1.What is collected
Account and contact details, the commercial registration and VAT number, delivery addresses, order and payment history, and the usual technical records a website keeps — device, browser and IP address.
2.Why it is used
To open and run the account, place and deliver orders, issue invoices, assess credit, prevent fraud, and improve what the catalogue shows this buyer.
3.Who it is shared with
Only those who need it to complete what the buyer asked for. Data is never sold.
4.Vendors
A vendor receives what it needs to fulfil its own lines: the items, the quantity, the delivery address and a contact. It does not receive payment details or what was bought from anyone else.
5.Payment providers
Card and SADAD transactions are handled by licensed providers. Full card numbers are never stored on Disty's systems.
6.Tax authority
E-invoices are reported to ZATCA as Saudi law requires. This is a legal obligation, not a choice, and it cannot be opted out of while trading on the platform.
7.How long it is kept
Transaction and invoice records are kept for the statutory retention period. Everything else is kept while the account is open and for a reasonable period after it closes.
8.Security
Access is restricted to staff who need it, connections are encrypted in transit, and administrative access is logged. Breaches that affect a buyer are notified.
9.Rights
A buyer may ask for a copy of their data, ask for it to be corrected, or ask for deletion of anything not held under a legal obligation. Requests are answered within 30 days.
10.Cookies
A session cookie keeps the buyer signed in — it is required for the site to work. Analytics cookies measure use in aggregate and can be declined without losing any function.
11.Contact
Privacy questions and data requests go to privacy@disty.app.