Privacy policy

Last updated: 11 October 2026

This policy explains how Sahab Gold processes personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

1. Who we are

Sahab Gold, Riyadh, Kingdom of Saudi Arabia, is the controller of personal data processed through the Platform. Contact our privacy team through the contact page.

2. Data we collect

Account data: name, email, mobile number, password (stored hashed).
Order data: delivery address, items purchased, invoices, payment status. Card numbers are processed by our payment gateway and never stored by us.
Identity data: where required by anti-money-laundering rules for high-value precious-metal purchases.
Seller data: commercial registration, licences, VAT number and bank details.
Usage data: device and browser information, pages viewed, search terms and cookies (see the Cookie policy).
Communications: messages with sellers and support.

3. Why we use it (legal basis)

To create your account and fulfil orders — performance of a contract.
To issue tax invoices, keep accounting records and meet anti-fraud and AML obligations — legal obligation.
To send order updates by email/SMS — performance of a contract.
To send newsletters and gold-rate alerts — your consent, which you can withdraw at any time.
To secure and improve the Platform — legitimate interest, balanced against your rights.

4. Who we share it with

Only what is needed: the Seller fulfilling your order, the payment gateway, couriers, SMS/email providers, the Zakat, Tax and Customs Authority and other authorities where required by law. We do not sell personal data.

5. Transfers outside the Kingdom

Some service providers may process data outside Saudi Arabia. Any such transfer is made only as permitted by the PDPL and its regulations, with appropriate safeguards.

6. Retention

Account data is kept while your account is active. Invoices and accounting records are kept for the period required by tax and commercial laws. Other data is deleted or anonymised when no longer needed.

7. Your rights

You have the right to be informed, to access your data and obtain a copy, to request correction, to request deletion when the data is no longer needed, and to withdraw consent. You can update your details or delete your account from My account, or contact us. You may also complain to the Saudi Data & AI Authority (SDAIA).

8. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and regular reviews. If a breach affects your data we will notify you and the competent authority as the law requires.

9. Children

The Platform is not intended for persons under 18.

10. Changes

We will post updates on this page and notify you of material changes.