Privacy Policy for ENTEK.AI

Privacy Policy for ENTEK.AI
Last Updated: November 12, 2025

Effective Date: November 12, 2025

ENTEK.AI ("Company", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered energy marketplace platform, accessible through entek.ai (the "Site"), our mobile applications, and related services (collectively, the "Services").

This Privacy Policy is designed to comply with the Saudi Personal Data Protection Law (PDPL), the General Data Protection Regulation (GDPR) where applicable, and other relevant data protection regulations.

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services.

Data Controller:
ENTEK.AI
Riyadh, Saudi Arabia
Email: [email protected]
Phone: +966 55 447 8567

Data Protection Officer (DPO):
Email: [email protected]

We collect several types of information from and about users of our Services, including:

3.1 Personal Information You Provide
When you register for an account, place an order, or interact with our Services, we may collect:

Identity Information: Full name, username, date of birth, national ID number (for verification purposes)
Contact Information: Email address, phone number, billing address, delivery address
Account Credentials: Username, password, and security questions
Business Information: For corporate clients and suppliers, we collect company name, commercial registration number, tax identification number, business licenses, and authorized representative details
Financial Information: Payment card details, bank account information, billing information (processed through secure third-party payment processors)
Transaction Information: Order history, purchase details, delivery preferences, payment records

3.2 Information Automatically Collected
When you access our Services, we automatically collect:

Device Information: IP address, browser type and version, operating system, device identifiers, mobile network information
Usage Information: Pages visited, time spent on pages, links clicked, search queries, access times and dates
Location Data: GPS location, Wi-Fi access points, cell tower information (with your permission for delivery tracking and service optimization)
Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to collect information about your browsing behavior. See our Cookie Policy for more details.

3.3 Information from Third Parties
We may receive information about you from:

Business Partners: Payment processors, delivery partners, verification services
Social Media: If you connect your account with social media platforms
Public Sources: Business registries, regulatory databases for supplier verification
Analytics Providers: Aggregated usage statistics and demographic information

3.4 Sensitive Personal Data
We may collect sensitive personal data only when necessary and with your explicit consent, including:

National identification documents (for identity verification)
Financial information (for credit assessment and payment processing)
Location data (for delivery services)

We use the information we collect for the following purposes:

4.1 Service Provision and Performance
Creating and managing your account
Processing and fulfilling orders
Facilitating communication between buyers and suppliers
Providing customer support and responding to inquiries
Delivering products and tracking deliveries
Processing payments and preventing fraud

4.2 AI-Powered Optimization
Matching buyers with suitable suppliers using AI algorithms
Optimizing delivery routes and logistics
Predicting energy demand and supply patterns
Personalizing user experience and recommendations
Analyzing market trends and pricing optimization

4.3 Analytics and Improvement
Monitoring and analyzing usage patterns and trends
Improving our Services, features, and user interface
Conducting research and development
Generating anonymized and aggregated statistics

4.4 Communication and Marketing
Sending transactional emails (order confirmations, delivery updates)
Providing customer service communications
Sending promotional materials and newsletters (with your consent)
Conducting surveys and gathering feedback

4.5 Compliance and Legal Obligations
Complying with legal and regulatory requirements
Enforcing our Terms of Service and other policies
Protecting our rights, property, and safety, and that of our users
Detecting, preventing, and addressing fraud, security breaches, and technical issues
Responding to lawful requests from public authorities

4.6 ESG and Sustainability
Tracking and reporting carbon emissions
Managing carbon offset programs
Supporting Saudi Vision 2030 sustainability goals
Generating ESG reports for corporate clients

We process your personal data based on the following legal grounds:

Consent: You have given explicit consent for specific processing purposes (e.g., marketing communications, location tracking)
Contractual Necessity: Processing is necessary to perform our contract with you (e.g., fulfilling orders)
Legal Obligation: Processing is required to comply with applicable laws and regulations
Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, network security, and business analytics, provided these interests do not override your fundamental rights
Vital Interests: Processing is necessary to protect your vital interests or those of another person

We may share your personal information with the following categories of recipients:

6.1 Service Providers and Business Partners
Energy Suppliers: To fulfill your orders and facilitate transactions
Payment Processors: To process payments securely (e.g., Stripe, PayPal, local Saudi payment gateways)
Delivery Partners: To coordinate and track deliveries
Cloud Service Providers: For data storage and hosting
Analytics Providers: For usage analysis and service improvement
Customer Support Tools: For providing customer service

6.2 Corporate Transactions
In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.

6.3 Legal and Regulatory Authorities
We may disclose your information to:

Government authorities and regulators (Ministry of Energy, SERA, SDAIA, NCA)
Law enforcement agencies in response to lawful requests
Courts and tribunals in legal proceedings
Other parties as required by applicable law

6.4 With Your Consent
We may share your information with other third parties when you have given us explicit consent to do so.

