Privacy Policy

1. Introduction

Arabian Fal International Company Limited ("Arabian Fal", "we", "us", or "our") operates the RPO Tracker platform (the "Platform"), an internal enterprise tool used to manage, track, and certify Resource Purchase Order (RPO) operations across our business lines. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you access and use the Platform.

By creating an account and using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Data We Collect

We collect the following categories of personal data:

• Account Credentials: Username, hashed password, and role assignment (admin, director, project manager, supervisor, or client).
• Profile Information: Full name, mobile number (for SMS credential delivery), job title, and linked RPO assignments.
• RPO & Progress Data: Contract details, line items, progress entries, certification records, and item requests associated with your account.
• Usage & Audit Data: Login timestamps, session tokens, action logs (approvals, rejections, data exports), and IP address where applicable.
• Electronic Signatures: Client signature images uploaded for certification purposes.

3. How We Use Your Data

We process your personal data for the following purposes:

• Authenticating users and managing role-based access to the Platform.
• Tracking RPO operations, progress submissions, and certification workflows.
• Facilitating communication between Arabian Fal staff and authorized client representatives.
• Maintaining immutable audit trails for compliance, security, and dispute resolution.
• Delivering account credentials and notifications via SMS.
• Generating reports and dashboards for internal management and client review.

4. Legal Basis

We process your personal data in accordance with the Saudi Arabian Personal Data Protection Law (PDPL) and applicable regulations. The legal bases for processing include:

• Contractual Necessity: Processing required to provide you access to the Platform and fulfill our business obligations.
• Legal Obligation: Processing required to comply with audit, tax, and regulatory requirements.
• Legitimate Interest: Processing for security, fraud prevention, and internal operations.
• Consent: Processing of mobile numbers for SMS delivery, which you may withdraw at any time.

5. Data Sharing & Disclosure

We may share your personal data with the following recipients:

• Authorized Clients: Progress submissions and certification records are shared with client representatives (e.g., Saudi Aramco, Petro Rabigh, LUBEREF, SABIC, SASREF) for certification purposes.
• Internal Personnel: Directors, project managers, and supervisors with appropriate role-based access.
• SMS Provider: Mobile numbers are shared with our SMS gateway provider solely for credential delivery.
• Infrastructure Provider: Data is hosted on secure cloud infrastructure (Base44) within our service region.

We do not sell your personal data to any third party.

6. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Active Accounts: Data is retained while your account is active and you use the Platform.
• Audit Logs: Retained for a minimum of five (5) years for compliance and dispute resolution.
• Inactive Accounts: Accounts disabled for more than twelve (12) months may have associated data archived or deleted.

7. Your Rights

Under the PDPL, you have the following rights regarding your personal data:

• Right to be informed about how your data is processed.
• Right to access your personal data held by us.
• Right to request correction of inaccurate or incomplete data.
• Right to request deletion of your data, subject to legal retention obligations.
• Right to withdraw consent for SMS notifications at any time.
• Right to file a complaint with the relevant Saudi data protection authority.

To exercise any of these rights, contact your system administrator or our privacy officer.

8. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

• Passwords are stored as salted SHA-256 hashes — never in plain text.
• Session-based authentication with brute-force protection (account lockout after repeated failed attempts).
• Role-based access control (RLS) ensuring users only see data relevant to their role.
• Immutable audit logging of all sensitive actions.
• Server-side data scoping to prevent client-side over-fetching.
• Encrypted data transmission via HTTPS.

9. Third-Party Services

The Platform uses Google Fonts loaded from Google's CDN for typography. This may involve transmission of your IP address to Google. No analytics, advertising, or tracking cookies are used. See our Cookie Policy for details.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the Platform. Continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy inquiries or to exercise your data protection rights, please contact your system administrator or: