First: Identity of the Data Controller and Geographic Distribution
The "Yomaak" digital platform (website and mobile application) is managed by a network of legally and financially independent entities.
Based on the user's geographic region upon registration, the operating entity (Data Controller) responsible for collecting, processing, and protecting data is determined as follows:
- Kingdom of Saudi Arabia: Yomaak IT Solutions Company (registered in Saudi Arabia), Commercial Registration No. 7051718844, Tax Identification No. 314241730400003, Address: Riyadh, Saudi Arabia, is the Data Controller for members registered within the Kingdom.
- Republic of Turkey: Yomaak IT Solutions (registered in Istanbul, Turkey), Commercial Registration No. 1057863, Tax Identification No. 0982108671300001, Address: Istanbul, Turkey, is the Data Controller for members registered within Turkey.
- United Arab Emirates, Arab Republic of Egypt, and Rest of the World: Yomaak IT Solutions (registered in Ajman, UAE), Commercial Registration No. 201822011, Tax Identification No. 104609701800001, Address: Ajman, UAE, is the legal Data Controller responsible for processing member data in these regions. (The Egyptian domain is managed fully remotely via the UAE entity, without a physical headquarters in Egypt).
Second: Regulatory Compliance and Alignment
The operating entities commit, each within its jurisdiction, to ensuring that the processing of personal and commercial data complies with the following laws and regulations:
- Saudi Personal Data Protection Law (PDPL) and its executive regulations.
- UAE Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection (applicable to the international scope, Egypt, and the UAE).
- Turkish Law on Protection of Personal Data (KVKK No. 6698) for the Turkish domain.
Third: Categories of Collected Data and Purposes
The platform collects the following data for the purpose of providing technical services and facilitating business-to-business (B2B) connections:
- Registration and Entity Data: Entity name, Commercial Registration number, tax certificates, official addresses, phone numbers, email addresses, and details of legal representatives.
- Commercial and Operational Data: Product listings, Requests for Quotations (RFQs), estimated transaction volume, and technical communications within the platform's chat rooms.
- Technical Data: Internet Protocol (IP) address, device type, browser information, and Cookies.
Important Financial Note
Payment data processed by the platform is strictly limited to membership fees and subscription plans for the platform itself. The platform does not retain funds for commercial deals between members, nor does it process their payment details (e.g., credit cards), as payment is settled directly between the exporter and importer entirely outside the scope of the platform.
Fourth: Consent Mechanism
- Account Creation and Contract Performance: Implicit consent (necessary) upon registration, as a prerequisite for operating the core technical service.
- Marketing and Updates: A separate and optional checkbox (explicit consent) upon registration, with the ability to unsubscribe at any time via the control panel or the link provided in messages.
- Analytics and Tracking Cookies: A consent notice (prior consent) displayed to the user upon their first visit, with options to adjust settings later.
Fifth: Statistical Data Processing and AI Development
The member explicitly agrees that the platform has the right to use and analyze browsing data, request volumes, quotations, and technical communications, converting them into fully anonymized general statistical data that cannot be linked to the member or their commercial entity under any circumstances.
This statistical data is used exclusively to train the platform's artificial intelligence algorithms, build economic indicators, and publish market trend reports, which shall not be deemed a breach of privacy or commercial confidentiality.
Sixth: Third-Party Data Sharing
- The platform contracts with external vendors (cloud hosting, licensed payment gateways, analytics tools) under binding data processing agreements that prohibit using the data outside the designated service scope.
- Members registering through success partners (Affiliates) grant them access to basic contact data and subscription status only, without any access to transactions or dispute histories.
- Data is shared with judicial and regulatory authorities only when required by a legal obligation or a court order issued by a competent authority in the operating entity's country.
- Cross-Border Data Transfer: Due to multiple geographical entities, the platform commits to transferring data between its branches (Saudi Arabia, Turkey, UAE) using secure and internationally recognized legal mechanisms, ensuring a level of protection equivalent to or exceeding that of the member's home country.
Seventh: Security and Breach Notification
- The platform commits to encrypting data in transit (TLS 1.2 minimum) and at rest on cloud servers using advanced encryption algorithms.
- Credit card details are never stored on the platform's servers and are processed exclusively through PCI-DSS compliant licensed payment gateways.
- In the event of a security breach affecting personal data, the platform commits to notifying competent regulatory authorities within 72 hours of discovery and informing affected members without undue delay.
Eighth: Data Retention Periods
- Active Account Data: Maintained for the duration of active membership.
- Cancelled Account Data & KYC Records: Retained for 5 years post-cancellation for legal compliance and Anti-Money Laundering (AML) requirements.
- Transaction Logs & Subscription Invoices: Retained for 10 years in compliance with tax and accounting regulations in operating countries.
Ninth: Minors' Data
Yomaak platform services are strictly intended for business entities and adults with full legal capacity (above 18 years of age).
The platform does not knowingly collect or process data from minors. If any data belonging to a minor is inadvertently collected, it will be deleted immediately from the databases.
Tenth: Automated Processing and Performance Analytics
The platform may use automated analysis tools to evaluate member performance (such as response speed to inquiries and deal completion rates) to enhance technical matching quality and support.
No decisions with legal or significant financial impact on the member are made solely based on automated processing without human intervention.
Eleventh: Applicable Law, Dispute Resolution, and Governing Language
- This policy is governed by and construed in accordance with the applicable laws and regulations of the jurisdiction of the member's designated operating legal entity.
- Members have the right to submit complaints to the relevant governmental authority based on their country and operating entity domain.
- Kingdom of Saudi Arabia: Saudi Data and Artificial Intelligence Authority (SDAIA).
- Republic of Turkey: Turkish Personal Data Protection Authority (KVKK).
- UAE, Egypt, and Rest of World: UAE Data Office (UAE).
Governing Language: This policy has been drafted in Arabic, which shall remain the official reference language in the event of any conflict or inconsistency with translated versions.