Oxcira

OxCira Company

Privacy and Data Protection Policy

This policy explains how OxCira collects, processes, protects, retains, and shares personal data in accordance with the laws of the Kingdom of Saudi Arabia.

Introduction

OxCira is committed to the Personal Data Protection Law and its implementing regulations, National Cybersecurity Authority controls, and related Saudi requirements. By using the Platform, you acknowledge this Policy.

Article 1: Scope

  • This Policy covers all personal data collected, processed, stored, or shared through OxCira's digital interfaces, website, applications, infrastructure, databases, and operational channels.
  • It applies to employees, contractors, and service providers authorized to access data.

Article 2: Regulatory Framework

  • Saudi Personal Data Protection Law (PDPL) and SDAIA implementing regulations.
  • National Cybersecurity Authority Essential Cybersecurity Controls (ECC).
  • Other applicable rules connected to the Platform's operations.

Article 3: Definitions

  • Personal Data: information that directly or indirectly identifies a natural person.
  • Data Subject: the person to whom the data relates.
  • Processing: collection, storage, use, disclosure, destruction, or any other operation on personal data.
  • Platform means OxCira Platform and Company means OxCira Company.

Article 4: Data Classification

OxCira classifies public, internal operational, personal, and sensitive personal data and applies controls based on least privilege and need to know.

Article 5: Data Sources

  • Information supplied during registration and service use.
  • Operational data generated through Platform activity and technical data such as login logs, IP addresses, and cookies.
  • Approved payment, logistics, and technical providers, and competent authorities where legally required.

Article 6: Lawful Basis

  • Explicit consent.
  • Performance of a contractual obligation.
  • Compliance with a legal obligation.
  • A legitimate Platform interest that does not prejudice Data Subject rights.

Article 7: Processing Purposes

  • Account creation and verification; Platform operation; management of offers, orders, and transactions; payment and settlement; logistics coordination.
  • Legal compliance, cybersecurity, fraud prevention, operational notices, service quality, and user-experience improvement.
  • Statistical analysis, indicators, performance measurement, service development, decision support, and anonymized operational insights.
  • AI-assisted material descriptions, estimated price indicators, search and matching, and market analysis. AI outputs are not guarantees or legal, financial, investment, or commercial advice; Users remain responsible for final verification and decisions.

Article 8: Sharing and Disclosure

  • OxCira does not sell, trade, or rent personal data.
  • The minimum necessary data may be shared with payment providers, logistics partners, cloud, technical and cybersecurity providers, AI or analytics providers, and competent authorities under a legal requirement.
  • Contractual and organizational safeguards limit use to specified purposes.

Article 9: International Transfers

Personal data is transferred outside Saudi Arabia only under PDPL controls, after necessary legal and technical measures, and with protection no lower than that applied in the Kingdom.

Article 10: Information and Cybersecurity

  • Encryption of sensitive data and access-control management.
  • Continuous monitoring, auditing, incident management, backups, disaster recovery, and periodic system testing.

Article 11: Security Incidents

  • OxCira promptly assesses, contains, documents, and investigates security incidents.
  • Required regulatory reports are submitted and corrective measures are taken to prevent recurrence.

Article 12: Retention and Destruction

  • Data is retained during the contractual relationship and for additional financial, tax, or regulatory periods required by Saudi law.
  • After the purpose ends, data is securely destroyed or anonymized unless longer retention is legally required.

Article 13: Data Subject Rights

  • The right to be informed and to access personal data.
  • The right to request correction or destruction.
  • The right to withdraw consent without affecting the lawfulness of earlier processing.

Article 14: Exercising Rights

Requests may be submitted through OxCira's official channels and are handled within a reasonable period under approved legal procedures.

Article 15: Messages and Notifications

OxCira may send operational and regulatory SMS or electronic notifications as part of providing the service under the Terms and Conditions.

Article 16: Amendments

This Policy is reviewed periodically and may be amended when needed. Continued use after publication constitutes acceptance.

Article 17: Governing Law and Jurisdiction

This Policy is governed by Saudi law and the competent courts within the city of Jubail.

Article 18: Governing Language

Arabic is authoritative and prevails over conflicting translations. This Policy and the Terms and Conditions complement one another.