This Privacy Policy explains how Disty Company for Marketing (شركة دستي للتسويق), Commercial Registration Number 1009005133 and VAT Registration Number 312200046700003 (“Disty,” “we,” “us,” or “our”), collects, uses, discloses, stores, and protects Personal Data through the Disty website, mobile application, and related services, collectively referred to as the “Platform.”

This Policy applies to individuals whose Personal Data is processed in connection with a business or organization using the Platform, including account holders, authorized users, representatives, employees, delivery recipients, supplier and seller contacts, and persons who contact Disty.

1. Personal Data we collect

We may collect the following categories of Personal Data:

a. Identity and contact data, including name, job title, email address, mobile number, telephone number, and business contact details.

b. Business registration and verification data, including information contained in Commercial Registration documents, VAT certificates, authorizations, identification documents, and records used to verify the Customer or its representatives.

c. Account data, including login details, account status, user permissions, company affiliation, preferences, and account activity.

d. Transaction data, including quotations, Orders, products, quantities, prices, invoices, delivery details, payment status, returns, refunds, warranty claims, Wallet activity, and communications relating to a transaction.

e. Payment and financial data, including payment method, bank-account details supplied for refunds, transaction references, payment confirmations, and limited payment-card information received from payment providers.

f. Credit data, including credit applications, limits, balances, payment terms, outstanding amounts, supporting documents, and information exchanged with the relevant credit provider.

g. Technical and usage data, including IP address, device type, operating system, browser, app version, device identifiers, mobile advertising identifiers, installation identifiers, language, approximate location derived from IP, access times, pages or screens viewed, clicks, errors, and security logs.

h. Mobile attribution and analytics data, including referral source, campaign source, deep-link activity, install and re-install events, first-open events, sessions, in-app events, conversion events, app interactions, advertising impressions, advertising clicks, and information used to measure campaign performance or detect fraud.

i. Marketing data, including communication preferences, campaign interactions, retargeting or audience data, and information concerning responses to advertisements or promotional messages.

j. Notification data, including app notification tokens and notification preferences where push notifications are enabled.

k. Contact, account, and transaction data that may be shared with analytics, attribution, advertising, or retargeting platforms, including email address, mobile number, customer ID, Order or purchase data, where permitted by law and the applicable consent status.

2. How we collect Personal Data

We collect Personal Data:

a. directly from the individual, the Customer, or an authorized representative;

b. when an account is registered, verified, updated, or used;

c. when an Order, quotation request, payment, return, refund, warranty claim, or complaint is submitted;

d. automatically through the Platform, cookies, software development kits, device tools, logs, and similar technologies;

e. from Marketplace Sellers, payment providers, banks, financing providers, delivery companies, service centers, and other parties involved in a transaction; and

f. from analytics, attribution, advertising, marketing, and referral partners where a lawful basis exists.

3. Purposes of processing

We process Personal Data for the following purposes:

a. registering, verifying, approving, administering, suspending, or closing accounts;

b. processing quotations, Orders, payments, deliveries, returns, refunds, warranties, Wallet transactions, and marketplace transactions;

c. assessing, administering, and enforcing Credit Facilities;

d. preventing fraud, misuse, unauthorized transactions, payment disputes, security incidents, and promotional abuse;

e. operating, securing, testing, maintaining, and improving the Platform;

f. measuring Platform use, mobile-app use, campaign performance, advertising performance, attribution results, and service quality;

g. attributing app installations, registrations, Orders, and other events to advertising campaigns or referral sources;

h. building, measuring, or excluding advertising audiences and conducting retargeting, where permitted;

i. sending service messages and, where permitted, marketing messages;

j. complying with legal, regulatory, tax, accounting, audit, and law-enforcement requirements; and

k. establishing, exercising, or defending legal claims.

4. Legal bases

Disty processes Personal Data on one or more of the following legal bases, as applicable:

a. the individual’s consent;

b. the performance of a contract or steps taken before entering into a contract;

c. compliance with a legal or regulatory obligation;

d. the achievement of Disty’s legitimate interests, where permitted by the Saudi Personal Data Protection Law and without prejudicing the rights and interests of the individual; and

e. any other basis permitted under applicable law.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing completed before withdrawal and may not prevent processing required under another lawful basis.

5. Mobile analytics, attribution, advertising, and retargeting

Disty may use analytics, attribution, advertising, retargeting, and similar technologies within the Platform and mobile application.

