Privacy Policy

This policy explains how Medad-X General Trading collects, uses, discloses and protects personal data when you visit our website, request a quotation, open a trading account or otherwise deal with us. It applies to processing carried out in the Kingdom of Saudi Arabia and to data subjects located across the GCC and wider MENA region.

Medad-X General Trading, part of the Arsan Global Group, is the data controller responsible for your personal data. Our address and contact details appear at the end of this policy.

Depending on how you interact with us, we may collect:

• Identity & contact data — name, job title, company, email, phone and WhatsApp number;
• Commercial data — quotation requests, order history, delivery addresses, trade licence and VAT details;
• Correspondence — messages you send us and records of our communications;
• Technical data — IP address, browser type and pages requested, recorded in our hosting provider's server logs for security and reliability;
• Any additional information you choose to provide to us.

We process personal data to:

• Respond to enquiries and prepare quotations;
• Perform supply contracts and arrange freight and delivery;
• Manage trading accounts, invoicing and payments;
• Comply with legal, tax, customs and food-safety obligations;
• Improve and secure our website and services;
• Send commercial updates where you have consented or where otherwise permitted by law.

We rely on one or more of the legal bases recognised under the Saudi PDPL: your consent; the performance of a contract with you; compliance with a legal obligation; the protection of vital interests; and our legitimate interests, provided these do not override your rights and freedoms.

Where we rely on consent — for example to send marketing communications — you may withdraw it at any time by contacting us or using the unsubscribe link. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We do not sell personal data. We may share it with:

• Group companies within the Arsan Global Group;
• Logistics, shipping, inspection and insurance providers to fulfil orders;
• Banks and payment processors;
• Government, customs and regulatory authorities where required by law;
• Professional advisers under a duty of confidentiality. All processors are bound by appropriate contractual safeguards.

As a regional trader, we may transfer personal data to other GCC states and to countries of origin (such as India and Pakistan) to arrange supply and shipping. Where data leaves the Kingdom, we apply the transfer conditions of the PDPL and its implementing regulations — including an adequacy assessment, appropriate safeguards, or your explicit consent — and transfer only the minimum data necessary.

We keep personal data only for as long as necessary to fulfil the purposes above and to meet legal, accounting, tax and customs retention requirements (generally up to ten years for commercial records under Saudi law), after which it is securely deleted or anonymised.

We apply appropriate technical and organisational measures — including access controls, encryption in transit and staff confidentiality obligations — to protect personal data against loss, misuse and unauthorised access. In the event of a personal-data breach, we will notify the competent authority and affected individuals as required by the PDPL.

Subject to the PDPL, you have the right to:

• Be informed of how your personal data is used;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data where legally permitted;
• Withdraw consent at any time;
• Object to or restrict certain processing;
• Receive a copy of your data in a readable format. To exercise any right, contact us using the details below; we respond within the period required by law.

Our website does not use advertising or tracking cookies. Your theme preference is stored in your browser's local storage. While you fill in our quote or trading-account forms, your selection and draft are kept in your browser's session storage so they are not lost if you change pages; this data stays on your device, is never sent to us until you submit, and is deleted when you close the tab (drafts also expire after 24 hours). You can clear this data at any time in your browser settings.

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data relating to minors.

If you have a concern about how we handle your data, please contact us first so we can address it. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA), the competent supervisory authority for the PDPL.

We may update this policy from time to time; the current version and its date appear on this page. For any privacy request, contact our compliance team at privacy@medadx.com or +966 920009050.