1. Who We Are
Automatic Washing Machine is a washing machine repair and appliance service provider registered in the Kingdom of Saudi Arabia.
We are the data controller for the personal data described in this policy. This means we determine why and how your personal data is processed.
2. What Personal Data We Collect
We collect the following categories of personal data:
2.1 Information You Provide When Booking a Service
- Full name
- Phone number
- WhatsApp number (if used for booking)
- Email address (if provided)
- Service address (street, building, district, city)
- Appliance brand and model
- Description of the appliance fault or issue
2.2 Information Collected During Service Delivery
- Notes from the technician's diagnosis
- Parts used and repair details
- Payment confirmation details (amount, date, method — not full card data)
2.3 Information Collected Automatically
- IP address (anonymised where possible)
- Browser type and device type
- Pages visited on our website
- Referring website or search query
- Time and date of visit
- Approximate geographic location (city-level, based on IP)
2.4 Information from Communications
- Records of phone calls, WhatsApp messages, and email correspondence
- and complaint records
2.5 What We Do NOT Collect
- We do not store your full credit card number, CVV, or PIN — these are processed directly by our payment provider
- We do not collect biometric data
- We do not collect data about your health, religion, or political opinions
- We do not collect data from children under 18 without parental consent
3. How We Collect Your Data
We collect your personal data through the following channels:
Directly from you when you:
- Call or WhatsApp us to book a service
- Fill in a booking form on our website
- Provide your details to our technician on-site
- Contact us with a complaint or question
Automatically when you:
- Visit our website (cookies, analytics)
- Interact with our emails (open rates, click tracking)
- Interact with our WhatsApp Business account
From third parties in limited cases:
- Payment processors (payment confirmation only)
- Google (if you arrive via Google Search or Maps)
- Social media platforms (if you contact us via those platforms)
4. Why We Collect Your Data (Lawful Basis)
Under the Saudi Personal Data Protection Law (PDPL), we must have a lawful basis for processing your personal data. Our lawful bases are:
4.1 Performance of a Contract
We process your name, contact details, service address, and appliance details to perform the repair service you have booked. Without this data, we cannot provide the service.
4.2 Legitimate Interests
and fraud prevention. We have balanced these interests against your rights.
4.3 Consent
We process your data for marketing communications (maintenance reminders, seasonal tips) only with your explicit consent. You may withdraw consent at any time.
4.4 Legal Obligation
We process and retain certain data (invoices, payment records) to comply with Saudi tax law, ZATCA e-invoicing requirements, and consumer protection regulations.
4.5 Vital Interests
5. How We Use Your Data
We use your personal data for the following purposes:
5.1 Service Delivery
- Scheduling and dispatching a technician
- Diagnosing the appliance fault
- Performing the repair
- Issuing the invoice
- Following up on the repair quality
5.2 Customer Support
- Responding to your calls, messages, and emails
- Resolving complaints
5.3 Business Operations
- Maintaining accurate service records
- Improving our service quality
- Preventing fraud and misuse
5.4 Communications (only with your consent)
- Sending maintenance reminders
- Sending seasonal maintenance tips
- Notifying you of significant updates to this policy
5.5 Legal and Compliance
- Complying with tax and invoicing requirements
- Responding to lawful requests from authorities
- Defending legal claims if necessary
What we do NOT use your data for: Selling or renting your data to third parties, targeted advertising on external platforms based on your data, or any purpose incompatible with the reasons listed above.
6. Who We Share Your Data With
We do not sell your personal data. We share it only with the following categories of third parties, and only to the extent necessary:
6.1 Payment Processors
- Data Shared: Name, amount, transaction reference
- Purpose: Processing payments securely
- Note: Full card details never reach us — they are handled directly by the payment processor
6.2 CRM and Scheduling Software
- Data Shared: Name, contact details, service history
- Purpose: Managing customer relationships, scheduling, and support
6.3 Hosting and Infrastructure Providers
- Data Shared: Website traffic data, booking form data at rest
- Purpose: Hosting our website and applications
6.4 Analytics Providers
- Processors: Google (Google Ads)
- Data Shared: Anonymised website usage data
- Purpose: Understanding website performance and improving user experience
6.5 Communication Providers
- Processors: WhatsApp (Meta)
- Data Shared: Name, phone, email, message content
- Purpose: Communicating with you about your service
6.6 Legal and Regulatory Authorities
We may disclose data where required by Saudi law, court order, or lawful authority request.
