Privacy Policy

Who We Are

TOA Digital is a Saudi digital platform offering digital products, services and solutions through the website toa.sa.

TOA Digital determines the purposes and means of Processing the Personal Data covered by this Policy and is the Controller of such Personal Data for the purposes of the Personal Data Protection Law of the Kingdom of Saudi Arabia.

Privacy contact: info@toa.sa

You may use this email address to make inquiries regarding the Processing of your Personal Data or to exercise your rights under applicable law.

Scope of This Policy

This Policy applies to the Processing of Personal Data through the TOA Digital Platform at toa.sa, including visits to the website, registration of customer accounts, submission of requests, use of available services, communication with the Platform's administration and access to technical support.

It covers Processing activities for which TOA Digital acts as Controller under the applicable laws and regulations of the Kingdom of Saudi Arabia.

The Platform may offer digital products or services operating through independent systems or applications with their own privacy policies. Personal Data Processed within those independent systems or applications is governed by the policies applicable to them. This does not displace this Policy in respect of Personal Data collected by TOA Digital to administer requests, contractual dealings or commercial relationships.

Provisions relating to any particular feature or service apply when that feature or service is actually made available and the associated Processing begins.

Personal Data We Collect

TOA Digital collects the Personal Data necessary to provide its services and operate the Platform securely. Depending on the service used, this includes:

• Customer account data: full name and email address, together with mobile number and company name if provided voluntarily.
• Authentication and security data: login-session information, Internet Protocol (IP) addresses recorded for security and audit purposes, and credentials needed to authenticate a user. Passwords are stored using secure hashing, not in their original plain-text form.
• Service and commercial request data: information submitted with a request, which may include name, contact details, company name, type and description of the requirement and budget range.
• Technical support data: the content of support tickets and related correspondence, and information provided to assist with a support request.
• Billing and payment data: when a commercial request is submitted, the information needed to issue an invoice and verify payment, including the name to appear on the invoice, the tax identification number and national address if the customer chooses to provide them, and the bank transfer details the customer reports (amount, date and transaction reference).

Billing and payment data is not collected merely because someone browses the Platform or registers an account.

We limit the Collection of Personal Data to what is necessary for the purposes specified in this Policy.

Please do not include Sensitive Personal Data or information relating to other individuals in messages unless doing so is necessary and lawful.

How We Collect Personal Data

We collect Personal Data directly from users when they register an account, update their profile, submit requests, open support tickets or contact us through approved channels.

Certain technical data may be collected automatically where needed to operate the Platform, protect accounts, manage sessions and record security events.

We do not purchase personal-data databases from third parties for marketing or collect user data through external advertising networks.

Purposes and Lawful Bases of Processing

We Process Personal Data for the purposes below, relying in each case on the lawful basis applicable to the particular Processing activity:

• Account registration and administration: to establish customer accounts, verify email addresses, enable sign-in and allow account administration, for performance of the contractual relationship relating to use of the Platform or to take steps necessary to provide a service requested by the user.
• Handling requests and delivering services: to receive and review requests, contact the person making a request and perform obligations relating to products or services, based on the relevant contractual relationship or another applicable lawful basis.
• Technical support: to receive, respond to and resolve customer inquiries, complaints and support tickets insofar as needed to deliver support.
• Operational communications: to send messages necessary for the operation of accounts and services, such as email verification, password resets and request and invoice notifications.
• Protection of the Platform and users: to review sign-in attempts, prevent unauthorised access, detect misuse and protect the integrity of the Platform, relying on legitimate interests where the relevant statutory conditions are met.
• Commercial and financial records: to Process data needed for invoicing, payment verification and the retention of records required to fulfil contractual and legal obligations.
• Compliance with legal requirements: to respond to requirements or requests issued by competent authorities where required or permitted by applicable law.

We do not sell Personal Data or use it to send marketing messages without satisfying any applicable legal consent requirements.

Mandatory and Optional Data

Customer account registration requires a full name and valid email address. Email verification is required to complete registration.

Providing a mobile number or company name is optional at registration.

Submitting a request or using a particular feature may require additional data necessary to process the request or deliver the service. Any such requirement will be explained when the feature is used.

Failure to provide mandatory data may prevent registration or delivery of the requested service. Declining to provide optional data does not, by itself, prevent account registration.

Cookies

TOA Digital uses essential cookies to operate the Platform, maintain authenticated sessions and remember the user's selected language.

Cookies associated with authenticated sessions contain random identifiers, while the corresponding session data is stored on the server.

The Platform does not use advertising cookies, marketing trackers or Google Analytics, and it does not share users' browsing data with external advertising networks.

It relies on aggregated operational statistics generated on the server, without external analytics tools or profiling users for marketing purposes.

Disabling essential cookies in your browser may prevent certain functions, including sign-in, from working.

Access to and Disclosure of Personal Data

Access to Personal Data is limited to the Platform's administration and persons it authorises, if any, according to their assigned permissions and only insofar as necessary to operate the Platform, provide services and protect the data.

Service providers necessary to operate the Platform, namely the hosting provider and the email provider, may Process Personal Data under appropriate contractual arrangements for its protection; this Processing is ongoing in order to operate the Platform. Disclosure to competent authorities takes place only when requested.

