1. Overview
DemandSa ("we", "us", "our") operates an on-demand home-services marketplace across the Kingdom of Saudi Arabia. This Privacy Policy explains how we collect, use, disclose and protect personal data when you use our website, mobile app, and related services (the "Services").
We comply with the Saudi Personal Data Protection Law (PDPL) issued by Royal Decree M/19 and implementing regulations issued by the Saudi Data & AI Authority (SDAIA).
2. Data We Collect
- Account data: name, phone number, email, password (hashed), profile photo.
- Booking data: service requested, address, time slot, special instructions, attached photos.
- Payment data: tokenized card details, Mada/STC Pay/Apple Pay identifiers, billing address, invoice history. Full PAN data is held by our PCI-DSS Level 1 payment processors — never by DemandSa.
- Device & usage data: IP address, device model, OS version, app version, crash logs, in-app actions.
- Location data: precise location only when you grant permission, to match you with nearby pros and enable arrival tracking.
- Communications: in-app chat, support tickets, call recordings (where notice is given) for quality assurance.
3. How We Use Your Data
- To create and operate your account.
- To match you with vetted professionals and dispatch jobs.
- To process payments, refunds and invoices.
- To prevent fraud, abuse and unauthorized access.
- To send transactional notifications (booking confirmations, ETAs, receipts).
- To send marketing — only with your opt-in consent and always with a one-tap unsubscribe.
- To improve safety, reliability, and the quality of recommendations.
4. Legal Bases
We process personal data on the following bases under PDPL Article 6:
- Contract: to deliver bookings and payments you request.
- Legal obligation: tax records, anti-money-laundering, court orders.
- Legitimate interest: fraud prevention, security, service improvement.
- Consent: marketing, precise location, optional analytics.
5. Sharing
We share data only with:
- The professional you book (name, contact, address, job details).
- Payment processors (HyperPay, PayTabs, Tap, Stripe).
- Cloud, analytics and crash-reporting vendors under data-processing agreements.
- Saudi government authorities when required by law.
We never sell personal data.
6. International Transfers
Where data is processed outside the Kingdom, we rely on adequacy decisions or Standard Contractual Clauses approved by SDAIA, plus encryption in transit and at rest.
7. Retention
- Account data: while your account is active, plus 90 days after closure.
- Booking & invoice data: 7 years (Saudi tax law).
- Support recordings: 12 months.
- Marketing logs: until you withdraw consent.
8. Your Rights
Under PDPL you may, at any time:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion (subject to legal retention).
- Withdraw consent for marketing or location.
- Lodge a complaint with SDAIA.
Email privacy@demandsa.com and we will respond within 30 days.
9. Security
We use TLS 1.3 in transit, AES-256 at rest, MFA on staff access, least-privilege RBAC, and quarterly penetration testing by an independent firm.
10. Children
The Services are not intended for users under 18. We do not knowingly collect data from children.
11. Changes
We will notify you of material changes by email and in-app at least 30 days before they take effect.
12. Contact
DemandSa Data Protection Officer · privacy@demandsa.com · Riyadh, KSA.