Privacy policy

This policy explains what personal data the SIPS platform processes, why, and for how long. The Platform is a business tool: the people concerned are the staff of the pharmacies and suppliers that use it, and the Operator's own team.

1. Controller

The entity named on the Legal notice page is the controller of the personal data processed on the Platform.

2. Data we process

Category	Examples	Purpose
Account	Name, work e-mail, phone, role, company, language, avatar	Sign-in, access control, notifications
Security	Sign-in history, IP address, browser, failed attempts	Protecting accounts, detecting abuse
Activity	Actions taken on requests, bids, orders, payments, settings	Audit trail required to operate a marketplace
Business	Requests, bids, orders, payment references, uploaded proofs, batch details	Running the procurement workflow
Point of sale	Sales and till sessions of a pharmacy, cashier name	Stock levels, reorder suggestions, anomaly alerts for the pharmacy
Support and chat	Tickets, messages and attachments	Helping users and keeping a record of what was agreed

3. Why we may process it

• To perform the agreement with the pharmacy or supplier the person works for.
• To comply with legal obligations (commercial and tax records, pharmaceutical traceability).
• For the Operator's legitimate interest in keeping the Platform secure and auditable.

4. Who sees what

• Suppliers see the products, quantities and delivery cities of a grouped request; pharmacy names are disclosed only on award, to the winning supplier, for the orders it must deliver.
• Pharmacies see the winning supplier's identity and the awarded prices for their own orders.
• The Operator's administrators see the full workflow, including payments and payouts, to run and audit it.
• Data is hosted on servers under the Operator's control. Transactional e-mails are sent by the Platform's own mail system. No personal data is sold or shared with advertisers.

5. Retention

Account data is kept while the account is active and archived when it is deactivated. Order, payment and audit records are kept for the periods required by Saudi commercial and tax law. Security logs are kept for a limited period sufficient to investigate incidents.

6. Your rights

In accordance with the Saudi Personal Data Protection Law, a person may ask to access, correct or, where applicable, delete their personal data, and may object to certain processing. Requests are made through the contact given on this page or the support desk; identity is verified before a request is fulfilled.

7. Cookies

The Platform uses only the cookies needed to keep a user signed in, protect forms against forgery, and remember the chosen language and display preferences. There are no advertising or third-party tracking cookies.

8. Changes

This policy may be updated. The version date is shown at the top of the page.