How we handle your establishment’s data

1. Introduction and scope

Industrial Technologies Co. Ltd. (referred to below as “the Company” or “we”) is a Saudi company specialising in the trading, distribution and import of industrial machinery and workshop service equipment, operating on a business-to-business (B2B) model. We are committed to protecting the personal data we collect through our website and our associated communication channels, in accordance with the Personal Data Protection Law in force in the Kingdom of Saudi Arabia and its implementing regulations (together, “the Law”).

This policy explains:

• The types of data we collect about our business customers, their representatives and site visitors.
• The purposes for which we use the data and the legal basis for processing it.
• When data is disclosed to third parties and the controls that apply.
• The rights of data subjects and how to exercise them.
• The technical and organisational safeguards we apply.

This policy applies to: all visitors to the website; current and prospective customers among commercial establishments; the authorised representatives of those establishments (maintenance managers, procurement managers, engineers, owners); suppliers and contractors; and anyone who contacts us through the website forms, by email or by telephone.

2. The data we collect

2.1 Data you provide to us directly

When you complete the request-for-quotation form or the contact form, or when you correspond with us by email, we may collect:

• Professional identity data: full name, job title, and the name of the establishment you represent.
• Contact data: email address, mobile number, landline number, and the postal address of the establishment.
• Establishment data: company name, commercial registration number, tax certificate number (VAT number), type of activity and sector, city and region.
• Commercial enquiry details: the type of equipment required (such as paint booths, vehicle lifts, chassis pullers and others), technical specifications, quantities, the delivery location, and any documents you attach to your request.
• Correspondence data: the content of your messages and enquiries, and the record of your contact with the sales or technical support team.

2.2 Data collected automatically when you use the website

When you visit our website, our systems and analytics tools may automatically collect:

• Technical data: Internet Protocol (IP) address, browser type and version, operating system, screen resolution, preferred language.
• Usage data: pages visited, session duration, navigation paths within the site, the page that referred you to us, and the dates and times of visits.
• Cookie identifiers: as detailed in section (6) of this policy.

2.3 Data we obtain from other sources

• Publicly available commercial registry data, used to verify the details of the establishments we deal with.
• Data provided by our commercial partners (such as shipping companies or agents) to the extent necessary to fulfil your order.

3. Purposes of processing and legal basis

We process your data for the following purposes, on the legal bases stated:

3.1 Carrying out commercial transactions and processing orders

• Receiving requests for quotation and reviewing them technically and commercially.
• Preparing quotations and issuing sales orders and tax invoices.
• Verifying establishment and commercial registration details before entering into a contract.
• Communicating about order status, supply scheduling, installation and commissioning.
• Legal basis: performance of a contract or taking steps at your request prior to contracting, and the Company’s legitimate interest in managing its commercial relationships.

3.2 Meeting statutory and accounting obligations

• Retaining invoices and commercial documents in line with the applicable accounting and tax requirements.
• Responding to lawful requests from the competent authorities where required.
• Legal basis: compliance with an applicable statutory provision.

3.3 After-sales service and technical support

• Managing warranty claims, maintenance and spare-part requests, and scheduling technical visits.
• Legal basis: performance of the contract and legitimate interest.

3.4 Improving the website and the user experience

• Analysing website usage patterns to improve content, page structure and performance.
• Improving the website’s visibility in search engines and measuring the effectiveness of marketing content.
• Developing the services and products offered based on the interests of visitors and customers.
• Legal basis: the Company’s legitimate interest, provided it does not override your fundamental rights and freedoms; you may object to this processing as set out in section (8).

3.5 Direct marketing communications

• Sending offers and introductory bulletins about our products and services to our current and prospective business customers.
• Legal basis: your consent, or our legitimate interest in direct marketing within the limits of the Law; you may stop these messages at any time.

4. Sharing and disclosure of data

We never sell or rent your personal data to any third party. We may disclose your data to the following categories, and only to the extent necessary to achieve the purposes set out above:

4.1 Service providers and contractors (processors)

• Shipping, transport and customs clearance companies: to deliver imported or supplied equipment to your site.
• Installation, commissioning and maintenance contractors: to carry out configuration and installation work at your site.
• Technical service providers: website hosting, content management systems and their extensions, email services, and customer relationship management systems.
• Professional service providers: chartered accountants and advisers where needed.