Your personal data may be transferred to, stored, and processed in countries outside the Kingdom of Saudi Arabia, including countries that may not provide the same level of data protection as Saudi Arabia.

When we transfer personal data outside Saudi Arabia, we implement appropriate safeguards, including:

Standard Contractual Clauses (SCCs): Approved by relevant authorities
Data Processing Agreements: With third-party processors
Adequacy Decisions: Transfers to countries deemed to have adequate data protection
Binding Corporate Rules: For intra-group transfers
Certifications: Such as Privacy Shield equivalents or ISO certifications

We conduct Transfer Risk Assessments for all cross-border data transfers involving sensitive data or large-scale processing, as required by the PDPL.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods:

Account Information: Retained while your account is active and for 7 years after account closure for legal and regulatory compliance
Transaction Records: Retained for 10 years for financial and tax compliance
Marketing Communications: Retained until you withdraw consent or for 2 years of inactivity
Cookies and Usage Data: Retained for 12 months unless you delete them earlier
Legal Claims: Retained as necessary for the establishment, exercise, or defense of legal claims

After the retention period expires, we will securely delete or anonymize your personal data.

Under the PDPL and other applicable data protection laws, you have the following rights:

9.1 Right of Access
You have the right to request access to your personal data and obtain a copy of the information we hold about you.

9.2 Right to Rectification
You have the right to request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")
You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

9.4 Right to Restriction of Processing
You have the right to request that we restrict the processing of your personal data under certain conditions.

9.5 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

9.6 Right to Object
You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

9.7 Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

9.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data protection rights have been violated.

SDAIA Contact:
Website: https://sdaia.gov.sa
Email: [SDAIA Contact Email]

9.9 Exercising Your Rights
To exercise any of these rights, please contact us at:
Email: [email protected]
Phone: +966 55 447 8567

We will respond to your request within 30 days of receipt. In some cases, we may require additional information to verify your identity before processing your request.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
Access Controls: Role-based access controls and multi-factor authentication
Network Security: Firewalls, intrusion detection systems, and regular security audits
Employee Training: Regular data protection and security training for all staff
Third-Party Security: Due diligence and contractual obligations for all service providers
Incident Response: Comprehensive data breach response plan

Despite our security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

Notify SDAIA within 72 hours of becoming aware of the breach
Notify affected individuals without undue delay if the breach is likely to result in a high risk to your rights and freedoms
Provide information about the nature of the breach, the likely consequences, and the measures taken to address the breach

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

We use AI and automated decision-making systems to:

Match buyers with suitable suppliers
Optimize pricing and delivery routes
Detect fraudulent transactions
Personalize user experience

You have the right to:

Be informed about the logic involved in automated decision-making
Request human intervention in automated decisions
Express your point of view and contest automated decisions
Opt-out of automated decision-making that produces legal effects or similarly significant effects

Our Services may contain links to third-party websites, applications, and services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of every website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

Posting the updated Privacy Policy on our Site with a new "Last Updated" date
Sending you an email notification (if you have provided your email address)
Displaying a prominent notice on our platform

Your continued use of the Services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

While our primary operations are in Saudi Arabia, we may serve users in other countries. If you are accessing our Services from outside Saudi Arabia, please be aware that your information may be transferred to, stored, and processed in Saudi Arabia and other countries where our service providers operate.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

ENTEK.AI Privacy Team
Email: [email protected]
Phone: +966 55 447 8567
Address: Riyadh, Saudi Arabia

Data Protection Officer:
Email: [email protected]

This Privacy Policy is designed to comply with:

Saudi Personal Data Protection Law (PDPL) - Effective September 14, 2023
General Data Protection Regulation (GDPR) - For EU users
Saudi Central Bank Regulations - For financial data
National Cybersecurity Authority (NCA) Requirements - For cybersecurity
Communication, Space and Technology Commission Regulations - For electronic communications



Acknowledgment: By using ENTEK.AI Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.