This Privacy Policy (the "Privacy Policy" or "Policy") describes how Al Tamkeen Al Hadeeth Trading Company (شركة التمكين الحديث للتجارة), Commercial Registration No. 1010635193, VAT No. 310569706500003 (the "Company", "Bonya", "we", "us", or "our"), as the operator of the Bonya Web Platform — comprising the Bonya web dashboard, the customer and carrier/supplier portals, and the public website (together, the "Platform") — collects, uses, shares, protects, and retains personal data.
Bonya operates a business-to-business (B2B) technology platform in the construction-materials, transportation, and logistics sector. The Platform connects the parties involved in ordering, arranging, and fulfilling transport and delivery — including customers and business accounts, carriers and transport companies, operations and administrative users, and authorized company representatives.
We are committed to processing personal data lawfully, fairly, and transparently, and to protecting privacy in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where the law requires consent for a specific processing activity, we will seek that consent separately.
This Policy applies to personal data that Bonya processes as a data controller through the Bonya Web Platform (web dashboard, portals, and public website) and directly related systems. It covers:
This Policy does not govern:
Where a specific notice is presented at the point of collection, that notice supplements this Policy.
We collect only the categories of personal data relevant to operating a B2B logistics web platform and public website. The categories are detailed in Sections 5–17. At a high level, they include account and registration data, business/company data, customer and carrier data, driver-related and vehicle data (as processed through the Platform), order/trip/shipment data, pickup/delivery data, location data (where applicable), documents and proof of delivery, payment and financial data, communications and support data, and website/technical data.
We collect data directly from Users (for example, at registration or when creating an order), automatically through use of the Platform (for example, technical logs), and from other parties where relevant (for example, a linked customer, carrier, or service provider). We do not knowingly collect more data than necessary, and we do not process Sensitive Data unless there is a valid legal basis and, where required, explicit consent.
Data about other persons. When you provide personal data about another person (for example, a recipient, a site contact, or another company representative), you confirm that you are entitled to share it and, where required, have that person's consent or another lawful basis. You act as an independent controller for that data and agree to indemnify Bonya against any claim arising from your provision of it.
Sensitive data. Please do not include sensitive personal data (such as data revealing health, religious or political belief, or security/criminal records) in free-text fields, messages, or uploaded files unless strictly necessary. If you do, we process it only to the extent adequate, relevant, and necessary for the purposes described in this Policy.
Providing your data. Providing certain data is necessary to use the Services — for example, to create an account or fulfil an order; if you do not provide it, we may be unable to provide the relevant Service. Other data is optional.
You are responsible for the accuracy of registration information and for the confidentiality of login credentials.
Because the Platform is B2B, we collect information about the organizations that use it, which may include:
Company data is used to establish, verify, and manage business accounts and to operate the Services.
For customers (and their authorized users), we process the account, contact, and order-related data needed to receive requests and manage the delivery of materials and transport services, including order details, delivery locations, and related requirements provided by the customer.
For carriers/transport companies (and their authorized users), we process account, contact, fleet, and operational data needed to coordinate dispatch and fulfilment, such as available vehicles, stations, pricing/availability data provided by the carrier, and assignment and trip data.
To coordinate transport, the Platform may process driver-related and vehicle information that is visible to, or handled by, authorized users, such as driver name and contact for a trip, vehicle type/capacity, and plate number. Detailed driver data processed through the Bonya Driver App is governed by the Driver App Privacy Policy; on the Web Platform, such data is processed only to the extent needed to arrange, assign, and evidence transport.
We process transport orders and trip data created and managed through the Platform, including order details, materials/quantities/tonnage, assigned carriers/vehicles, trip status, timing, distances, and related operational events. This data is essential to operate, track, and evidence the Services.
We process pickup and delivery/receiving information, including pickup and drop-off locations, scheduling, recipient/site details provided by the parties, and delivery status. This information is used to coordinate and complete transport and to evidence performance.