6.7 Business Transfers
If the business is sold or merged, customer data may transfer to the acquiring entity under the same privacy commitments.
Data Processing Agreements
We have written data processing agreements with all third-party processors, requiring them to protect your data to the standards required by PDPL.
Critical Note: All third-party processors listed must have actual data processing agreements in place.
7. International Data Transfers
Some of our third-party processors store data outside the Kingdom of Saudi Arabia. Under PDPL, we may transfer personal data outside Saudi Arabia only if:
- The destination country provides an adequate level of protection as determined by SDAIA; or
- We have put in place appropriate safeguards (such as standard contractual clauses); or
- You have given explicit consent; or
- The transfer is necessary for the performance of a contract with you.
Our current international transfers:
| Processor |
Country of Storage |
Safeguard |
| Processors: Google (Google Ads) |
— |
Legal Note: PDPL has specific rules on cross-border data transfer, and SDAIA maintains a list of countries with adequate protection.
8. How Long We Keep Your Data
We retain your personal data only as long as necessary for the purposes described in this policy, or as required by Saudi law.
| Data Type |
Retention Period |
Reason |
| Booking and service records |
5–7 years |
and legal |
| Invoices and payment records |
5–10 years per ZATCA |
Saudi tax law compliance |
| Marketing consent records |
Until you unsubscribe + 24 months |
Audit trail |
| Website analytics (anonymised) |
26 months |
Analytics best practice |
| WhatsApp and call records |
24 months |
Service quality and dispute resolution |
| Complaint records |
3–5 years |
Legal protection |
When retention periods expire
We securely delete or anonymise your data. Where complete deletion is not technically feasible (for example, in encrypted backup archives), we isolate and protect the data until it can be securely deleted.
9. How We Protect Your Data
We take data security seriously. Our measures include:
9.1 Technical Measures
- Encryption of data in transit (HTTPS across the website)
- Encryption of sensitive data at rest (where applicable)
- Secure passwords and access controls for all staff systems
- Two-factor authentication on administrative systems
- Regular security patching of our website and software
- Firewall protection on hosting infrastructure
9.2 Organisational Measures
- Access to customer data is limited to staff who need it to perform their role
- All staff receive privacy and data protection training
- Staff sign confidentiality agreements
- Clear escalation process for suspected data breaches
- Physical security of any physical records
9.3 Data Breach Response
If we become aware of a personal data breach that affects your data, we will:
- Notify SDAIA within 72 hours (where required by PDPL)
- Notify you without undue delay if the breach is likely to affect your rights or freedoms
9.4 Your Role
Help us protect your data by:
- Not sharing your booking reference with others
- Using strong passwords on any account you create with us
10. Cookies and Tracking
We use the Google Ads tag (gtag.js) and its cookies to measure calls, WhatsApp messages and form requests that come from our ads, and we keep the ad click ID (gclid) in your browser for 90 days.
10.1 What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help the site remember your preferences and improve your experience.
10.2 Cookies We Use
| Cookie Type |
Purpose |
Duration |
Can You Opt Out? |
| Essential |
Site functionality (e.g. language preference, form session) |
Session or up to 12 months |
No — required for the site to work |
| Analytics |
Understand how visitors use the site (e.g. Google Analytics) |
Up to 26 months |
Yes — via cookie banner or browser settings |
| Preference |
Remember your language and city selection |
Up to 12 months |
Yes — via cookie banner or browser settings |
| Marketing |
Google Ads, Meta Pixel (if used) |
— |
Yes — via cookie banner |
10.3 Cookie Consent
When you first visit our site, you will see a cookie banner that allows you to accept, reject, or customise non-essential cookies. Essential cookies are set regardless because the site cannot function without them.
