Privacy policy

1. What we collect

Company details: legal names, CR and VAT numbers, city and address.

Contact person details: name, mobile number and work email.

Account data: your login email and password (stored only in hashed form by our authentication provider).

Transaction data: RFQs, quotes, orders, invoices and payments.

Technical data: essential sign-in and language cookies, and server logs that may include your IP address.

Visit statistics: we record which pages are visited and when, to measure how the platform is used. We don't store your IP address — only a one-way encrypted identifier that changes every day, so a visitor can't be followed from one day to the next. If you're signed in, the visit is linked to your company account. These records are kept for 13 months and then deleted automatically, and we honour your browser's “Do Not Track” setting.

2. Why we use it

To verify your business and operate your account; to price, quote, fulfil and invoice your orders; to meet our legal obligations, including tax and e-invoicing record-keeping; to contact you about your account and orders; and to keep the platform secure. We rely on the performance of our contract with you, our legal obligations, and our legitimate interests.

3. Where it is stored

The platform's database and application are hosted in Frankfurt, Germany (European Union). Transactional emails are sent through a provider based in the United States. These transfers outside the Kingdom are made in accordance with the PDPL and its implementing regulations, with safeguards including encryption in transit and at rest and strict access controls.

4. Who we share it with

We do not sell personal data. We share it only with service providers who operate the platform on our behalf (hosting, email), with banks for payment processing, and with ZATCA or other authorities where the law requires.

5. Supplier confidentiality

A supplier's name, details and contacts are confidential: they are never shown to any customer, visitor or other supplier on the platform. Kayan sells under its own name; customers see only the product, its specifications, country of origin and lead time — never the supplier's name.

The cost prices a supplier sends and the spec sheets and documents it uploads are seen only by Kayan's responsible team, and are never published or shared with customers or competitors.

This is enforced in the database with permissions per role, not merely hidden in the interface.

We disclose a supplier's data to no third party without its consent, unless the law requires it — for example regulators or the tax authority.

6. Marketing messages

We send offers or announcements only with your consent — at registration or from "Notifications & offers" in your account, where you choose the kinds you want.

Every marketing message has a one-click unsubscribe link, and you can change your choice any time. Notices about your RFQs, quotes and invoices are not marketing and always reach you.

7. How long we keep it

Account data is kept while your account is active. Transaction and tax records are kept for the periods required by Saudi tax and commercial law, after which they are deleted or anonymised.

8. Your rights

Under the PDPL you may ask to be informed about the processing of your data, to access or obtain a copy of it, to correct it, and to have it destroyed where we no longer need to keep it by law. You may also lodge a complaint with the Saudi Data and AI Authority (SDAIA).

To exercise these rights, email info@etizaz.com. We aim to respond within 30 days.

9. Cookies

We use only cookies that are strictly necessary to keep you signed in and remember your language. We do not use advertising or cross-site tracking cookies.

10. Security

Access to data is restricted by role and enforced at the database level, all traffic is encrypted, and changes to business records are logged.

11. Changes

We may update this policy. The version published here, with its date, applies from publication.