سياسة الخصوصية

1. Who we are and the scope of this policy

Dirajiti Trading Establishment ("Dirajiti") is the data controller that determines the purposes and means of processing for providing our services. This policy explains privacy practices related to the www.dirajiti.com website, purchases from our branches, customer service communication, and warranty, maintenance, and after-sales services. We are committed to the Saudi Personal Data Protection Law and its relevant regulations and amendments.

2. Data we process and its sources

Data varies depending on the service you use, and we limit it to what is necessary for a specific purpose. Data may include: name and contact details, account and login data, delivery address and recipient details, product, order, invoice, shipping, return, warranty, and maintenance details, and communications and attachments you provide to customer service.

Transaction data includes what is necessary to confirm payment or refund, such as amount, payment method, reference, and status, and may include limited payment information displayed by the service provider. Card data is entered into the payment provider’s interface; do not send us full card numbers, security codes, or verification codes via email or chat.

Technical data may be collected automatically, such as IP address, device and browser type, pages visited and interaction, cookie identifiers, and preferences. We may receive payment completion and delivery data from these service providers, or your order data from systems connected to the store. When collecting data from others, we observe requirements for notifying you and the legal justifications for collection.

3. Purposes and grounds for processing

We process data necessary to receive, confirm, prepare, and deliver orders, and to manage accounts, customer service, returns, warranties, and maintenance, based on the execution of the contract to which you are a party or other applicable legal grounds. We process billing, record-keeping, and disclosure data as required to fulfill legal obligations.

We may rely on legitimate interest to protect systems, prevent fraud, and improve service, after assessing necessity, proportionality, and the impact of processing on your rights, in accordance with legal conditions. When relying on consent, we explain the purpose and obtain the necessary consent for it; simply viewing the policy or placing an order is not considered general consent for marketing or purposes unrelated to the order.

4. Mandatory and optional data

Data necessary for order fulfillment, such as contact method and delivery address for shipping, is required for the relevant service; its fulfillment may be delayed or impossible if sufficient and correct data is not provided. Subscription to marketing and data not necessary for the service is optional. We clarify required fields upon collection and do not request data beyond the service needs or legal requirements.

5. Sharing data and service providers

We do not sell or rent your personal data. We may disclose necessary portions of order, contact, delivery, and transaction data to operators of the store, hosting, technical systems, billing, shipping companies, payment and installment service providers, customer service, and analytics and marketing providers based on the service used and the applicable legal ground. We also disclose to competent authorities when there is a legal or judicial requirement.

Our store operates on the Shopify platform. When choosing payment or installment services, such as Tabby or Tamara, the provider may process your data for its own legal purposes according to its policy; it may be an independent controller for that processing. What we share is limited to what the service requires, and we observe appropriate safeguards and agreements when using parties that process data on our behalf. You can contact us to find out the entities related to your order.

6. Storage and processing outside the Kingdom

Your data may be stored or processed inside or outside the Kingdom through Shopify and store-related service providers, including countries such as Canada and Singapore, depending on the service and its provider. Operating the store in Saudi Arabia does not mean that all processing operations take place within it.

Transfers and disclosures outside the Kingdom are subject to the requirements of the law and the regulations for transferring personal data outside the Kingdom, including lawful purpose, appropriate safeguards, risk assessment when required, and consideration of subsequent transfers. You can request information about the geographic scope of processing and the safeguards associated with the service through the privacy channel indicated below.

7. Cookies and similar technologies

Cookies and similar technologies are used to run store functions, such as the cart, login, security, and saving preferences. They may also be used for analytics, performance measurement, or advertising according to the tools used and the legal ground, with consent obtained where required. Their retention period varies according to the type of file and the entity placing it; some expire upon closing the session, while others remain for a specific period or until deleted.

You can manage or delete cookies from your browser settings; disabling necessary cookies may affect the cart, login, or order completion. For inquiries about tracking tools or exercising your rights regarding them, please contact us. Viewing this policy is not a substitute for obtaining the necessary consent.

