The Ironmesmar store is committed to full compliance with the provisions of the Personal Data Protection Law issued in the Kingdom of Saudi Arabia and its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority, as well as the regulatory rules issued by the Communications, Space and Technology Commission (CST) and other relevant regulations, in a manner that ensures the processing of users’ personal data in accordance with the principles of transparency, privacy, security, and lawful use.
Personal data — in accordance with the law — means any data that leads to the specific identification of the consumer, whether directly or indirectly, and includes by way of example and not limitation: name, identity number, address, contact numbers, email address, account or bank card numbers, geographic location data, Internet Protocol (IP) addresses, and any other data of a personal nature.
A: Data Collection
- The website collects data that the user voluntarily provides upon registration or when placing an order, such as: full name, telephone number, email address, address, and payment information.
- Technical data is collected automatically when using the website, such as: cookies, browser logs, operating system, and IP address, for the purposes of analysis and improving performance and the user experience.
- No data is collected that does not serve a legitimate purpose or that lacks a statutory basis or the express consent of the user.
B: Purposes of Data Use
The consumer’s personal data is used for the following purposes:
- Fulfilling orders and contracts and completing purchase, payment, and delivery processes.
- Managing accounts and communicating with customers regarding orders, updates, or technical issues.
- Improving the user experience and developing the operational performance of the website and services.
- Complying with the legal and regulatory obligations imposed under the relevant Saudi regulations.
- Preventing fraud and ensuring the security of electronic transactions through secure and advanced monitoring systems.
C: Data Protection and Security
The website applies the highest technical, organisational, and administrative standards to protect users’ personal data from unauthorised access, disclosure, alteration, loss, or processing for purposes other than legitimate ones. These measures include:
- Storing data on secure servers with limited and monitored access, inside or outside the Kingdom, in accordance with the requirements of the regulatory authorities.
- Training employees and authorised persons with access on secure methods of handling data.
- Conducting periodic reviews of security and encryption procedures to prevent any breach or unauthorised use.
- Exercising reasonable care in selecting external service providers such as: electronic payment gateways, hosting companies, shipping companies, and technical support providers, and verifying their compliance with data protection regulations.
In the event that the user’s data is subject to any breach or unauthorised access, the store undertakes to notify the Ministry of Commerce, the competent authority, and the user within three (3) business days from the date of becoming aware of the incident, setting out its scope, its effects, and the corrective measures taken, without this notification exempting the store from its statutory liability within the limits of what falls under its actual and reasonable control.
D: Sharing Data with Third Parties
The website does not sell or share users’ data with any commercial or marketing entity. Data sharing is limited to necessary cases only, and includes:
- External service providers who participate in fulfilling the order (such as shipping companies, payment gateways, cloud hosting providers, and technical support).
- Governmental or judicial authorities upon lawful request or in implementation of an official order.
- Other parties of whom the user is informed and whose prior consent is obtained before their data is shared with them.
The website remains responsible for monitoring the performance of third parties within the limits of reasonable care and in accordance with the controls established by law.
E: Users’ Rights
The user has the right to exercise their statutory rights set out in the Personal Data Protection Law, which include:
- Requesting access to their personal data or obtaining a copy of it.
- Requesting correction of their data if it is inaccurate or incomplete.
- Requesting deletion of their personal data if the legitimate purpose for collecting it has ceased.
- Withdrawing consent to the processing of data, without prejudice to processing carried out prior to the withdrawal of consent.
The website undertakes to respond to the user’s statutory requests within a period not exceeding thirty (30) business days from the date of officially receiving the request, in accordance with the controls and procedures specified in the relevant regulations.
F: Consent to the Privacy Policy
The user’s use of the website or any of its services shall be deemed express and prior consent to the collection, processing, use, and sharing of their personal data in accordance with the provisions of this policy.
The store reserves the right to amend the privacy policy whenever there is a statutory or technical need to do so, provided that the amendment is published on the website and the updated version becomes effective from the date of its publication.
