Skip to content
Procurement Hub team in a meeting room presentation in Riyadh, Saudi Arabia

Privacy Policy

Last updated: August 24, 2026

Procurement Hub ("we", "us", "the Company") is committed to protecting the privacy and personal data of everyone who visits our website, uses our services, or communicates with us — including customers, prospective customers, job applicants, and website visitors.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it. This policy is issued in accordance with the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, and its Executive Regulations (together, the "Law"), the implementation of which is overseen by the Saudi Data and Artificial Intelligence Authority ("SDAIA"). If you have any questions about this policy or how we handle your data, please contact us using the details in Section 12.

1. Who We Are

Procurement Hub is a Saudi company founded in 2016, specializing in providing procurement solutions, contract management, and supplier management for organizations across the Kingdom. For the purposes of the Law, Procurement Hub is the data controller with respect to personal data collected through this website and our services.

2. Scope of This Policy

This policy applies to personal data we collect through:

  • Our website procurementhub.sa and all of its pages and subdomains
  • Our appointment and demo-booking system
  • Contact and inquiry forms
  • Our website's chatbot
  • Email correspondence with us
  • Any other interaction you have with us as a customer, prospective customer, or visitor

This policy does not cover the practices of third-party websites we may link to, nor third parties that collect your data independently (for example, when you interact with us on LinkedIn, that platform's own privacy policy applies to that interaction).

3. Personal Data We Collect

Depending on how you interact with us, we may collect:

  • Identity data — full name, job title, organization name
  • Contact data — email address, phone number, organization address
  • Booking data — appointment date and time, purpose of the meeting, notes provided when booking a demo
  • Correspondence data — messages you send us via contact forms, the chatbot, or email, including their content
  • Technical data — IP address, browser type, device type, general location (city/country level), pages visited, referring site
  • Cookie and tracking data — as described in our Cookie Policy, including analytical and functional cookies

We do not intentionally collect sensitive personal data (such as health data, or religious or political affiliation, or biometric data) through this website. If you voluntarily provide such data (for example, in a free-text field), we will handle it in accordance with the additional safeguards the Law requires for sensitive data, and we encourage you not to share such information with us unless necessary.

4. How We Collect Your Data

  • Directly from you — when you fill out a contact form, book a demo appointment, chat with our chatbot, or email us
  • Automatically — through cookies and similar technologies as you browse our website (see our Cookie Policy)
  • From third parties — in limited cases, such as a colleague referring you to us and providing your contact details on your behalf

5. Why We Process Your Data, and Our Legal Basis

Under the Law, we only process personal data when a valid legal basis is available. We rely on the following:

  • Responding to your inquiries and booking requests — necessary to take steps at your request prior to entering into a contract with you
  • Providing and managing our services for existing customers — performance of a contract
  • Sending appointment confirmations and reminders — performance of a contract / at your explicit request
  • Improving our website and services — our legitimate interest, balanced against your rights and fundamental freedoms
  • Sending marketing communications — your explicit consent, which you may withdraw at any time
  • Compliance with legal and regulatory obligations — compliance with a legal obligation under Saudi law
  • Using non-essential cookies and technologies — your consent, given via our cookie consent banner

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure the site works correctly, remember your preferences, and understand how visitors use our website. We use a cookie consent management tool that lets you review and control which categories of cookies you allow, beyond those strictly necessary for the site to function.

You can manage your cookie preferences at any time through the cookie settings icon available on our website, or through your browser settings. For full details on the specific cookies we use, their purpose, and their duration, please refer to the cookie preferences panel available on this site.

7. Who We Share Your Data With

We do not sell your personal data. We only share personal data with the following categories of parties, and only to the extent necessary:

  • Service providers who process data on our behalf, under written agreements requiring them to protect your data in a manner consistent with the Law, including: website hosting and infrastructure providers; email delivery providers, used exclusively for operational correspondence such as appointment confirmations; our appointment-booking system provider; our website's chatbot provider; and analytics and cookie-consent management providers
  • Professional advisors (legal, accounting, financial) where necessary for our legitimate business operations
  • Regulators and public authorities, where we are legally required to disclose data (for example, to SDAIA or other competent Saudi authorities) — we assess and document such requests in accordance with the Executive Regulations
  • A legal successor, in the event of a merger, acquisition, or sale of business assets, subject to the same protections described in this policy

8. International Data Transfers

Some of the service providers referenced in Section 7 may process personal data using infrastructure located outside the Kingdom of Saudi Arabia.

When we transfer personal data outside the Kingdom, we do so only when the Law's cross-border transfer requirements are met — including, as applicable, verifying an adequate level of protection at the receiving party, or putting in place contractual safeguards approved by SDAIA, and ensuring the transfer does not undermine your ability to exercise your rights under the Law or the Kingdom's national interests.

We maintain a record of our data processors and the locations where data is processed, available on request as described in Section 12.

9. Data Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or regulatory requirements under Saudi law.

  • Booking and inquiry data — retained for the duration of our relationship with you, and for a reasonable period afterward to address any follow-up, legal, or contractual matters
  • Marketing consent data — retained until you withdraw your consent
  • Cookie data — retained according to the duration specified for each cookie in our consent management tool

When personal data is no longer needed, we securely delete or anonymize it.

10. How We Protect Your Data

We apply appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or destruction, in line with the Law's data security requirements. These measures include:

  • Encryption of data in transit (HTTPS/TLS) across our website
  • Access controls limiting personal data access to authorized personnel only
  • Regular review of our security practices and third-party service providers
  • Internal procedures to identify, assess, and respond to any potential data breach, including notifying SDAIA and affected individuals without undue delay where the Law requires it

No method of data transmission or storage is 100% secure, and while we work hard to protect your personal data, we cannot guarantee its absolute security.

11. Your Rights Under the Law

As a data subject, you have the following rights regarding your personal data:

  • Right to be informed — to know the legal basis and purpose for collecting your personal data
  • Right of access — to request a copy of the personal data we hold about you
  • Right to correction — to request correction of inaccurate or incomplete personal data
  • Right to deletion/destruction — to request destruction of your personal data when it is no longer necessary for the purpose it was collected for, subject to any legal obligations to retain it
  • Right to withdraw consent — to withdraw any consent you previously gave, at any time, without affecting the lawfulness of processing before withdrawal
  • Right to restrict processing — in certain circumstances
  • Right to be notified of a data breach — where a breach is likely to cause serious harm to you or your data

To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request within the timeframe required by the Law and its Executive Regulations. We may need to verify your identity before processing certain requests.

If you believe we have not handled your personal data in accordance with the Law, you have the right to file a complaint with SDAIA.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have any concerns about how we handle your personal data, please contact us:

Procurement Hub
Email: info@procurementhub.sa
Address: Riyadh – Northern Ring Road – Al Wadi District – Office 24
Phone: 0112666628

13. Marketing Communications

If you have consented to receive marketing communications from us, you may withdraw your consent and unsubscribe at any time using the unsubscribe link in any marketing message we send, or by contacting us directly. We do not use sensitive personal data for marketing purposes, and we do not sell or rent your contact data to third parties for their own marketing purposes.

14. Children's Privacy

Our website and services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable laws, including any future guidance issued by SDAIA. We will post any updates on this page with a revised "last updated" date. We encourage you to review this policy periodically.

16. Governing Law

This Privacy Policy is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Executive Regulations. Any disputes arising from this policy are subject to the exclusive jurisdiction of the competent courts of the Kingdom of Saudi Arabia.

This policy is available in both Arabic and English. In the event of any conflict between the two versions, the Arabic version shall prevail.