Privacy Policy

1. Introduction

DeepParts.sa (“Deep Parts,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your Personal Data.

This Privacy Policy explains how we collect, use, store, disclose, transfer, and protect Personal Data when you:

visit or use the DeepParts.sa website or mobile applications;
register or manage a business Account;
purchase Products or use our marketplace services;
communicate with our customer service team;
interact with Suppliers, delivery providers, payment providers, or other partners through our Platform; or
otherwise interact with Deep Parts.

For the purposes of this Privacy Policy, “Platform” means the DeepParts.sa website, applications, and related digital services, and “Personal Data” means information that identifies an individual directly or indirectly.

Deep Parts processes Personal Data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Saudi Personal Data Protection Law (“PDPL”) and its Implementing Regulations.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, and any additional privacy notice presented when Personal Data is collected.

2. Data Controller

The controller responsible for determining how and why your Personal Data is processed is:

Legal entity name: [Insert registered legal entity name]

Trading name: DeepParts.sa

Commercial Registration No.: [Insert CR number]

Registered address: [Insert registered address]

Website: DeepParts.sa

Email: info@deepparts.sa

Telephone: [Insert telephone number]

Data Protection Officer or privacy contact, if applicable:

[Insert name or department]

[Insert dedicated privacy email address]

3. Scope of This Privacy Policy

This Privacy Policy applies to Personal Data relating to:

Customers and prospective Customers;
Account administrators and authorized Account users;
representatives and employees of Customers;
Suppliers, distributors, wholesalers, and their representatives;
delivery recipients;
website and application visitors;
individuals contacting our customer service team; and
other individuals whose Personal Data is provided to us in connection with our services.

As Deep Parts primarily operates as a B2B platform, some information we process relates to companies rather than individuals. However, this Privacy Policy applies whenever business information identifies or can reasonably be linked to an individual.

4. Personal Data We Collect

The Personal Data we collect depends on how you interact with Deep Parts and which services you use.

4.1 Identity and Contact Information

We may collect:

full name;
job title and department;
business or company name;
email address;
mobile and telephone numbers;
billing, delivery, and business addresses;
national identification, residency, or authorization information where legally required;
signature; and
other information used to identify or verify you as an authorized business representative.

4.2 Account Information

When you create or use an Account, we may collect:

username and Account identifier;
registered email address and mobile number;
encrypted or securely stored authentication credentials;
verification codes and authentication records;
Account roles and permissions;
communication and language preferences;
login and Account activity; and
information used to verify the Account or its authorized users.

We do not ask you to provide your Account password to our customer service representatives.

4.3 Business Information

We may collect:

company registration information;
Commercial Registration number;
VAT registration information;
company address and business activity;
licenses, permits, or authorization documents;
authorized representative details;
purchasing and approval authority;
Supplier, wholesaler, or distributor information; and
information required for business verification and compliance purposes.

4.4 Order and Transaction Information

We may collect:

Products viewed, selected, or purchased;
quotations and purchase orders;
Order numbers and transaction history;
quantities, prices, discounts, taxes, and fees;
invoices and credit notes;
returns, exchanges, refunds, and cancellations;
Account Balance and top-up transaction records;
Supplier and distributor interactions;
delivery, collection, and fulfillment records;
complaint and warranty information; and
communications relating to Orders.

4.5 Product and Vehicle Information

Where necessary to identify or verify the correct Product, we may collect:

vehicle make, model, and year;
vehicle identification or chassis number;
engine, equipment, or technical specifications;
part numbers and manufacturer references;
photographs of Products, parts, vehicles, packaging, or damage; and
other compatibility information you provide.

You should avoid including unnecessary Personal Data in photographs or documents submitted for Product verification.

4.6 Payment and Financial Information

Depending on the selected payment method, we may collect:

payment method;
bank transfer reference;
payment status and transaction identifier;
proof of payment;
Account Balance and top-up records;
billing details;
refund information; and
limited payment information received from banks or payment service providers.

Payment card information may be collected and processed directly by authorized third-party payment providers. Deep Parts may not receive or store full payment card numbers or security codes.

4.7 Credit and Financing Information

If Deep Parts makes financing, deferred payment, credit facilities, or buy-now-pay-later services available, we or the relevant financial partner may collect:

financing application information;
identity and business verification records;
financial and credit information;
requested financing amount;
repayment and payment status;
eligibility or risk assessment information; and
supporting documentation.