8. Marketing communications and withdrawing consent

We distinguish between order fulfillment and service messages and marketing messages. Direct marketing via email, SMS, or WhatsApp requires your consent in accordance with legal requirements; we do not require a marketing subscription to complete a purchase.

You can unsubscribe using the unsubscribe method available in the message or by a clear request to info@mybikesa.com. We stop direct marketing without unjustified delay after withdrawing consent. This does not affect necessary order messages or processing based on a legal obligation or other justification.

9. Retention and destruction

Invoices, records, and accounting documents subject to tax requirements are retained for at least six years from the end of the relevant tax period, or longer when required by law. This period does not automatically apply to all personal data.

Order, warranty, and maintenance data are retained to the extent and for the duration necessary to fulfill obligations and handle claims. Account data is retained as long as the account is active and there is a legitimate need for it, and communication duration is determined by its purpose and the continued need for it. Upon withdrawing marketing consent, the processing based on it is stopped, while retaining the minimum necessary to verify the choice and prevent re-sending where allowed by law.

After the purpose and legal retention period end, data is destroyed or anonymized in a way that prevents the identification of its owner, considering backups and related systems. We may retain specific data when there is a dispute, claim, or legal obligation that requires it, and then dispose of it when the reason for retention no longer exists.

10. Your rights and how to exercise them

You have, subject to legal conditions and exceptions, the right to know how your data is processed, to access it, to obtain a readable and clear copy, to request its correction, completion, or update, to request its destruction when the need ends or a legal reason exists, and to withdraw consent when it is the basis for processing. You may request to restrict processing while verifying data accuracy in cases established by law.

Send your request to info@mybikesa.com, specifying the right requested and sufficient data to find your record, such as the order number or the contact method used. We verify your identity by an appropriate and proportional method before disclosure or execution; do not send a copy of your ID initially, and any additional document is requested only when necessary and as permitted by law.

We fulfill requests to exercise rights within a period not exceeding 30 days without delay; this may be extended by an additional 30 days when legal justifications are met, with prior notification of the extension and its reasons. If a request or part thereof cannot be fulfilled for a legal reason, we clarify the reason as permitted by law. Deleting an account does not entail deleting records that must be retained by law.

11. Data protection and data breaches

We take organizational, administrative, and technical measures appropriate to the nature of the data and the risks of its processing to protect it from unauthorized access, disclosure, modification, or unlawful loss, and we restrict access to work and service requirements. No technical means can absolutely guarantee the prevention of all risks. Please be careful to protect login details and not share verification codes.

In the event of a data breach, we assess its impact and take containment and remediation measures, and we notify the competent authority within the legal period, including 72 hours from becoming aware if reporting conditions are met, and we notify the data subject without unjustified delay when required by law.

12. Children's data and others' data

Purchasing products intended for children does not require us to be provided with the child's data. When it is necessary to process data of a minor or a person lacking capacity, we ensure the consent of their legal guardian and verify guardianship where necessary. If we become aware of unlawful processing of a child's data, we take appropriate measures to stop it and destroy the data in accordance with the law.

If you provide us with data of another recipient, limit it to what is necessary for delivery, ensure that its provision is based on a legal ground, and inform them of this policy.

13. Complaints and contact

Data Controller: Dirajiti Trading Establishment — Riyadh, Kingdom of Saudi Arabia.

For inquiries, rights requests, and privacy-related complaints: info@mybikesa.com. Please write "Privacy Request" in the email subject line to facilitate routing. You have the right to file a complaint with the Saudi Data and AI Authority (SDAIA) via the National Data Governance Platform in accordance with legal procedures.

14. Updating the policy

We update this policy when processing practices or legal requirements change, and we publish the updated version and its date on this page. We clarify material changes by an appropriate method and request new consent when legally required. Continued use of the website alone is not considered consent to a new purpose that requires consent.