Where the Platform offers location/tracking features, location information may be processed and displayed in connection with an active trip — for example, to allow a customer to track an in-progress delivery. Location is used for operational purposes only, and its availability/accuracy is not guaranteed. The Platform does not continuously monitor individuals outside the operational purpose. Where applicable, location and time-at-site data may be used to record loading/offloading waiting time and to calculate any related waiting or demurrage charges.
Where the Platform allows uploading documents — such as legal documents, logos, stamps, loading/weighbridge/delivery tickets, or proof of delivery/receiving — we process those files to operate accounts, verify orders and delivery, and handle disputes. You are responsible for the accuracy and legality of documents you upload.
In connection with invoicing, payments, and settlements between the parties, we process invoice details, transaction records, amounts, VAT information, and payment status. Where card or online payments are offered, they are processed by a third-party payment provider, and Bonya does not store full bank-card numbers unless expressly confirmed otherwise.
We process communications relating to the Platform, including support and customer-service requests, reports, feedback, and messages exchanged through the Platform between authorized parties to coordinate an order. We also process system/service notifications (such as activation, approval/rejection, password reset, and status updates).
When you use the public website or dashboard, we may automatically collect technical information necessary to operate and secure the Platform, which may include IP address, browser and device information, operating system, website/dashboard activity and usage information, and technical/security logs.
The website/dashboard may use cookies necessary to operate the Platform, and (where used) analytics or similar technologies to measure and improve performance. Where required, non-essential cookies/analytics are used only with consent, and you can manage preferences through your browser settings or any provided consent tool.
We use personal data to:
Under the PDPL, we process personal data only where there is a valid legal basis:
| Basis | Typical use on the Web Platform |
|---|---|
| Performance of a contract / the Service | Account management; order processing and assignment; delivery confirmation; invoicing/settlement |
| Legal obligation | Regulatory, tax, transport, and record-keeping requirements |
| Legitimate interests | Security, fraud prevention, dispute handling, analytics, and improving the Services, balanced against rights |
| Consent | Where required — for example, non-essential cookies/analytics or certain marketing |
Where processing is based on consent, it may be withdrawn at any time (without affecting prior lawful processing).
We do not sell personal data, and we do not share it with third parties for their own direct-marketing purposes. We share it only as necessary and lawful, with categories including: parties to an order (Section 21); third-party service providers/processors (Section 22); payment providers (where applicable); insurers, claims processors, and legal advisers where an accident, complaint, dispute, or claim arises; government, regulatory, and judicial authorities where required or permitted by law; and parties to a corporate transaction (merger, acquisition, restructuring, or transfer of assets), subject to appropriate safeguards. In each case we share only what is needed and require appropriate confidentiality and security.
Because the Platform coordinates transport between parties, certain data is shared between the parties to an order so it can be fulfilled — for example, relevant order, pickup/drop-off, contact, vehicle, and status data is shared between the customer, the assigned carrier, and (as needed) the driver/authorized users. Sharing is limited to what is necessary for that order, and, for live location where offered, to the duration of the trip. Where a party is an independent controller, its own privacy practices apply to what it does with data it receives.
We use third-party providers to operate the Platform, which process data on our behalf under agreements requiring appropriate security and confidentiality, or under their own terms where they act independently. Based on Bonya's current stack, these include: mapping/location services (Google Maps), an AI/document-processing service (Google Gemini), notification/messaging infrastructure (Firebase), file storage (Cloudflare R2), email delivery (Resend), and the official WhatsApp Business API for messaging. We name a specific provider only where it is actually used by Bonya.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law, after which it is securely destroyed or anonymized. Retention varies by the type of data, purpose of processing, and regulatory, tax/accounting, dispute, and security requirements. For example, account data is generally retained while the account is active and for a defined period afterwards; order, delivery, and proof-of-delivery records as needed for operational and legal purposes; invoicing/financial records for the statutory accounting period; and technical/security logs for a limited period. We may also create and use anonymized or aggregated data that cannot identify you, and we may share such aggregated or anonymized insights with business partners, suppliers, or carriers for analytics and service-improvement purposes.
