1. Introduction

SAMACO Toys & Leisure (“we”, “us”, or “our”), registered in the Kingdom of Saudi Arabia under Unified Number 7012406265 with its principal place of business at 4010 Abdullah Ash Sharbtly St, Al Safa District, Jeddah 23455 operates the website www.samacotoysandleisure.com.

We are committed to protecting your personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (Royal Decree No. M/19, dated 9/2/1443H) and its Implementing Regulations. This Privacy Policy explains how we collect, use, store, share, and protect the personal data you provide through our Website’s contact form.

By submitting your information via our contact form, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

For the purposes of the PDPL, the Data Controller responsible for your personal data is:

Company Name: SAMACO Toys & Leisure

Unified No.: 7012406265

Registered Address: 4010 Abdullah Ash Sharbatly, Alsafa District, Jeddah 23455 Kingdom of Saudi Arabia

Contact Email: stl@samaco.com.sa

3. Personal Data We Collect

3.1 Information You Provide

When you submit our contact form, we collect the following personal data:

• Full name
• Email address
• Phone number (if provided)
• Company or organisation name (if provided)
• Subject or nature of your enquiry
• Any additional information you voluntarily include in the message field

3.2 Automatically Collected Information

In addition, our website systems may automatically collect technical data, including:

• IP address
• Browser type and version
• Date and time of form submission
• Referring URL (the page you visited before the contact form)

We do not collect sensitive personal data (as defined under Article 2 of the PDPL) through our contact form, such as health information, financial account details, or national identification numbers. If your message incidentally contains such data, please avoid sharing it.

4. Legal Basis for Processing

Under the PDPL, we process your personal data on the following legal bases:

• Consent: By submitting the contact form, you consent to us processing your personal data for the purpose of responding to your enquiry. You may withdraw this consent at any time (see Section 8).
• Legitimate Interests: We may process your data where necessary for our legitimate business interests, such as responding to your query, improving our services, and maintaining records of communications, provided these interests are not overridden by your fundamental rights.
• Contractual Necessity: Where your enquiry relates to entering into or performing a contract with us, processing may be necessary for that purpose.
• Legal Obligation: We may process your data where required to comply with a legal or regulatory obligation under Saudi Arabian law.

5. Purposes of Data Processing

We collect and use your personal data solely for the following specified purposes:

• To respond to your enquiry or request submitted via the contact form
• To provide you with information about our products, services, or activities (where requested)
• To maintain a record of our communications with you
• To improve the functionality and user experience of our Website
• To comply with our legal and regulatory obligations
• To detect, prevent, or investigate fraudulent or unlawful activity

We will not use your personal data for purposes that are incompatible with those listed above without your prior consent.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Saudi Arabian laws and regulations.

In general:

• Contact form submissions and related correspondence are retained for 3 years from the date of receipt, unless a longer retention period is required by law or the nature of the matter requires otherwise.
• Server logs containing technical data are typically retained for 90 days.

At the end of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with our data disposal procedures.

7. Disclosure and Sharing of Personal Data

7.1 Internal Access

Access to your personal data is restricted to authorised employees, contractors, and representatives of SAMACO Toys & leisure who need access to fulfil your enquiry or carry out their job responsibilities. All such individuals are bound by confidentiality obligations.

7.2 Third-Party Service Providers

We may share your personal data with trusted third-party service providers who assist us in operating our Website and business, such as:

• IT and cloud hosting providers
• Email and communication service providers
• Customer relationship management (CRM) system providers

Such third parties are contractually obligated to process your data only on our instructions, to keep it confidential, and to implement appropriate security measures.

7.3 Legal and Regulatory Disclosure

We may disclose your personal data to government authorities, law enforcement agencies, or courts where we are required to do so under Saudi Arabian law, including pursuant to a court order, judicial process, or formal regulatory request.

7.4 Cross-Border Transfers

If we transfer your personal data outside the Kingdom of Saudi Arabia, we will do so only in accordance with Article 29 of the PDPL and its Implementing Regulations. This means we will ensure that:

• The receiving country provides an adequate level of personal data protection as determined by the relevant Saudi authority; or
• Adequate contractual safeguards or binding corporate rules are in place; or
• A specific exemption under the PDPL applies (e.g., the transfer is necessary for a contract to which you are a party, or is required to protect vital interests).

We will not sell, rent, or trade your personal data to third parties for marketing purposes.

8. Your Rights Under the PDPL

As a Data Subject under the PDPL, you have the following rights in relation to your personal data:

Right of Access — You have the right to request confirmation of whether we hold your personal data and to obtain a copy of it.

Right to Correction — You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Deletion — You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

Right to Restriction of Processing — You may request that we restrict or suspend the processing of your data in certain circumstances.

Right to Withdraw Consent — Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Right to Lodge a Complaint — You have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) or the National Data Management Office (NDMO) if you believe your rights have been violated.

To exercise any of the above rights, please contact us in writing using the details in Section 11. We will respond to your request within 30 days as required under the PDPL, unless an extension is permitted by law.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted through our contact form
• Access controls and authentication requirements for internal systems
• Regular security assessments and monitoring
• Staff training on data protection obligations

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and encourage you to exercise care when submitting personal information online.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the relevant regulatory authority and, where required, affected individuals, in accordance with Article 26 of the PDPL and its Implementing Regulations.

10. Children’s Personal Data

Our Website and contact form are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has submitted personal data through our contact form without appropriate parental or guardian consent, please contact us immediately and we will take steps to delete such information.

11. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

Company Name: SAMACO Toys & Leisure

Unified No.: 7012406265

Registered Address: 4010 Abdullah Ash Sharbatly, Alsafa District, Jeddah 23455 Kingdom of Saudi Arabia

Contact Email: stl@samaco.com.sa

Phone Number: 800-244-0366

12. Updates to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for any other operational reason. Any material changes will be posted on this page with an updated effective date.

We encourage you to review this Privacy Policy periodically. Your continued use of the contact form following the posting of changes constitutes your acknowledgement of the revised Policy.