Financial partners may independently determine whether to approve a credit or financing request. Their processing of Personal Data will also be governed by their own privacy notices.

4.8 Delivery Information

We may collect:

recipient’s name and contact details;
delivery address and location;
delivery instructions;
proof of delivery;
delivery status and timestamps;
recipient signature;
communications with delivery personnel; and
photographs taken as proof of delivery, where appropriate.

If you provide another person’s information as a delivery contact, you are responsible for ensuring that you are authorized to provide that information and that the person is appropriately informed.

4.9 Customer Service and Communications

When you contact us, we may collect:

the content of emails, messages, and support requests;
telephone call information or recordings where legally permitted and notified;
complaints, feedback, and survey responses;
photographs, videos, invoices, and supporting documents;
marketing preferences; and
records of our responses and actions.

4.10 Technical and Usage Information

When you use the Platform, we may automatically collect:

IP address;
device type and device identifiers;
browser type and version;
operating system;
application version;
language and time-zone settings;
login times and activity;
pages visited and functions used;
referring website or source;
clickstream and navigation information;
error reports and performance data; and
security, fraud-prevention, and diagnostic logs.

4.11 Cookies and Similar Technologies

We may use cookies, software development kits, pixels, local storage, and similar technologies to collect information about how the Platform is accessed and used.

For more information, please see Section 11 of this Privacy Policy and our Cookie Policy.

5. Sources of Personal Data

We may collect Personal Data from:

you directly;
your employer or the company you represent;
another authorized user of your company’s Account;
Suppliers, wholesalers, and distributors;
banks and payment service providers;
financing and credit partners;
logistics and delivery providers;
identity and business verification providers;
customer service and communication providers;
fraud-prevention and cybersecurity providers;
analytics and advertising providers;
publicly available sources and official business registers; and
government authorities or other parties where permitted or required by law.

When required, we will inform you if providing particular Personal Data is mandatory or optional and explain the possible consequences of not providing it.

6. Why We Process Personal Data

We may process Personal Data for the following purposes.

6.1 Providing and Managing the Platform

We use Personal Data to:

create, verify, and manage Accounts;
authenticate users and manage access permissions;
provide Platform features;
respond to requests and enquiries;
personalize Account settings; and
maintain the availability and performance of the Platform.

6.2 Processing Orders

We use Personal Data to:

receive, verify, and accept Orders;
source Products from Suppliers;
process payments, top-ups, and Account Balance transactions;
issue invoices and transaction records;
arrange delivery or collection;
manage substitutions and out-of-stock Products;
process cancellations, returns, exchanges, and refunds; and
provide customer service and Order updates.

6.3 Product Identification and Compatibility

We may use vehicle, equipment, and Product information to:

identify appropriate Products;
verify Product compatibility;
respond to technical enquiries;
process warranty claims; and
investigate incorrect, damaged, or defective Products.

6.4 Payments and Financing

We may process Personal Data to:

verify and reconcile payments;
prevent unauthorized transactions;
process refunds;
administer Account Balance and top-ups;
facilitate financing or credit applications;
communicate with payment and financing partners; and
comply with financial, accounting, tax, anti-fraud, and regulatory obligations.

6.5 Customer Service

We may use Personal Data to:

respond to questions and complaints;
investigate delivery or Product issues;
process warranty claims;
provide technical support;
resolve disputes; and
monitor and improve service quality.

6.6 Platform Improvement and Analytics

We may process usage information to:

understand how Customers use the Platform;
improve navigation, functionality, and performance;
identify errors and technical issues;
develop new Products and services;
conduct internal research and reporting; and
produce aggregated or anonymized business insights.

Where data has been effectively anonymized so that no individual can be identified, it may no longer constitute Personal Data.

6.7 Security and Fraud Prevention

We may process Personal Data to:

protect Accounts and transactions;
verify identities and business authority;
detect and prevent fraud, misuse, and cybersecurity threats;
enforce our Terms and Conditions;
investigate suspicious activity;
protect the rights and safety of Customers, employees, Suppliers, and service providers; and
establish, exercise, or defend legal claims.

