Privacy Policy
Version 2.0 — Last updated 18 August 2026. Mandatory Saudi law and any non-waivable customer rights prevail over conflicting contractual language.
This policy describes how SBCMI Store processes personal data for digital enterprise commerce. It is structured around the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations and applicable rules for transfers outside the Kingdom.
Controller
The data controller is the seller identified in the Business Information section of SBCMI Store. The applicable privacy contact channel is the contact published by SBCMI Store for privacy requests.
Personal data we collect
Depending on the transaction, the store may process business contact details, name and job contact information, legal-entity information, billing and national-address information, tax/VAT identifiers, order and invoice records, payment references (not raw card number or CVV), IP address, device/browser information, security logs, support communications, license records and evidence of legal acknowledgements.
Sources
Data is collected directly from the customer or its authorized users, generated through use of the store, received from payment/fraud providers, or obtained from lawful business-verification sources where necessary.
Purposes and legal bases
Processing is limited to defined purposes such as concluding and performing contracts, verifying business customers, processing and reconciling payments, issuing invoices, provisioning licenses, providing support, preventing fraud, protecting systems, complying with legal obligations, handling disputes and maintaining required transaction records. Optional marketing is not bundled into checkout consent and requires its own lawful basis or consent where applicable.
Data minimization
Only personal data reasonably necessary for the stated purpose should be requested. Sensitive or credit data is not intentionally collected through ordinary storefront fields unless a separately approved process and appropriate legal basis are implemented.
Disclosure and processors
Personal data may be disclosed to contracted payment providers, banking/settlement providers, hosting and infrastructure providers, invoicing/tax technology providers, professional advisers, auditors and competent authorities where necessary and lawful. Processors must be subject to appropriate contractual, confidentiality and security obligations. Personal data is not sold to advertisers.
International transfers
If a processor or recipient is outside the Kingdom, the transfer must be assessed and implemented under the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom. Appropriate safeguards may include an adequacy basis, approved exemptions, standard contractual clauses, transfer-risk controls or other measures required by the competent authority.
Retention
Order, contract, payment, invoice, tax and accounting records are retained for the statutory or contractual period applicable to the transaction and any dispute/audit period. Support records are retained only as long as needed for service history, security and contractual requirements. Security logs and incomplete-checkout data follow an approved retention schedule and are deleted or anonymized when no longer necessary, subject to legal hold or mandatory retention.
Security
SBCMI applies organizational, administrative and technical safeguards appropriate to the risk, including access control, restricted administrative sessions, encryption in transit, secure credential handling, logging, backup/recovery controls and incident procedures. Raw payment-card numbers and CVV data are not intended to be stored by this application.
Personal-data incidents
Personal-data incidents are assessed under the PDPL Implementing Regulations. Where the regulatory threshold is met, the competent authority is notified within the legally required period and affected data subjects are notified where required.
Your rights
Subject to statutory conditions and exceptions, data subjects may have rights to be informed, access personal data, obtain a copy in an appropriate format, request correction/completion/update, request destruction when legally available, and withdraw consent where consent is the processing basis. Requests to exercise applicable data-subject rights may be submitted through the privacy contact channel published by SBCMI Store.
Cookies, local storage and analytics
The storefront may use strictly necessary browser storage for cart/session functionality. Non-essential analytics, advertising or behavioral tracking must not be enabled without the required notice and consent mechanism where consent is required.
Complaints
Privacy requests and complaints should first be sent to the published privacy contact. This does not restrict any right to complain to the competent Saudi data-protection authority in accordance with applicable procedures.