Personal Data may also be disclosed to competent authorities where applicable law requires or permits disclosure, limited to the data necessary for the relevant lawful purpose. This includes sending invoice data to the Zakat, Tax and Customs Authority when that becomes a legal requirement.

Some digital products or services may require additional Processing of Personal Data to activate a product, deliver a service or provide related support. In such cases, use or disclosure is limited to what is necessary for the specified purpose, and product- or service-specific notices will be provided where warranted by the nature of the Processing.

Buying a product or requesting a service through TOA Digital does not, of itself, give every other product access to the customer's Personal Data.

We do not sell users' Personal Data or disclose it to advertising organisations for marketing purposes.

Location of Storage and Processing

Platform data is stored and Processed on the servers of a hosting provider located outside the Kingdom of Saudi Arabia, including the database, files, records and backups.

Transfer of data outside the Kingdom is limited to what is necessary to operate the Platform and deliver services, does not involve selling or sharing it for any other purpose, and is carried out in accordance with the statutory controls on transferring Personal Data outside the Kingdom, subject to the safeguards described in this Policy.

Retention and Destruction of Personal Data

We retain Personal Data for as long as necessary for the purposes for which it was collected, or for the period required by law, after which it is deleted automatically as follows:

• Login sessions and verification or password-reset links: deleted 30 days after they end, are used or are replaced, in an automated deletion run every six hours.
• Email log: message content is cleared once sent, and the record is deleted after 30 days.
• Service requests: deleted 12 months after they are declined or cancelled, or after submission if never decided, and 5 years after they are accepted.
• Commercial requests not accepted: a request rejected or cancelled before acceptance is deleted 12 months after the decision, and an abandoned request cart 12 months after its last change.
• Support tickets and their messages: deleted 24 months after closure or after their last message.
• Account: on closure the mobile number and company name are erased immediately, and the account is deleted permanently 12 months after closure. An account with no sign-in for 24 months is closed automatically.
• Security and audit log: kept for 24 months; IP addresses are removed from it after 90 days.
• Financial records (accepted requests, invoices, payments and related records): kept for at least five years, including the buyer details copied into them, even if the account is deleted.
• Backups: backups are deleted after no more than 90 days; deleted data remains in them until then, and they are used only to restore the Platform.

When a retention period ends, the data is destroyed securely so that it cannot be recovered.

Protection of Personal Data

We apply appropriate technical and organisational measures to protect Personal Data against unauthorised access, unlawful use, alteration or disclosure, and loss, including:

• Encryption of data in transit.
• Secure hashing of passwords.
• Two-factor authentication for Platform administration accounts.
• Access restrictions based on assigned permissions.
• Controls for authentication and session management, including limits on failed sign-in attempts.
• Logging of important administrative and security events.
• Backup arrangements.

Safeguards are reviewed in light of the relevant risks and technological developments. These measures do not constitute an absolute guarantee against security incidents. If an incident affecting Personal Data occurs, we notify the competent authority and the affected Data Subjects as required by law.

Rights of Personal Data Subjects

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations, subject to applicable conditions and exceptions, Data Subjects have the following rights:

• Right to be informed: to know why their Personal Data is collected, the purposes for which it is Processed and the lawful basis for doing so.
• Right of access: to request access to Personal Data relating to them.
• Right to obtain a copy: to request a copy of their Personal Data in a clear and readable format.
• Right to rectification: to request correction of inaccurate Personal Data, completion of incomplete data or updating of their data.
• Right to destruction: to request Destruction of Personal Data in the circumstances prescribed by law, unless a lawful basis for retention exists.
• Right to withdraw consent: to withdraw consent where consent is the lawful basis of Processing.
• Right to compensation: to claim compensation for damage resulting from a breach of the Law, through the statutory procedures.

Exercising Rights and Closing an Account

Users may update their name, mobile number and company name through the profile section of their account.

Requests concerning other rights may be made by email to info@toa.sa. We may request appropriate verification of the requester's identity to prevent disclosure of data to unauthorised persons.

Requests to exercise rights are handled within no more than 30 days. Where permitted under the Implementing Regulations, this period may be extended by no more than a further 30 days, provided the requester is notified beforehand of the reasons for the extension.

A customer may request account closure through their profile. Closure is not carried out while the customer has an open request or an order in progress, and it does not entail Destruction of records that must be retained by law.

Complaints and Inquiries

Inquiries or complaints concerning the Processing of Personal Data may be submitted by email to info@toa.sa.

A Data Subject may also lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), as the competent authority, under the applicable statutory procedures and time limits.

External Websites and Links

The TOA Digital Platform may link to independent websites or applications, including systems associated with digital products and services offered through the Platform.

This Policy does not extend to Processing carried out within those websites or applications independently of TOA Digital; each is subject to its own applicable privacy policy.

This does not affect TOA Digital's responsibility for Personal Data that it collects and Processes for account administration, requests or commercial relationships within the Platform. We recommend reviewing the policy applicable to each independent website or application before providing Personal Data through it.

Changes to This Privacy Policy

This Policy may be updated to reflect changes to Personal Data Processing, newly introduced services or features, or relevant legal requirements.

The version in effect is published on this page together with its version number and effective date, and earlier versions remain available for reference.

Where a change requires additional notification or renewed consent under applicable law, appropriate measures will be taken before the relevant Processing begins.