6.8 Legal and Regulatory Compliance

We may process and disclose Personal Data to:

comply with Saudi laws and regulations;
maintain tax, accounting, and transaction records;
respond to legally valid requests;
cooperate with courts, regulators, and government authorities;
comply with reporting and audit requirements; and
establish or defend our legal rights.

6.9 Marketing and Business Communications

Subject to applicable law and your preferences, we may use contact information to send:

Platform and service announcements;
Product availability updates;
promotional offers;
newsletters;
business surveys; and
information about related Products or services.

You may unsubscribe from promotional communications at any time. Service-related messages—including payment, Account, security, and Order notifications—are not considered marketing and may continue where necessary to provide the service.

7. Legal Bases for Processing

Depending on the circumstances and applicable law, Deep Parts may process Personal Data based on:

your consent;
the need to enter into or perform a contract with you;
compliance with a legal or regulatory obligation;
the protection of public interests;
the protection of vital interests;
Deep Parts’ legitimate interests, where permitted and where those interests do not prejudice your rights or conflict with your interests; or
another legal basis permitted under applicable Saudi law.

Where processing is based on consent, you may withdraw that consent through the channels specified in this Privacy Policy. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The applicable legal basis may differ depending on the nature and purpose of the processing.

8. Mandatory and Optional Information

Certain information is required for Deep Parts to:

verify your identity or business authority;
register and protect an Account;
process an Order or payment;
deliver Products;
issue an invoice;
process a return or refund; or
comply with legal obligations.

If you do not provide required information, we may be unable to create your Account, process your Order, provide a requested service, or fulfill a legal obligation.

Other information may be optional. Where practical, we will identify whether requested Personal Data is mandatory or optional when it is collected.

9. How We Share Personal Data

We do not sell or rent Personal Data.

We may disclose Personal Data to the following recipients when reasonably necessary and legally permitted.

9.1 Suppliers, Wholesalers, and Distributors

We may share Order, Product, business, and contact information with Suppliers to:

confirm availability;
process and fulfill Orders;
provide quotations;
verify Product compatibility;
arrange warranties, exchanges, or returns; and
resolve Product-related complaints.

9.2 Logistics and Delivery Providers

We may share recipient names, contact details, addresses, delivery instructions, and Order information with logistics and delivery providers.

9.3 Payment and Financial Partners

We may share relevant information with:

banks;
payment gateways;
payment processors;
Account top-up providers;
fraud-prevention providers;
financing providers; and
credit or deferred-payment partners.

These parties may use Personal Data to process payments, assess applications, prevent fraud, meet regulatory requirements, and provide their services.

9.4 Technology and Service Providers

We may engage service providers for:

cloud hosting and data storage;
software operation and maintenance;
analytics and performance monitoring;
identity verification;
communications and customer support;
cybersecurity and fraud prevention;
accounting and auditing;
document management; and
professional legal or compliance services.

Service providers are authorized to process Personal Data only for the relevant contracted purposes and subject to appropriate obligations.

9.5 Affiliates and Corporate Transactions

Where legally permitted, we may disclose Personal Data to our affiliated companies for internal administration, service delivery, security, and business operations.

If Deep Parts is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, Personal Data may be disclosed to relevant advisers, investors, or transaction parties, subject to appropriate confidentiality and legal safeguards.

9.6 Government and Regulatory Authorities

We may disclose Personal Data to courts, law-enforcement authorities, regulators, tax authorities, or other government bodies when:

required by applicable law;
required by a legally valid order or request;
necessary to protect legal rights or public safety; or
necessary to investigate fraud, security incidents, or unlawful activities.

10. International Transfers

Some service providers or business partners may process or store Personal Data outside the Kingdom of Saudi Arabia.

Where Personal Data is transferred or disclosed outside Saudi Arabia, Deep Parts will take the measures required by applicable law, which may include:

confirming that the destination provides an adequate level of protection;
implementing appropriate contractual or organizational safeguards;
carrying out required risk assessments;
limiting the transfer to the minimum information necessary;
obtaining any required approval; or
relying on another legally permitted transfer mechanism.

Saudi regulations impose specific requirements on international transfers, including protections for Data Subject rights and Saudi national interests. (dgp.sdaia.gov.sa)

For additional information about applicable international transfers, you may contact us using the details in Section 19.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

operate essential Platform functions;
keep users signed in;
remember language and other preferences;
protect Accounts and prevent fraud;
understand Platform traffic and usage;
diagnose technical problems;
improve Platform performance; and
measure the effectiveness of communications or marketing, where permitted.