These technologies may collect or receive device data, advertising identifiers, app-install information, referral information, deep-link information, app interactions, conversion events, Order or purchase events, and contact or account data such as email address, mobile number, customer ID, or other identifiers, where permitted.

This data may be used to attribute app installations and transactions to advertising campaigns, measure performance, create or exclude advertising audiences, retarget users, personalize communications, and detect fraudulent or invalid traffic or conversions.

Where required by law or platform rules, Disty will request the relevant tracking, marketing, or advertising consent before enabling the relevant processing.

6. Marketplace transactions

For a Marketplace Product, Disty may disclose Personal Data to the relevant Marketplace Seller as necessary to process and fulfil the transaction, issue the invoice, deliver the Product, handle support, and process a return, refund, or warranty claim.

A Marketplace Seller may act as an independent controller of Personal Data that it receives for its own legal and commercial obligations.

7. Payments and Credit Facilities

Payments may be processed by banks, payment gateways, SADAD-related providers, or other authorized payment service providers.

Where a Credit Facility is provided by a bank, Marketplace Seller, financing provider, or another third party, Disty may share application, identity, transaction, payment, and account information with that provider.

8. Cookies, SDKs, and similar technologies

The Platform may use cookies, local storage, software development kits (SDKs), device identifiers, analytics tools, advertising technologies, and similar technologies to:

a. keep the Platform operating and secure;

b. remember settings and sessions;

c. measure usage, installs, and performance;

d. attribute registrations, Orders, and other events to marketing campaigns;

e. support advertising, retargeting, or personalization where permitted; and

f. identify errors, abuse, and fraud.

Where required, Disty will obtain consent before using non-essential tracking or advertising technologies.

9. Disclosure of Personal Data

Disty may disclose Personal Data to:

a. Marketplace Sellers and suppliers involved in the relevant transaction;

b. payment providers, banks, SADAD-related providers, and financing or credit providers;

c. warehouses, delivery companies, service centers, manufacturers, and warranty providers;

d. analytics providers, mobile attribution platforms, advertising networks, social-media advertising platforms, marketing service providers, and retargeting partners;

e. cloud-hosting, information-technology, cybersecurity, communications, customer-support, and professional-service providers;

f. government authorities, courts, regulators, tax authorities, or law-enforcement bodies where required or permitted by law; and

g. an actual or prospective purchaser, investor, successor, affiliate, or restructuring party, subject to appropriate confidentiality and legal controls.

Disty does not sell Personal Data.

10. International transfers

Some service providers or recipients may process Personal Data outside the Kingdom of Saudi Arabia.

Any transfer or disclosure outside the Kingdom will be carried out in accordance with the Saudi Personal Data Protection Law and the regulations governing international transfers.

11. Retention and destruction

Disty retains Personal Data only for as long as required for the purpose for which it was collected or for a legal, regulatory, tax, accounting, security, fraud-prevention, credit, warranty, dispute, or enforcement requirement.

When Personal Data is no longer required, it will be securely destroyed, deleted, or anonymized unless continued retention is required or permitted by law.

12. Data security

Disty applies administrative, organizational, and technical safeguards appropriate to the nature of the Personal Data and the risks of processing.

No system is completely secure. Individuals and Customers must protect account credentials and promptly report suspected unauthorized access.

13. Personal Data rights

Subject to the Saudi Personal Data Protection Law and its implementing regulations, an individual may have the right to:

a. be informed of the legal basis and purpose for collecting Personal Data;

b. access Personal Data held by Disty;

c. obtain a copy of Personal Data in a clear and readable format, where applicable;

d. request correction, completion, or updating of inaccurate Personal Data;

e. request destruction of Personal Data where the legal conditions are met;

f. withdraw consent where processing is based on consent; and

g. submit a complaint concerning the processing of Personal Data.

A request may be submitted to info@disty.app.

14. Changes to this Policy

Disty may update this Policy to reflect changes in the Platform, processing activities, or legal requirements.

15. Contact and complaints

Legal entity: Disty Company for Marketing (شركة دستي للتسويق)

Commercial Registration: 1009005133

VAT Registration Number: 312200046700003

Registered Address: Building 6581, Al Nahda Road, Ar Rabwah District, Additional No. 2791, Postal Code 12823, Riyadh, Kingdom of Saudi Arabia

Privacy and Legal Email: info@disty.app

Telephone: 920027744