers; conduct audits; comply with lawful authority requests; recover debts; and establish, exercise or defend legal claims. The grounds are applicable legal requirements and, where permitted, documented legitimate interests. These grounds do not remove special requirements for personal credit data, sensitive data or direct marketing.
Where available and requested, we may process relevant data to evaluate, arrange, administer and collect credit or deferred-payment facilities, including through appropriately authorised third parties. Processing of personal credit data requires the applicable explicit consent and compliance with the Credit Information Law and relevant Saudi Central Bank requirements. We provide required notices relating to credit-data disclosures. An organisation’s application does not automatically authorise access to an individual’s credit report or a guarantor’s data.
We may process the information you submit, together with relevant account, product and order context, to interpret requests, transcribe voice messages, identify products, prepare responses and assist with procurement and support. Relevant information may be processed by contracted AI and infrastructure providers. Depending on the activity and your relationship with Disty, the legal ground is implementation of an existing agreement, a documented legitimate interest in providing the requested assistance, or consent where required.
Interactions may be subject to limited review by authorised personnel or contracted providers for troubleshooting, safety and quality evaluation, to the extent necessary and lawful. Acceptance of this Policy or the general Terms does not authorise the use of personal or confidential content to train general-purpose models. Training or fine-tuning using interactions that permit identification shall take place only after the purpose and legal basis have been established, an appropriate separate notice provided, and consent obtained where required. We shall contractually require processors to comply with the approved instructions and restrictions. This Policy does not authorise them to reuse data for undisclosed independent purposes.
Automated rules or scoring may assist fraud detection, account checks and initial credit assessments. Before making a decision about an individual solely through automated processing of personal data, we provide the required information and obtain explicit consent where required. You may contact us to question an outcome and request review. Do not submit authentication codes, payment credentials, unnecessary identity documents or unrelated personal information in an AI conversation.
Consent is requested in a clear, specific and verifiable form, separately for each purpose where required. You may withdraw it using the relevant control or the contact details in Section 10. Withdrawal does not affect lawful processing before withdrawal or processing that continues on a separate, valid legal ground.
Before relying on legitimate interests, we assess and document necessity, reasonable expectations, effects on individuals and appropriate safeguards. We do not rely on legitimate interests to process sensitive data or to bypass a specific consent requirement. New purposes are assessed separately, with further notice and consent where required.
We may use cookies, pixels, local storage, software development kits (“SDKs”), device identifiers and server-side integrations to support the Services and the purposes described below.
Essential operation. Technologies necessary for authentication, security, cart operation, load balancing and remembering privacy choices are used on the legal ground applicable to those functions. A technology is not essential merely because it is commercially useful.
Preferences and analytics. Technologies may support saved settings, recently viewed products, usage measurement, feature evaluation and diagnostics. The applicable ground depends on the actual purpose, data and implementation. Where consent is required, the technology must remain inactive for that purpose until consent is obtained.
Advertising, audiences and attribution. With the required consent, we may measure advertising performance; associate ad interactions and app installations with registrations and purchases; personalise advertising on our own or third-party services; retarget interested users; create, match or exclude audiences; and improve campaign delivery. These activities may involve advertising identifiers, IP and device information, campaign events, product identifiers and relevant transaction values.
Server-side measurement may involve sending partners an email address or mobile number transformed using a hashing function to match records, measure conversions or manage audiences. Hashing is a pseudonymisation measure, not anonymisation: matched or otherwise identifiable records remain personal data. Server-side processing is subject to the same applicable consent and disclosure requirements as other tracking. Sensitive data, personal credit information and confidential negotiated commercial terms are not provided for advertising purposes.
The technology and consent notices available for the relevant Service shall identify the tools and providers actually used, the purpose of each tool, the categories of data processed, the duration of identifiers or the criteria determining it, the recipient’s capacity and the relevant processing locations. This information shall be updated when tools or purposes change. Some partners process data on our instructions, while others act as independent controllers for disclosed purposes under their own notices. A reference to a category of providers does not constitute consent to activate an undisclosed tool.