Cookies may include:

11.1 Strictly Necessary Cookies

These cookies are required to operate the Platform, authenticate users, protect transactions, and provide requested services.

11.2 Preference Cookies

These cookies remember choices such as language, location, and Account settings.

11.3 Analytics Cookies

These cookies help us understand how visitors use the Platform and identify areas for improvement.

11.4 Advertising or Marketing Cookies

Where used and legally permitted, these cookies help measure campaigns and provide more relevant promotional content.

You may manage non-essential cookies through our cookie preference tool, where available, or through your browser settings.

Disabling some cookies may affect the functionality or performance of the Platform. Essential cookies cannot generally be disabled through our preference tool because they are required for the Platform to operate.

12. Data Retention and Destruction

We retain Personal Data only for as long as reasonably necessary to:

fulfill the purposes described in this Privacy Policy;
maintain your Account and provide services;
process Orders, payments, refunds, and warranties;
comply with legal, tax, accounting, and regulatory obligations;
resolve complaints and disputes;
prevent fraud and maintain security; and
establish, exercise, or defend legal claims.

Retention periods may vary according to the type of Personal Data, the purpose of processing, legal requirements, and the relationship between you and Deep Parts.

When Personal Data is no longer required, we will securely delete, destroy, or anonymize it, unless retention is permitted or required by law. The PDPL requires collection to be limited to what is necessary and data to be destroyed when it is no longer needed, subject to applicable legal exceptions. (dgp.sdaia.gov.sa)

Backup copies may remain for a limited period until they are securely overwritten or deleted in accordance with our backup procedures.

13. Data Security

Deep Parts implements reasonable and appropriate organizational, administrative, and technical measures designed to protect Personal Data against:

unauthorized access;
accidental or unlawful disclosure;
alteration or misuse;
loss or destruction;
cybersecurity threats; and
other unlawful forms of processing.

These measures may include, where appropriate:

access controls and permission management;
authentication measures;
encryption in transit or at rest;
system and activity monitoring;
secure backups;
employee confidentiality requirements;
security assessments;
vendor-security controls; and
incident-response procedures.

However, no website, application, database, or internet transmission can be guaranteed to be completely secure. You are responsible for protecting your Account credentials and notifying us immediately if you suspect unauthorized Account activity.

14. Personal Data Breaches

If a Personal Data breach occurs, Deep Parts will investigate and take appropriate steps to contain, mitigate, and remedy the incident.

Where required by applicable law, we will notify the competent authority and affected individuals within the applicable regulatory requirements.

We may contact affected individuals by email, telephone, Account notification, Platform notice, or another appropriate method.

15. Your Personal Data Rights

Subject to the PDPL, its Implementing Regulations, and applicable exceptions, you may have the following rights:

15.1 Right to Be Informed

You have the right to be informed of the legal basis and purpose for collecting and processing your Personal Data and other information required by law.

15.2 Right of Access

You may request access to the Personal Data that Deep Parts holds about you.

15.3 Right to Obtain a Copy

You may request a copy of your Personal Data in a clear and readable format, subject to applicable legal requirements.

15.4 Right to Correction

You may request the correction, completion, or updating of inaccurate, incomplete, or outdated Personal Data.

15.5 Right to Request Destruction

You may request the destruction or deletion of Personal Data when it is no longer required, subject to legal retention obligations and other applicable exceptions.

15.6 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time, subject to applicable legal requirements.

15.7 Right to Object or Restrict Processing

Where provided by applicable law, you may request that particular processing activities be stopped or restricted.

15.8 Marketing Preferences

You may unsubscribe from promotional emails or messages by using the unsubscribe option provided in the communication or by contacting us.

The core rights expressly identified in Saudi official materials include the rights to be informed, access Personal Data, obtain a readable copy, request correction, request destruction, and withdraw consent. These rights may be subject to statutory conditions and exceptions. (dgp.sdaia.gov.sa)

16. Complaints

If you have concerns about how Deep Parts handles your Personal Data, please contact us first so that we can investigate and attempt to resolve the matter.

You may also have the right to submit a complaint to the competent Saudi data-protection authority. SDAIA’s official materials identify SDAIA as the authority receiving complaints related to the PDPL. (dgp.sdaia.gov.sa)