Spedition is committed to conducting its business in accordance with all applicable Data Protection laws and regulations and in line with the highest standards of ethical conduct.

1. Scope

SPEDITION is committed to conducting its business in accordance with all applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL), while maintaining the highest standards of lawful, fair, and transparent processing of personal data.

In determining the context of the organisation and the expectations of interested parties, SPEDITION recognises the protection of personal data as a fundamental compliance obligation and an essential element of trust in its services. Interested parties include customers, business partners, employees, regulatory authorities, and other stakeholders who expect secure and lawful handling of personal information.

Privacy compliance is embedded within the organisation’s operational governance and risk-based approach. Risks associated with the processing of personal data are identified and managed to ensure appropriate protection of confidentiality, integrity, and availability of personal information.

This Privacy Notice explains what personal data we collect, how we use it, and the rights individuals may exercise in relation to their personal data, including access, correction, restriction, objection, and deletion where applicable.

We process personal data only where necessary for specified, explicit, and legitimate purposes, including providing services, fulfilling contractual obligations, and complying with legal requirements.

Where relevant, we also consider environmental impacts related to information handling, including reducing unnecessary paper usage and promoting responsible data lifecycle management.

This Privacy Notice explains:

• When this Notice applies
• What personal data we collect
• How and why we use personal data
• Legal bases for processing
• How personal data is shared
• International data transfers
• Security of personal data
• Retention of personal data
• Your rights
• Cookies and tracking technologies
• Updates to this Notice
• Contact details

2. What Data We Collect and Why

SPEDITION collects and processes personal data as part of its business operations to deliver services, manage customer relationships, and meet legal and regulatory obligations.

We collect personal data that is adequate, relevant, and limited to what is necessary for the intended purposes.

Categories of personal data may include:

• Name
• Address details
• Contact details (email, telephone)
• Company name (where applicable)
• Service and account information
• Payment and billing information

Sources of personal data include:

• Contact and enquiry forms
• Email and telephone communications
• Contracts, order forms, and service agreements
• Direct interactions with customers or business contacts

Personal data is processed to support:

• Service delivery and customer management
• Business operations and administration
• Contract performance and order fulfilment
• Service improvement and operational efficiency
• Legal and regulatory compliance

We do not sell personal data to third parties.

3. Legal Basis for Processing

We process personal data under the following lawful bases depending on jurisdiction.

UK GDPR / EU GDPR

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests (balanced against individual rights)
• Consent (where required)

Saudi PDPL

• Consent (where required under applicable law)
• Contractual necessity
• Legal or regulatory obligations
• Legitimate interests, where permitted

Where consent is used as a legal basis, individuals have the right to withdraw consent at any time, without affecting prior lawful processing.

4. How We Use Personal Data

We use personal data for the following purposes:

• Providing and delivering services
• Managing customer accounts and relationships
• Processing payments and fulfilling orders
• Communicating service updates and operational information
• Handling enquiries, complaints, and support requests
• Fraud prevention and security management
• Legal and regulatory compliance
• Business administration and service improvement

Personal data is not used for purposes incompatible with those described in this Notice.

All processing is carried out in accordance with applicable legal requirements and is subject to appropriate technical and organisational safeguards.

5. How We Share Personal Data

We may share personal data where necessary with:

• Payment service providers and financial institutions
• Credit reference agencies (where applicable)
• Logistics and delivery providers
• IT systems and service providers
• Legal, regulatory, or governmental authorities
• Professional advisers or auditors (where required)

All third-party recipients are required to:

• Process data only under documented instructions
• Maintain appropriate security measures
• Comply with applicable data protection laws

We ensure that data sharing is limited to what is necessary, relevant, and proportionate for the intended purpose.

6. International Data Transfers

Where personal data is transferred outside the UK, EU, or Saudi Arabia, we ensure appropriate safeguards are applied depending on jurisdiction.

UK / EU transfers

• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Other approved safeguards under applicable law

Saudi Arabia transfers

Where personal data is transferred outside the Kingdom of Saudi Arabia, transfers are conducted in accordance with PDPL requirements, which may include:

• Adequate protection measures
• Regulatory approvals where required
• Restrictions for sensitive data categories

7. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against:

• Unauthorised access
• Loss or destruction
• Alteration or disclosure

Security controls are designed to ensure confidentiality, integrity, and availability of personal data.

Access to personal data is restricted to authorised personnel on a need-to-know basis.

Security measures are reviewed and updated where necessary to reflect changes in risk, technology, or legal requirements.

8. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including:

• Contractual obligations
• Legal and regulatory requirements
• Operational and business needs

Retention periods are determined based on:

• Nature of the data
• Purpose of processing
• Applicable legal requirements

When personal data is no longer required, it is securely deleted or anonymised.

9. Your Rights

Depending on applicable law, individuals may have the following rights.

Under UK GDPR / EU GDPR

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

Under Saudi PDPL

• Right to be informed
• Right of access
• Right to correction
• Right to deletion (subject to legal exceptions)
• Right to withdraw consent (where applicable)

Supervisory authorities include:

• UK: Information Commissioner’s Office (ICO)
• EU: Relevant national data protection authority
• Saudi Arabia: Saudi Data & AI Authority (SDAIA)

10. Cookies and Tracking Technologies

We use cookies and similar technologies to ensure website functionality, improve user experience, and analyse website usage.

Non-essential cookies are only used where consent has been obtained where required by law.

Users may manage or withdraw cookie consent at any time via browser settings or cookie preference tools.

11. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legal, technical, or operational requirements.

The most recent version will always be available on our website.

12. Contact Details

For any questions, requests, or concerns regarding this Privacy Notice or the processing of personal data, please contact:

SPEDITION – Data Protection Contact
Email: info@spedition.sa.com