You may manage your choices through the privacy or consent controls presented for the relevant Service, browser and device settings, or by contacting us. Where processing is based on consent, we shall provide a withdrawal method that is no more difficult than giving consent and shall cease the processing concerned without undue delay. Device permissions, including Apple’s App Tracking Transparency, are additional controls and do not replace consent required under Saudi law. Browser settings alone may not stop server-side processing or remove data previously disclosed. Refusing optional tracking does not prevent use of unrelated core Services; blocking essential technologies may affect functionality.
Identifiers may last for a session or a longer period depending on purpose and provider. We limit their duration and related records to what is justified under Section 8. You may request information about relevant technologies, providers and retention.
Subject to the required consent, we may communicate offers, promotions, product news and relevant commercial opportunities through email, SMS, WhatsApp, telephone, push or web notifications, and other selected channels. We may use information collected directly from you to tailor marketing within your consent. Sensitive data is not used for marketing.
We record consent and identify Disty as the sender. Direct marketing is subject to the PDPL and applicable communications and anti-spam requirements; an existing customer relationship or acceptance of this Policy does not itself establish marketing consent.
You may unsubscribe without charge through the method provided with a communication, a relevant preference control, or info@disty.app. We stop the affected marketing without undue delay following withdrawal and maintain only the necessary suppression information to respect your choice. You do not need to close your account to stop marketing.
Necessary security, account, order, payment, delivery and legal notices may continue on their applicable non-marketing ground. A price, stock or product alert is assessed by its actual content and purpose. Requesting a specific alert does not enrol you in unrelated promotions; marketing alerts remain subject to marketing consent.
We disclose relevant personal data only for a specified lawful purpose and limit disclosure to what is necessary and permitted. We do not sell personal data as a standalone product. The following disclosures may occur:
Disclosure shall also comply with the specific provisions applicable to the transaction, including Article 5 of the E-Commerce Law where applicable. Where those provisions require consent to disclosure or a specific statutory basis, that requirement shall be satisfied before disclosure. A legitimate interest, membership of a corporate group or a proposed transaction is not, by itself, sufficient to override that requirement. Acceptance of the Terms does not replace the required consent.
Marketplace sellers, suppliers and service centres: relevant RFQ requirements, business and transaction details, delivery contacts and claim information to prepare quotations, fulfil orders, issue documents and administer returns, repairs and warranties. Receiving order information does not authorise a seller to add you to unrelated marketing lists.
Carriers, warehouses and fulfilment partners: recipient and contact details, delivery instructions, order and parcel details, tracking events and appropriate delivery confirmation information to fulfil deliveries, collect returns and investigate shipment claims.
Payment, banking and credit partners: information necessary for payments, reconciliation, refunds, risk checks and requested credit arrangements. Personal credit disclosures remain subject to the consents and controls in Section 3.
Technology and operational providers: information needed for hosting, storage, authentication, security, communications, customer support, analytics, AI processing and other contracted functions. Providers acting as processors are subject to appropriate written instructions, confidentiality, security and data-processing requirements, including controls for subprocessors.
Advertising and measurement partners: identifiers, permitted audience information and events for the purposes and subject to the choices in Sections 4 and 5.
Disty group entities: where relevant, entities within our corporate group supporting operations, systems, security, finance or administration, on the applicable lawful ground. Group affiliation does not remove disclosure or international-transfer requirements.
Professional advisers and authorised recipients: relevant information for legal, accounting, tax, audit, insurance, debt-recovery and dispute-related services, and disclosures made at your valid direction.
Authorities and parties to legal proceedings: information required by law, a binding order or a properly established statutory disclosure ground. Protection of Disty’s interests does not, by itself, authorise unrestricted disclosure.
Transaction counterparties: relevant information in connection with an actual or proposed investment, financing, merger, acquisition, restructuring, insolvency or transfer of business or assets, subject to a lawful disclosure ground, proportionate due diligence and appropriate confidentiality and access controls. A transaction does not remove existing data-protection obligations.
