1.1 Reliable Accuracy Trading Establishment (trading as STUS | Digital Procurement) ("STUS") is the controller of personal data processed through the Platform, under the Saudi Personal Data Protection Law (Royal Decree No. M/19 of 9/2/1443H, as amended) and its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom (together, the "PDPL"), supervised by the Saudi Data and AI Authority (SDAIA).

1.2 Data Protection contact / DPO: Data Protection Contact, Reliable Accuracy Trading Establishment, email: admin@stus.digital. Please use this contact for any privacy request or question.

1.3 Mandatory acceptance. Before you create an account, and again when we publish a material update, a pop-up on the Platform asks you to read and agree to this Privacy Policy and the Terms by ticking a box. This agreement is mandatory: without it you cannot register or use the Platform. By agreeing you confirm that you have read and understood how we collect, use, share and transfer personal data as described here, including the sharing of RFQs and search activity with Suppliers and transfers outside the Kingdom. Optional choices, such as marketing emails, are requested separately and are not a condition of using the Platform. We keep a record of your acceptance (date, time and version).

Account and identity data: name, business email, mobile number (with country code), job title, company name, the mode you use (buying or selling), and OTP verification records.

Supplier registration data: company CR details, VAT registration details, business address and location, contact person names, positions, emails and phone numbers, product and service details, logos and images, and verification documents.

Activity and content data: search queries, filters used, Listings viewed, RFQs, quotations and messages, agreements generated through the Platform, and support communications.

Billing data: plan selected, billing country, invoice and payment status, and payment references (for example the payer's name, bank and transfer reference). If online payment is offered, card details are collected and processed by our payment service provider and are not stored by STUS. STUS does not process payments between Buyers and Suppliers.

Technical data: IP address, device and browser type, language, time zone, approximate location (for example to suggest your phone country code), log data, and cookies as described below.

We do not intentionally collect sensitive personal data (such as health, religion, or biometric data) and ask that you do not submit it.

directly from you when you register, complete a profile, search, send an RFQ or contact us;

automatically through your use of the Platform;

from Suppliers, who may provide contact person details for their colleagues (the Supplier must have the right to do so);

from publicly available business sources and registries, when building or updating supplier Listings, limited to business information.

Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing. Withdrawal may limit certain features.

We do not sell, rent or trade personal data, and we do not give email addresses or other contact details to advertisers, data brokers or other companies for their own advertising or marketing. We share it only as follows:

Other users: Contact details are shared between a Buyer and a Supplier only when both hold an active paid plan and each chooses to share them; an RFQ, with the Buyer's company name and country, is shown to the Suppliers STUS matches to it (in preview form to Suppliers without an active plan); all messages between them stay in the STUS inbox.

Service providers (processors) acting on our instructions: cloud hosting and deployment (Vercel), database and caching (Upstash), transactional email (Resend, Zoho Mail), payment processing (our payment service providers, if online payment is offered), and AI language processing (Anthropic) used to interpret search queries. Each is bound by contract to protect data and use it only for our purposes.

Professional advisers, auditors and insurers under confidentiality duties.

Authorities, courts and regulators where required by law or to protect rights and safety.

Successors, in a merger, restructuring or sale of the business, subject to this Policy.

Search activity and RFQs. To connect Buyers and Suppliers, we may tell Suppliers about search activity. Suppliers without an active plan see only general information, such as the number of searches in a category. Suppliers with an active plan may see the product searched and the searching company's name and country. We do not reveal the name, email address or phone number of an individual in these alerts. We do this to provide the service and in our legitimate interest in connecting Buyers and Suppliers. You can ask us to withhold your company name from alerts by emailing admin@stus.digital.

Some of our service providers operate servers or support teams outside Saudi Arabia. Where personal data is transferred or made accessible outside the Kingdom, we do so only as the PDPL permits, using the mechanisms in the Transfer Regulations (such as approved standard contractual clauses, binding common rules, adequacy or another lawful ground), applying appropriate safeguards, limiting what is shared to what is necessary, and documenting the transfer. Details of the safeguards are available on request at admin@stus.digital.

Search text you enter may be processed by an AI language model provider to interpret your request and match it to suppliers. Please do not enter confidential or personal information about third parties into search boxes. Results are produced to assist you; no decision with legal effect on you is made solely by automated means. You may contact us to ask how automated processing is used.

If no registered Supplier matches your search, the Platform may show suggestions generated by AI, clearly labelled as AI suggestions and not STUS Suppliers. Your search text is processed as described above.

We use cookies and similar technologies that are strictly necessary (session, login, security, language and preferences). Where we use analytics or non-essential cookies, we will ask for your consent first and you can change your choice at any time. You can also block cookies in your browser settings, but parts of the Platform may not work.

We keep personal data only as long as necessary for the purposes in this Policy:

Account and profile data: while your account is active and for up to twenty-four (24) months after closure, unless a longer period is required by law or to handle a dispute.

Billing and tax records: for the period required by Saudi commercial, accounting and tax laws.

Support and RFQ records: for up to twenty-four (24) months after the matter ends.

OTP and security logs: for the shortest period needed for security and fraud prevention.

When data is no longer needed, we delete or anonymise it securely.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, role-based permissions, OTP authentication, secure deployment practices, and regular security review. No system is completely secure. If a breach affects personal data, we will notify SDAIA and the Ministry of Commerce where required, and notify affected individuals where there is a risk to them, within the timeframes required by law.

Under the PDPL you have the right to:

be informed about how your data is collected and used;

access your personal data and obtain a copy in a readable format;

request correction of inaccurate or incomplete data;

request destruction (deletion) of data we no longer need or are not entitled to hold;

withdraw consent at any time;

object to certain processing and to direct marketing.

To exercise a right, email admin@stus.digital from your registered address. We may verify your identity first and will respond without undue delay and within the period set by the PDPL. Some rights are subject to legal limits, for example data we must keep by law.

If your name or business contact details appear on a Listing and you did not provide them, or you no longer wish to be listed, contact admin@stus.digital. We will verify the request and correct, anonymise or remove the personal data, and where appropriate the Listing, promptly. Suppliers who provide colleagues' details confirm that they have informed those individuals and have a lawful basis to share the data.

We send marketing emails only with your consent or where otherwise permitted by law. Every marketing message includes an unsubscribe option. Service and legal notices are not marketing and may still be sent.

Marketing consent is requested separately from acceptance of the Terms, through an unticked option or a clear opt-in, and is never a condition of using the Platform. We use your email address only for service messages and, where you opted in, for STUS's own updates. We never sell, rent or disclose email addresses to advertisers, data brokers or other companies for their own advertising, and we do not use them to target third-party advertisements. You can withdraw consent at any time using the unsubscribe link or by emailing admin@stus.digital.

We may use data in anonymised, aggregated form (for example search volumes by category or country) for statistics and to improve the Platform. Such data does not identify you.

The Platform is for businesses and professionals aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.

We may update this Policy to reflect changes in law, services or providers. We will post the new version with its effective date and notify you of material changes before they take effect where required.

Reliable Accuracy Trading Establishment (trading as STUS | Digital Procurement) | CR No. 4030558135 | VAT No. 311092264500003 | Al Zahra District, Jeddah, Kingdom of Saudi Arabia | admin@stus.digital | stus.digital

If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and AI Authority (SDAIA) through its official channels.