Saudi Arabia Privacy Notice (PDPL)

This notice adds Saudi-specific information to the Tanqory Global Privacy Policy. It applies when the Kingdom of Saudi Arabia's Personal Data Protection Law ("PDPL") applies to how Tanqory Inc. ("Tanqory", "we", "us") handles personal data of people residing in the Kingdom (PDPL Art. 2). Where this notice and the Global Privacy Policy differ for a person in the Kingdom, this notice applies.

Official references:

• Saudi Data and AI Authority (SDAIA), Data Governance Platform: https://dgp.sdaia.gov.sa/
• PDPL, Implementing Regulation and Transfer Regulation (English texts): https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter

---

1. Who is responsible

• Tanqory Inc. is the controller for personal data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the controller and Tanqory processes that data on the merchant's behalf under our Data Processing Addendum. Ask the merchant first about your rights; we help the merchant answer.
• Contact: privacy@tanqory.com. Our Data Protection Officer can be reached at the same address. Please write "PDPL request" in the subject line.

2. What we collect and why (PDPL Arts. 5, 6, 12 and 13)

The categories of data, how we collect them, purposes, recipients, storage and deletion are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). The PDPL basis we rely on for each purpose is:

We do not make giving consent a condition of using our services, except where the data is needed for the service itself (Art. 7). We do not ask for sensitive data, such as health, religious, genetic or criminal records data, to use Tanqory. Every marketing message names Tanqory and includes a way to stop receiving it that is as easy as signing up (Implementing Regulation Art. 28).

3. Your rights (PDPL Art. 4)

You can ask us to:

• tell you the legal basis and purpose for processing your data;
• give you access to your data, and a copy in a clear, readable format;
• correct, complete or update your data;
• destroy data we no longer need;
• stop processing based on your consent, by withdrawing it (Art. 5(2)). Withdrawing is as easy as giving consent: use the unsubscribe link, your account settings, or email us. It does not affect processing done before.

Send requests to privacy@tanqory.com. We will check your identity before we act. We answer within 30 days. If a request needs disproportionate effort, we may extend that by up to 30 more days and tell you before the first period ends (Implementing Regulation Art. 3). Requests are free.

You can also complain to SDAIA (Art. 34). We would like the chance to fix the problem first, but you do not need to contact us before you complain.

4. Children and people without full legal capacity

Tanqory is built for businesses and is not meant for children. You must be 18 or older to open a merchant account. We do not knowingly collect data from children or from people who lack full legal capacity. Where the PDPL requires a legal guardian's consent (Art. 5(1); Implementing Regulation Art. 13) and we do not have it, we delete the data.

5. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in the Kingdom see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

6. Transfers outside the Kingdom (PDPL Art. 29)

Tanqory is a US company. Today our platform data is hosted by DigitalOcean in Singapore, and some of our service providers process data in the United States and other countries (see the subprocessor list). We transfer only the minimum data needed. Where the recipient country is not on SDAIA's adequacy list, we rely on appropriate safeguards under Article 4 of the Regulation on Personal Data Transfer outside the Kingdom, usually standard contractual clauses, and we assess the transfer's risk where Article 7 of that Regulation requires it. You can ask us for a copy of the safeguards that apply to your data.

7. Security and data breaches (PDPL Art. 20; Implementing Regulation Art. 24)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If a breach could harm you or your rights, we notify SDAIA within 72 hours of becoming aware of it, and tell the people affected without undue delay, in simple language, with what they can do to protect themselves.

8. How long we keep data

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example tax records). Periods are listed in our Data Retention Policy. After that we destroy or anonymise the data.

9. Changes and language

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. This notice is in English.

Change history