Privacy Policy

1. Introduction

Waraq is committed to respecting your privacy and protecting your personal data. We will be transparent about the information we collect about you and what we will do with it. We will use your personal data for the purposes described below. Your personal data will not be processed in a manner inconsistent with the purpose of its collection or in cases other than those stipulated by applicable privacy laws. We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected and need to process your personal data. We have measures to protect your personal data and keep it secure. We will respect your data protection rights and aim to give you control over your own personal data.
You can access our full Privacy Policy below to help you understand how we use your personal data. In it, we explain in particular the types of personal data we collect, how we collect and process it, what we may process it for, and who we may share it with.

2. Full Privacy Policy

2.1 Controller of Personal Data

Any personal data processed in connection with this Privacy Policy is controlled by Arab Paper Manufacturing Company (WARAQ), a company organized and registered under the laws of the Kingdom of Saudi Arabia, with its registered office at 2nd Industrial City, Street 67, Road 98, P.O. Box 9840, Dammam 31423, Kingdom of Saudi Arabia, which is considered the “data controller” of your personal data under the KSA Personal Data Protection Law and its Implementing Regulations.
To contact Waraq’s Data Protection Officer, please send a request using the contact details specified at the end of this Privacy Policy.

2.2 What Do We Mean By Personal Data?

Personal data means any data, regardless of its source or form, that may lead to identifying you specifically, or that may directly or indirectly make it possible to identify you, including your name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of you, and any other data of a personal nature.

2.3 When Does This Policy Apply?

This Privacy Policy applies to personal data about you that we collect, use, or otherwise process in connection with your relationship with us as a customer. Personal data is used in this process to help our business use customer data for invoicing purposes.

2.4 How Do We Collect and What Types of Personal Data Do We Collect About You?

2.4.1 Direct Collection

We collect and process personal data that you provide directly to us via channels such as email, WhatsApp, phone, or an internal system.
In that respect, we collect the following types of personal data:

Name
Email Address
Address
Contact Number
Signature
Bank Account Details
Company details (such as commercial registration certificate and VAT certificate)

We will inform you at the time of collection of your personal data whenever providing such data is mandatory in order to allow us to achieve the purposes described below. Otherwise, providing the personal data is optional. If you do not provide the personal data we require, this may affect our ability to provide services to you.

2.5 What Do We Use Your Personal Data For and Our Legal Basis?

We will only process your personal data where we have a legal basis to do so. The legal basis will depend on the reason or reasons we collected your data and need to use it, as described below:

2.5.1 Legitimate Interest We have a legitimate business interest to process your personal data to:

Ensure the accurate and timely creation of your invoices reflecting the goods shipped to you.
Allow you to view, download, and print your invoices.
Maintain records of your invoices for accounting, auditing, and legal purposes.
Address your inquiries and resolve any issues related to your invoices.
Verify your identity using the information provided in your KYC (“Know Your Customer”) form.
Map your customer journey to provide insights into your interactions and transactions with us.
Assess the financial risk associated with you based on the information you have provided.
Map your customer journey to provide insights into your interactions and transactions with us.

2.5.2 Performance of Contract
It is necessary for us to use your personal data in order to:

Collect and verify personal and company details (such as VAT number, commercial registration, and company address) from suppliers to establish a supplier account.
Initiate and maintain communication with the designated supplier point of contact via email, phone, or WhatsApp.
Utilize personal and company details to facilitate accurate and timely payments to suppliers.
Ensure the supplier account is accessible to relevant departments for operational purposes.

2.6 How Long Do We Keep Personal Data?

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, accounting, or reporting obligations.
Once the personal data is no longer required for the purposes outlined, we will securely delete or anonymize it to prevent any further association with you.
If you wish to know more about our retention policies, please contact us using the details provided at the end of this Privacy Policy..

2.7 Who Do We Share Your Personal Data With?

For the purposes referred to under this Privacy Policy, we share your personal data with our internal departments, namely with the finance, HR and delivery departments, for the purposes of managing the supply chain and other activities.
We do not share your personal data with any external entities for the purposes referred to under this Privacy Policy.
We do not sell personal data to third parties, and we only allow third parties to send you marketing information where we have your consent to do so.

2.8 Do We Transfer Personal Data Outside KSA?

We do not transfer your personal data outside of the Kingdom of Saudi Arabia.

2.9 What Are Your Legal Rights in Relation to the Personal Data We Hold About You?

Under the applicable privacy laws, you have certain rights in relation to your personal data. Responses to requests to exercise your rights will be provided within 30 days (or such other period as required under applicable law). If your request is particularly complex, we may extend the deadline for responding by a further 30 days (or such other period permitted under applicable law), and we will let you know if this is the case.
We will handle all requests in accordance with applicable law. However, depending on the right you wish to exercise and the nature of the personal data involved, there may be legal reasons why we cannot grant your request. Further explanation of those rights and the exceptions to them are set out below.
Your rights include the following:

Right of access to your personal data.
Right to be informed about our processing of your personal data (this Privacy Policy provides this information).
Right to obtain your personal data in a readable and clear format (data portability).
Right to request correction, completion or updating of your personal data.
Right to request the destruction/erasure of your personal data.

In any case, you also have the right to lodge a complaint with the competent data protection authority in accordance with applicable law if you consider that the processing of your personal data carried out by us infringes the applicable privacy laws.

2.10 How Can You Exercise Your Legal Rights and Change How We Use Your Data?

In order to exercise any of your rights mentioned above, or if you have any questions about our use of your personal data, please send a request using the contact details specified at the end of this Privacy Policy.
We may ask for some additional information to confirm your identity, which will only be used to process your request.
In your request, please try to clearly indicate which right(s) you would like to exercise and provide any details which may help us respond to your request.
Where you fully or partially lack legal capacity (for example, if you are a child under 18), the applicable law may require your legal guardian to exercise your rights on your behalf.

2.11 Security of Your Personal Data

To protect against the loss, misuse, and alteration of the information under our control, we have in place appropriate physical, electronic, and managerial procedures. For example, our servers are accessible only by authorized personnel, and your information is shared with relevant personnel on a need-to-know basis to complete the transaction and provide the services requested by you.
Be aware that there is an internet fraud practice known as “phishing,” which is the illegal gathering of personal data by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a cloned or illegal copy website.

3. How Will We Inform You of Changes to This Privacy Policy?

If we change this Privacy Policy, we will let you know about the changes by publishing the updated version on our website. If such change to the Privacy Policy requires your consent, you will have a choice as to whether or not we may use your personal data in a different manner.
We are committed to protecting and respecting your privacy and will continue to do so in any future changes we make to this Privacy Policy.

4. How to Get in Touch With Us and Your Right to Complain to Our Supervisory Authority

If you want to exercise any of your rights, or if you have any questions about this Privacy Policy or our use of your personal data, please contact the Data Protection Officer. The Data Protection Officer for Waraq can be contacted via email at DPO@waraq.com.