Organisation administrators: information appropriate to administer a business account, its authorised users, approvals, transactions and activity. Business-account activity may be accessible to your organisation according to roles and permissions.
Some recipients, including sellers, banks, credit bureaus and certain technology or advertising partners, may act as independent controllers for their own disclosed purposes. Their notices apply to that processing. This does not reduce Disty’s responsibility for its own collection and disclosure. Third-party links and independently operated services should be reviewed before you provide information to them.
Personal data may be stored in electronic systems and, where relevant, physical records. Access by a provider or personnel outside Saudi Arabia may constitute an international transfer even where the primary system is hosted in the Kingdom.
We may use overseas infrastructure, group support, communications, analytics, advertising and AI providers only where the transfer or disclosure complies with Article 29 of the PDPL, the applicable transfer regulation and any additional sector-specific or localisation requirements.
Before a transfer, we establish a permitted purpose and transfer route. Depending on the circumstances, this may involve a recognised adequate level of protection, an applicable safeguard or exemption satisfying its specific conditions, or another route expressly permitted by Applicable Law. Relevant safeguards may include SDAIA standard contractual clauses, binding common rules or an authorised accreditation mechanism, where available and applicable. A contract or your acceptance of this Policy alone does not establish that every transfer is permitted.
We shall apply the required data-minimisation, security, onward-transfer and risk-assessment measures before transfer where required. Additional restrictions concerning personal credit data and specially regulated records remain applicable. The hosting and provider notice associated with the Service shall identify the countries or regions in which data is actually stored or processed, including relevant support and remote-access locations, the categories of recipients, the purpose of transfer, and the applicable safeguard or lawful transfer route. Further information may be requested using the contact details in Section 10, subject to lawful confidentiality and security restrictions. Required disclosure shall not be limited to information available on request where it must be provided at collection.
We retain identifiable personal data for the period justified by its purpose and any applicable legal obligation. We determine that period by considering the nature of the record, the activity involved, account status, unresolved obligations, applicable accounting and tax rules, warranty and claim periods, security risks, and the establishment or defence of legal claims.
Account and verification records shall be retained during the relationship to the extent necessary to administer the account and permissions. Upon account closure or termination of an authorisation, we shall review the data, delete what is no longer necessary and retain only information supported by a statutory obligation or a specific, documented lawful purpose. Transaction, invoice and accounting records shall be retained for the period required for each record under the applicable tax and accounting requirements. This does not justify retaining all account or tracking data for the same period.
The retention period for a credit file shall be linked to the facility, repayment, dispute and applicable statutory requirements. For support correspondence, call records and AI interactions, retention shall be linked to closure of the request or conversation and the specific follow-up, quality or security need, followed by deletion or anonymisation unless a separate lawful ground for retention exists. Separate periods shall be established for conversation content, uploaded files and technical logs held by Disty and its providers. Removing a visible conversation does not necessarily immediately delete a separate transaction record, evidence subject to a lawful preservation requirement or all backup copies.
Analytics, advertising and security retention periods shall be determined by purpose, necessity, risk and the applicable consent, with separate periods for identifiers and their associated events and records. The retention notice associated with the Service shall specify the approved period for each category, or the criteria used to determine it where a fixed period cannot be specified, and the event from which that period runs. Consent and marketing-suppression records shall be retained only to the proportionate extent necessary to demonstrate and respect choices. Suppression records shall not be used to send new offers. Provider settings or a possible future benefit do not justify indefinite retention.
When a retention ground ends, we securely destroy personal data or irreversibly anonymise it. Use of data subject to a lawful preservation requirement is restricted to the relevant purpose. Residual backup copies are protected and removed through the applicable deletion cycle, subject to lawful retention requirements; if restored, applicable deletion instructions are reapplied.
We may use and disclose genuinely anonymised statistics and business insights for research, planning, benchmarking and service development without an identification-based retention limit. Data that can reasonably be linked back to a person, including merely hashed or pseudonymised data, remains subject to this Policy and Applicable Law.
