Who we are and who is responsible for your data
This website is operated by the O2GO new-car showroom in Makkah, owned by O2 GO Company, commercial registration no. 7055102664.
We are the “controller” responsible for the personal data you send us through this website, under the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.
Scope of this policy
This policy covers the data we collect through this website and its request forms, and our communication with you about those requests. It does not cover third-party services we link to, such as WhatsApp and Google Maps, which have their own policies.
Data we collect
We collect only what you enter in a request form yourself, and what is technically needed to protect the site and measure its use in aggregate:
- Contact details with every request: name, mobile number, email and city (both optional), and your notes.
- Request details: the car you are interested in and its price at the time, and how you want to pay (cash or finance).
- Finance requests: net monthly salary, employer sector, current monthly obligations and the estimated finance plan you chose (down payment, term and final payment).
- Company requests: company name, commercial registration number (optional), number of cars, how you want to pay, and the requester’s job title.
- Test-drive bookings: the branch, day and time slot you chose.
- Limited technical data: a one-way hash of your IP address to prevent repeated and automated submissions, the campaign source (utm links) if any, and the interface language.
- Cookieless, aggregate usage statistics (Vercel Web Analytics and Speed Insights): the pages you visit, the site that referred you, your country, your device type, browser and operating system, page load speed, and events such as opening a car page, starting or sending a request, tapping WhatsApp, call or share, or a search that found no car (with the words searched). They do not include your name, number or anything you type in a request form, and nothing is stored on your device.
- If you email us your CV: the data it contains, which we use for recruitment only.
What we don’t collect
- We don’t ask for your national ID or Iqama number on the website.
- We don’t collect bank or payment card details, and no payment is made on the website.
- We don’t ask for any sensitive data, such as health data or beliefs.
- We don’t create customer accounts or ask for passwords.
Why we use your data
- To contact you about your request, prepare a quotation, and book and confirm your test drive.
- To pre-assess a finance request and, if you ask us to, refer it to a licensed finance provider.
- To protect the site against automated and repeated submissions and fraud.
- To meet our legal obligations, such as keeping accounting records of completed sales.
- To improve our service, measure the site’s speed and use, and understand which campaigns brought you to us, in aggregate and without identifying you.
We don’t use your data for fully automated decisions that affect you, and we don’t send you marketing messages without your separate consent.
Legal basis for processing
- Your consent: when you send a request and confirm that we may use your data to contact you about it.
- Carrying out your request: to take the steps you asked for before a purchase or finance contract.
- Legal obligations: such as keeping accounting records and responding to requests from competent authorities.
- Legitimate interest: to protect the site against abuse and fraud, and to measure its use and performance in aggregate, without affecting your rights and interests.
You can withdraw your consent at any time; this does not affect the lawfulness of processing that took place before.
Who we share your data with
- Finance providers licensed by the Saudi Central Bank, only when you ask for financing and only as needed to assess your request.
- Technical service providers that host the site and database, measure its traffic and performance in aggregate, and send request notifications to our sales team, under contracts that oblige them to protect the data and not use it for any other purpose.
- Competent government authorities where the law requires it.
- We don’t sell your data or share it with anyone for marketing purposes.
Where the data is stored and transferred
Data is stored with our hosting provider. If providing the service requires transferring data outside the Kingdom, it will follow the regulatory rules for transferring personal data outside the Kingdom, and be limited to what is necessary.
How long we keep it
- Open requests: for as long as we are handling them.
- Closed requests: deleted automatically 12 months after they are closed, unless another law requires longer, such as accounting records of completed sales.
- Abuse-prevention data (the IP hash and request counters): deleted within days.
- Campaign-source cookie: 30 days.
- CVs: until you ask us to delete them, or once they are no longer needed for recruitment.
Your rights
The Personal Data Protection Law gives you the following rights:
- To be informed about how your data is collected and why it is processed.
- To access your data and obtain a copy in a clear format.
- To have your data corrected, completed or updated.
- To request destruction of your data when it is no longer needed.
- To withdraw your consent to processing at any time.
- To lodge a complaint with the Saudi Data & AI Authority (SDAIA).
How to exercise your rights
Contact us through our showroom page or visit us there, with your request number if you have one and what you are asking for: access, correction, destruction or withdrawal of consent.
We may ask for additional information to verify your identity before acting, to protect your data, and we will reply within the statutory period. Exercising these rights is free of charge.
Security
We use encrypted connections, a database with access limited to authorised sales staff, and a log of every change to a request’s status. Site visitors can never see other people’s requests.
If an incident affects your data, we will deal with it immediately and notify the competent authorities and you as the law requires.
Cookies and local storage
We use a small number of first-party cookies and your browser’s local storage to remember your language, theme, saved cars and campaign source. We measure visits and page speed with an analytics tool that uses no cookies and stores nothing on your device. We use no third-party advertising cookies or trackers. Full details are in our cookie policy.
Minors
Purchase and finance requests are intended for adults, and we don’t knowingly collect data from anyone under 18. If you learn that a minor has sent us their data, contact us so we can delete it.
Changes to this policy
We may update this policy when our services or the applicable regulations change. We show the date of the latest update at the top of this page, and if a change is material and affects your data we will tell you through the contact details you gave us.
Contact
- Controller: O2 GO Company.
- Commercial registration: 7055102664.
- Address: Makkah.