10.4 Managing Cookies
You can manage cookies through:
- Our cookie banner (available at any time via the cookie settings link in the footer)
- Your browser settings (most browsers allow you to block or delete cookies)
- Opt-out tools for specific analytics providers (e.g. Google Analytics Opt-out Browser Add-on)
10.5 Do Not Track
We do not currently respond to browser "Do Not Track" signals, but you can control tracking via the cookie banner and browser settings.
Technical Requirement: A functioning cookie consent banner is required for PDPL compliance and for this section to be truthful. If no banner exists, either implement one or state clearly that only essential cookies are used.
11. Your Rights Under PDPL
Under the Saudi Personal Data Protection Law (PDPL), you have the following rights regarding your personal data:
11.1 Right to Be Informed
You have the right to know what personal data we collect, why we collect it, and how we use it. This policy provides that information.
11.2 Right of Access
You have the right to request a copy of the personal data we hold about you.
11.3 Right to Correction
You have the right to request correction of inaccurate or incomplete personal data.
11.4 Right to Destruction / Deletion
You have the right to request deletion of your personal data, subject to our legal record-keeping obligations (for example, tax records that must be retained).
11.5 Right to Withdraw Consent
Where we rely on consent for processing (for example, marketing emails), you have the right to withdraw that consent at any time.
11.6 Right to Object
You have the right to object to processing based on legitimate interests, in certain circumstances.
11.7 Right to Data Portability
Where technically feasible, you have the right to receive your personal data in a structured, commonly used format, and to transmit it to another controller.
11.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data protection rights have been violated.
12. How to Exercise Your Rights
To exercise any of your rights, contact us using the details below. Please include:
- Your full name
- The phone number or email you used when booking
- A clear description of your request
- A copy of identification (only if required to verify your identity)
How to contact us
- We will acknowledge your request within 5 business days
- We will respond to your request within 30 calendar days (as required by PDPL)
- If we need more time (for example, for complex requests), we will inform you and explain why
Verification
To protect your privacy, we may need to verify your identity before processing your request.
No Charge
Exercising your data rights is free of charge. We will not charge you for a reasonable request, and we will not treat you differently for exercising your rights.
13. Children's Privacy
Our services are directed at adults (18 years and older). We do not knowingly collect personal data from children under 18.
If you believe that a child under 18 has provided us with personal data without parental consent, please contact us at privacy@automaticwashingmachine.com. We will delete the data promptly.
If a service is booked on behalf of a household that includes children (for example, a family home), we do not collect any data about the children — only the adult who made the booking.
14. Marketing Communications
14.1 What We Send
We send maintenance reminders and seasonal tips — typically 4 emails per year. We do not send frequent marketing emails, and we do not send promotional offers unless you specifically opted in.
14.2 How We Collect Consent
We collect consent for marketing communications through:
- An explicit opt-in checkbox on our booking form
- A specific request you make (for example, asking to receive our maintenance checklist by email)
- A WhatsApp message requesting reminders
14.3 Withdrawing Consent
You can withdraw consent at any time by:
We process opt-out requests within 5 business days.
14.4 Third-Party Marketing
We do not share your data with third parties for their own marketing purposes.
15. Changes to This Policy
15.1 Right to Update
We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, or legal requirements.
15.2 Notification of Significant Changes
For significant changes (for example, new categories of data collected, new third-party processors, or changes to your rights), we will notify active customers by email or SMS at least 14 days before the change takes effect.
15.3 Version History
- Version 1.0: 01/01/2026 — Initial publication
15.4 Continued Use
Continuing to use our services after changes are published constitutes acceptance of the updated policy.
16. Complaints and Contact
16.1 Internal Complaints
If you have a concern about how we handle your personal data, please contact us first:
We will respond within 5 business days and aim to resolve your concern quickly and fairly.
16.2 External Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with:
- Saudi Data and Artificial Intelligence Authority (SDAIA)
- Website: sdaia.gov.sa
16.3 Business Contact Details