We apply appropriate organizational, administrative, and technical measures, which may include access controls on a need-to-know/least-privilege basis, authentication controls, encryption where applicable, secure storage and hosting, network protections, monitoring and logging, periodic security assessments, incident-response processes, staff confidentiality obligations, and security requirements imposed on providers. No electronic system can be guaranteed absolutely secure, and we do not claim to use any specific technology unless confirmed. We maintain secure — and, where appropriate, encrypted — backups of data, which are retained and securely deleted on a defined schedule.
We maintain processes to detect, assess, and respond to personal-data incidents. If a breach likely to cause harm occurs, we will take remedial action and notify the competent authority (SDAIA) and affected individuals where and within the timelines required by the PDPL and its Implementing Regulations.
Some technology providers may process or store data outside the Kingdom of Saudi Arabia. Where personal data is transferred or processed outside the Kingdom, we apply the safeguards required by the PDPL and its Implementing Regulations — which may include transfers to jurisdictions recognized as adequate, appropriate contractual safeguards, transfer risk assessments, and equivalent measures. We do not assume that all data is transferred outside the Kingdom.
Subject to the PDPL and its exceptions, individuals may have the right to be informed; to access their data; to obtain a copy and, where applicable, data portability; to request correction/updating; to request destruction where legally permissible; to withdraw consent where processing is based on consent; to object to or restrict certain processing based on legitimate interest; and to lodge a complaint with SDAIA.
You may submit access, correction, update, or deletion requests through the contact channels in Section 37. We may need to verify your identity, and we will respond within the periods prescribed by law. We may be unable to fulfil some requests — in particular deletion — where retention is required by legal, tax, or accounting obligations, ongoing disputes, fraud prevention, or protection of legal rights. Where you act on behalf of an organization, some requests may be handled through that organization's account administrator.
Accounts may be closed on request or in accordance with the Terms of Service. On closure, we delete or anonymize personal data, except where retention is required for legal, tax/accounting, dispute, fraud-prevention, or legal-rights purposes, after which it is securely destroyed or anonymized.
Where we send marketing or promotional communications, we do so in accordance with applicable law and, where required, with consent, and you can opt out at any time through the provided controls or by contacting us; essential service and transactional messages will still be sent.
The Platform may contain links to, or integrate with, third-party websites or services. Those services are governed by their own privacy policies, and we are not responsible for their practices.
The Platform is a B2B service directed at businesses and professional/authorized users. It is not directed at children, and we do not knowingly collect children's personal data.
We may update this Policy from time to time — for example, to reflect changes in our Services, technology, or legal requirements. We will notify Users of material changes through the Platform or by other appropriate means, and the "Last updated" date indicates the latest version.
We may use automated processes — for example, to match and assign orders, calculate amounts, or detect fraud and security risks — and these may involve profiling (evaluating certain aspects of a person, such as reliability or behaviour). Where a decision producing a legal or similarly significant effect on an individual (such as restricting or suspending an account) is based solely on automated processing, that individual has the right, to the extent provided by law, to request meaningful information about the logic involved, to obtain human review, and to contest the decision. We may decline to disclose specific details where doing so would reveal trade secrets or undermine fraud, crime, or security safeguards, but we take reasonable steps to ensure such processes operate correctly and without unlawful bias.
We may use artificial intelligence, including generative AI, to improve routing, matching, document processing, analytics, fraud detection, and support. Where AI is used, we aim to apply responsible-AI principles — including data minimization, the use of anonymized or pseudonymized data where possible, human oversight of significant outcomes, and testing for accuracy and fairness — and any data shared with a third-party AI tool is subject to appropriate safeguards and the relevant provider's terms. Where AI or automated support tools are used, your personal data remains under our control and is not shared to train third-party AI models, and any AI provider processes it only under our instructions.
If you have a concern about how we handle your personal data, please contact us first using the details in the Contact section so we can address it. If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent supervisory authority.