This policy explains how GHAYA Express (CR 4603151480, Riyadh) collects, uses and protects personal data, and your rights under the Saudi Personal Data Protection Law (PDPL) and its regulations.
1. Data we collect
- Account data: name, email, mobile number, store or business name, city, and details of employees you add to your account.
- Verification data: commercial registration, freelance document or ID and tax certificate when you verify your account.
- Shipment data: sender and receiver names, mobile numbers, addresses and cities, item description, weight and cash-on-delivery amount.
- Financial data: wallet movements, top-ups, transfers and invoices. We do not store your card details; payments are processed by a licensed payment gateway.
- Security and usage data: sign-in records, device and browser type, approximate IP address and account activity, to protect you and prevent fraud.
- Contact data: what you send us through contact or support forms.
2. Why we use it
- To provide the service: issuing waybills, sending shipment data to the carrier, tracking, and collecting and settling cash on delivery.
- To manage your account and wallet and issue electronic tax invoices.
- Account security: two-step verification, new-device sign-in alerts and fraud detection.
- Service notifications about shipments, payments and your account.
- Customer support, problem solving and improving the platform.
- Promotional messages — only with your consent, which you can withdraw at any time.
- Legal compliance, including ZATCA and other authorities’ requirements.
3. Legal basis
We process your data to perform our agreement with you, to meet our legal obligations, for our legitimate interests in protecting the platform and preventing fraud without harming your rights, and on your consent where consent is required, such as promotional messages.
5. Receivers’ data
When a merchant creates a shipment, they provide the receiver’s details and are responsible for obtaining them lawfully. We use this data only to deliver the shipment and send tracking updates; receivers can contact us to exercise their rights.
6. Transfers outside the Kingdom
We aim to process data inside Saudi Arabia. If providing a service requires transferring data outside the Kingdom, this happens only under the conditions set by the PDPL and its regulations.
7. Retention
We keep data while your account is active and as needed to provide the service, then keep only what the law requires — such as invoices and accounting records for the legally required periods — and destroy or anonymise data once it is no longer needed.
8. How we protect it
- Mandatory two-step verification for every account, new-device alerts and automatic sign-out when idle.
- Encrypted connections, and passwords stored with one-way hashing.
- Fine-grained staff permissions and an audit log of every sensitive action.
- We will never ask for your password or verification code by phone, chat or email.
9. Your rights
Under the PDPL you have the right to:
- Be informed how and why your data is collected and processed.
- Access your data and obtain a copy.
- Ask us to correct or update your data.
- Ask us to destroy your data when it is no longer needed, unless we must keep it by law.
- Withdraw consent for consent-based processing, such as promotional messages.
- Complain to the competent authority if you believe your data was processed unlawfully.
11. Minors
The platform is for people aged 18 or over, and we do not knowingly collect minors’ data.
12. Updates
We may update this policy; the new version is published here with its date, and we notify you of material changes by email or on the platform.
13. Contact us
For any question or request about your personal data: info@ghayaex.com · unified number 920016203 · Riyadh, Saudi Arabia. We answer requests within the legally required periods.
Questions about this page? Contact us at info@ghayaex.com