All of these parties are bound by contractual obligations requiring them to protect the data and to use it only in accordance with our instructions and for the specified purposes.

4.2 Regulatory and judicial authorities

We may disclose data where there is a statutory obligation, in response to a court order or a lawful request from a competent authority, or to protect our legal rights or establish our defence in an actual or potential dispute.

4.3 Affiliated companies and business successors

In the event of a merger, acquisition or transfer of the business in whole or in part, data may pass to the successor entity within the limits permitted by the Law, and you will be notified.

4.4 Cross-border transfers

Supplying equipment from factories outside the Kingdom may require the exchange of limited data with international suppliers (such as the name of the receiving establishment and delivery details). Some technical tools (such as hosting or analytics services) may also operate on servers outside the Kingdom. In all such cases we comply with the provisions on transferring personal data outside the Kingdom set out in the Law and its implementing regulations, and we transfer data only to the extent necessary and with appropriate safeguards in place.

5. Data retention

• We retain your data for the duration of the commercial relationship with your establishment, and for as long as is necessary to achieve the purposes set out in this policy.
• Commercial documents and invoices are retained for the statutory periods required under the applicable accounting and tax rules.
• Analytics data and cookies are retained for limited periods proportionate to their purposes.
• Once the purpose or the statutory period ends, we securely dispose of the data or convert it into anonymised data that does not identify its subject.

6. Cookies

Our website uses cookies to improve the browsing experience and measure performance. Cookies are small text files stored on your device when you visit the site.

• Essential cookies operate automatically because the site cannot function without them.
• You can control or delete non-essential cookies at any time from your browser settings, noting that disabling some of them may affect certain site functions.

7. Data security

We apply appropriate technical and organisational measures to protect your data from loss, unauthorised access, alteration or disclosure. These include:

• Restricting access to data to employees and authorised persons, to the extent necessary to perform their duties.
• Using secure encryption protocols (HTTPS) across the website.
• Continuously updating the website systems and their extensions to close security vulnerabilities.
• Contractual confidentiality obligations on everyone who handles the data, whether our personnel or our service providers.

In the event of a data breach or leak that may harm your interests or conflict with your rights and freedoms, we will take the statutory steps required, including notifying the competent authority and the affected data subjects as the Law requires.

8. Your rights as a data subject

The Law grants you the following rights, which you may exercise by contacting us at info@intech-ksa.com:

• The right to be informed: to know how your data is collected and processed — which is what this policy sets out.
• The right of access: to request access to the personal data we hold about you and to obtain a copy of it.
• The right to request correction, completion or updating: to request the correction of inaccurate data, the completion of incomplete data, or its updating.
• The right to request destruction (erasure): to request the destruction of your data once it is no longer necessary for the purpose for which it was collected, unless retention is required by a statutory provision or is necessary to bring or defend a legal claim.
• The right to withdraw consent: where processing is based on your consent (such as marketing communications), you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
• The right to object: to object to processing based on legitimate interest (such as analytics); we will cease that processing unless we have compelling statutory grounds.

How requests are handled: we respond to your requests within the statutory periods, and we may ask you for proof of your identity or of your capacity as an authorised representative of the establishment before acting on the request. You also have the right to lodge a complaint with the competent personal data protection authority in the Kingdom if you believe our processing of your data breaches the Law.

9. Minors’ data

Our website and services are directed at commercial establishments rather than individuals, and we do not target the collection of data from anyone under eighteen years of age. If we become aware that we have collected a minor’s data without a lawful basis, we will move to destroy it.

10. External links

The website may contain links to third-party websites (such as manufacturers’ sites or technical references). This policy does not apply to those sites, and we encourage you to review their own privacy policies before providing them with any data.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in statutory requirements. We will publish the updated version on this page together with the date of the last update, and we encourage you to review it periodically. Your continued use of the website after amendments are published constitutes notice of the updated version.

12. Privacy contact

For any enquiry about this policy, or to exercise any of your statutory rights:

• Email: info@intech-ksa.com
• Address: Industrial Technologies Co. Ltd. — Riyadh, Kingdom of Saudi Arabia
• Website: intech-ksa.com

The Terms & Conditions published on this website are complementary to this policy.