We apply appropriate organisational, administrative and technical safeguards proportionate to the nature of the data and processing risks. Relevant measures include access restrictions, authentication controls, confidentiality requirements, protected transmission and storage where appropriate, monitoring, provider oversight and incident-response procedures.
Payment processing is subject to the security and regulatory requirements applicable to the relevant service and provider. Do not send card security codes, full payment credentials or sign-in codes through support chats, WhatsApp or Disty AI.
No transmission or storage system can provide absolute security. This does not exclude any responsibility imposed on Disty by Applicable Law. If a personal data breach meets the statutory notification conditions, we notify the competent authority within the prescribed period, including within 72 hours of awareness where applicable, and notify affected individuals without undue delay where required.
Protect your devices and authentication codes, maintain accurate user permissions, remove access that is no longer authorised and report suspected misuse promptly using the contact details below.
Subject to Applicable Law, you may request information about the legal basis and purposes of processing; access to your personal data; a copy in a clear and readable format; correction, completion or updating; and destruction in the circumstances provided by law. You may withdraw consent for consent-based processing and submit a privacy complaint.
Send requests to info@disty.app or contact 920027744. Please describe the request and the relevant relationship or account without sending unnecessary identity documents. We may take proportionate steps to verify identity and authority and protect other individuals’ information. You may contact us directly even where your organisation administers the account.
If Disty appoints a personal data protection officer, clear and accessible contact details shall be provided in the published privacy information and updated when they change. The address info@disty.app remains a channel for receiving privacy requests and directing them to the responsible person. Merely stating that address does not announce the appointment of a data protection officer or confirm that the appointment requirements have been satisfied.
We act on rights requests without undue delay and within 30 days. Where the statutory conditions for an extension are met, we may extend by up to a further 30 days and notify you in advance, explaining the reason. Exercising these rights is free of charge.
Rights are subject to statutory conditions and exceptions. For example, a destruction request may not require removal of records that must lawfully be retained, and access must protect others’ rights and confidential information. We explain a restriction, refusal or available alternative to the extent permitted by law. Repetitive, manifestly unfounded or disproportionate requests are handled only as Applicable Law permits.
Withdrawal of consent does not cancel outstanding payment obligations or prevent necessary processing on another lawful ground. We explain where withdrawal means a directly related optional feature can no longer be provided. Changes to your role or departure from a company do not automatically require destruction of its legally retained transaction records.
You may raise a concern with us or complain directly to the competent authority, currently the Saudi Data and Artificial Intelligence Authority (“SDAIA”), through its official personal data protection channels at dgp.sdaia.gov.sa. Contacting Disty first is not a condition for exercising a statutory complaint right. Nothing in this Policy limits any right to a remedy or compensation available under Applicable Law.
The Services are primarily intended for professional use by adults authorised to act for their organisations. Where a purchasing programme for individuals or employees is made available, or an Order is fulfilled through a partner platform, this Policy applies to our processing of those purchasers’ and recipients’ data, together with an appropriate supplementary notice identifying the parties’ roles. The Services are not directed at persons under 18. If you believe that a child has provided personal data, please contact us. We shall assess the circumstances and take appropriate action, including destruction or obtaining valid guardian authorisation where legally applicable.
We may update this Policy to reflect changes in the Services, processing practices or Applicable Law. The revision date appears above. We provide additional notice where required and, before processing for a new purpose, provide the applicable information and obtain fresh consent where required. Continued use does not replace consent that must be obtained separately.
Where matching Arabic and English versions of this Policy are published, the Arabic version prevails in the event of inconsistency, subject always to mandatory Saudi law. Language precedence does not expand processing permissions or reduce statutory protections.
Privacy enquiries and rights requests: info@disty.app
General support: info@disty.app | 920027744
Controller: Disty Company for Marketing (شركة دستي للتسويق), CR 1009005133
Postal address: Building 7027, Al Olaya Street, Al Olaya District, Secondary No. 2455, Riyadh 12244, Kingdom of Saudi Arabia.