Local Supplies ("Build") is committed to protecting the personal data of its customers, suppliers, and carriers under Saudi Arabia's Personal Data Protection Law (PDPL, Royal Decree M/19) and its implementing regulations issued by the Saudi Data and AI Authority (SDAIA). This policy explains what data we collect, why, and your rights over it.
1. Data We Collect
We collect data based on how you use the platform:
- Suppliers & carriers: contact name, job title, email (verified via OTP), mobile number, establishment name, country, commercial registration number, material categories or transport services, bank account details (IBAN), and uploaded documents (commercial registration, bank letter, registration certificates).
- Customers (supply requests): contact and company name, email (verified), mobile number, project name, delivery location (national address short code or city/district), item details, and attached files (bills of quantities, drawings).
- Technical data: IP address for abuse prevention (e.g. Cloudflare Turnstile verification), and basic site usage data.
2. Purpose & Legal Basis
We process your data under one of the following legal bases recognized by the PDPL:
- Contract performance / your request: registering suppliers and carriers, processing supply requests, and issuing quotes.
- Legitimate interest: identity verification via OTP, protection against automated abuse (bots), and preventing duplicate registrations.
- Consent: non-essential analytics cookies (see our Cookies Policy).
- Legal obligation: retaining commercial and accounting records as required under applicable Saudi law.
3. Sharing Data with Third Parties
We do not sell your data. We share the minimum necessary data with trusted service providers acting on our behalf, including: our ERP provider (Odoo) for storing registration and request records, our email provider (Resend) for sending verification codes and notifications, and Cloudflare for protection against automated abuse. These providers are contractually bound to process data only for the purposes we specify.
4. Cross-Border Data Transfer
Some data may be hosted or processed by technology providers with data centers outside Saudi Arabia, within the exceptions permitted by the PDPL when necessary to deliver the service you requested, and with appropriate contractual and technical safeguards providing a level of protection equivalent to Saudi requirements.
5. Data Retention
We retain your data for as long as necessary to fulfill the purpose it was collected for, or as required by applicable Saudi laws (such as tax and commercial regulations), whichever is longer. Afterward, data is securely deleted or anonymized.
6. Data Security
We apply appropriate technical and organizational safeguards, including: email verification via OTP, protection against automated requests via Cloudflare Turnstile, encrypted connections (HTTPS), and access restricted to authorized personnel on a need-to-know basis.
7. Your Rights Under the PDPL
Under the Personal Data Protection Law and its regulations, you have the right to:
- Obtain a copy of your personal data held by us.
- Request correction of inaccurate or incomplete data.
- Request destruction of data no longer legally required to be retained.
- Withdraw consent to any consent-based processing (such as analytics cookies) at any time.
- Lodge a complaint with the Saudi Data & AI Authority (SDAIA) if you believe we have not complied with the law.
To exercise any of these rights, email us at cs@build.sa.
8. Cookies
We use essential and analytics cookies — full details are in our Cookies Policy.
9. Updates to This Policy
We may update this policy as our processing practices or applicable regulations change. Material updates will be posted on this page along with the last-updated date.
Last updated: July 2026.