1. Controller, Processor and Scope
This Privacy Policy describes how ARAMA Logistics (legal name supplied: مؤسسة أراما للخدمات اللوجستية), Commercial Registration No. 1010881702, located in Riyadh, Al Marwah District, Matawi Street, Saudi Arabia, handles personal data in connection with its website, logistics services and technical integrations, including Salla. Privacy inquiries: [email protected]. Depending on the processing activity, ARAMA may act as a controller for its direct business relationships or as a processor acting on behalf of a merchant.
2. Categories of Personal Data
Depending on the service, data may include merchant and representative names, contact details and account information; recipient names, delivery addresses and phone numbers; order numbers, order contents, products, shipment and tracking details, returns and inventory records; support communications; and technical identifiers and logs required for operation and security. We seek to limit collection to what is necessary.
3. Sources of Data
We may receive data directly from merchants and users, from connected online stores after relevant permissions are granted, from delivery and service partners, or automatically through use of the website or system, subject to applicable requirements.
4. Purposes of Processing
We process data to create accounts, manage commercial relationships, receive and fulfill orders, pick and pack products, manage inventory, generate shipping labels, arrange delivery and tracking, handle returns, provide support, issue invoices, secure systems, meet legal obligations and improve service quality where lawful.
5. Legal Bases
Processing relies on the applicable lawful basis for each purpose under Saudi Arabia’s Personal Data Protection Law, which may include contractual necessity, legal obligations, legitimate interests where the statutory conditions are met, or consent where required. Consent is not assumed to be the basis for every processing activity.
6. Salla and Other Integrations
When a merchant connects Salla to ARAMA, we process information made available through the authorized integration and needed to deliver agreed services, potentially including orders, products, customers and shipment information. Actual access depends on granted technical permissions. Merchants may request disconnection through available platform settings or support. Certain records may be retained where a lawful obligation or basis applies.
7. Technology Service Provider
ARAMA uses the LOGESTECHS platform supplied by شركة منصة الشامل للاتصالات وتقنية المعلومات to operate logistics services. Its SaaS agreement addresses confidentiality, ownership of ARAMA’s stored data and arrangements for data export and deletion upon termination, subject to contractual conditions. This policy does not represent that the SaaS agreement alone satisfies all personal-data processing requirements; roles and safeguards remain subject to the relevant agreements.
8. Data Sharing
We may share necessary data with carriers, delivery partners, technology, hosting and support providers, connected platforms, and competent authorities where legally required. The LOGESTECHS agreement refers to limited technical information sharing with mapping and notification providers. We do not sell personal data. Sharing must be limited to lawful purposes and appropriate safeguards.
9. Hosting and International Transfers
The hosting country for LOGESTECHS databases and backups, and the locations from which technical support may access data, have not yet been confirmed. Before final approval of this policy, ARAMA will verify processing locations and any international transfers or remote access and apply relevant legal requirements. This draft does not claim that all data is hosted in Saudi Arabia.
10. Retention and Deletion
ARAMA retains data for as long as necessary for processing purposes and applicable legal or contractual obligations, then deletes or otherwise handles it in accordance with applicable law. Category-specific retention periods are pending approval. The LOGESTECHS agreement provides for export and deletion of ARAMA data within up to 30 business days following termination, subject to its contractual terms and exceptions. This does not establish a 30-day retention period for all customer data during service delivery.
11. Information Security
ARAMA seeks to implement appropriate organizational and technical measures to protect personal data against unauthorized access, loss, alteration and disclosure, including access governance and review of service-provider controls. No system can be guaranteed completely secure. Specific controls operated by the platform provider remain subject to documented confirmation.
12. Data Subject Rights
Subject to applicable legal conditions and exceptions, individuals may have rights to be informed, access and obtain a copy of their data, request correction or updating, request destruction where applicable, withdraw consent where consent is the legal basis, and lodge a complaint with the competent authority. Requests may be sent to [email protected]. Where ARAMA processes data on a merchant’s behalf, requests may be referred to or coordinated with that merchant.
13. Cookies and Technical Logs
The website or system may use cookies and technical logs necessary for operation, authentication, security and performance. Any nonessential analytics or tracking tools must be verified and accompanied by appropriate notices and choices where required.
14. Data Incidents
ARAMA takes appropriate steps to address and assess data incidents, coordinate with service providers and make legally required notifications when applicable thresholds are met. A documented internal incident-response and escalation procedure is being finalized.
15. Changes to this Policy
ARAMA may update this policy when services, processing practices or legal requirements change. An updated version will be published on the website, with the last-updated date added upon approval.
16. Contact and Approval
ARAMA Logistics — Commercial Registration No. 1010881702 — Riyadh, Al Marwah District, Matawi Street, Saudi Arabia — Email: [email protected] — Website: https://arama.sa. Effective date: to be set upon approval.