Who we are, and how to reach us
Afiyatech Commercial Company is a laboratory and clinical supply distributor registered in the Kingdom of Saudi Arabia. For personal data collected through this website, Afiyatech is the data controller — it decides why and how that data is processed.
| Legal name | Afiyatech Commercial Company |
| Commercial registration | CR 101088142 |
| VAT registration | 313050062700003 |
| Registered address | Zaid Ibn Thabit, Al Malaz District, Riyadh, Saudi Arabia |
| Telephone | +966 58 121 8534 |
| Email for data protection | contact@afiyatech.com |
| Hours | Sunday – Thursday, 08:30 – 17:30 (AST) |
Mark any data protection request “PDPL request” in the subject line so that it reaches the right person without delay.
What this policy covers
This policy covers personal data we collect through www.afiyatech.com — principally the quote request form, the manufacturer partnership form and the correspondence that follows from them.
It does not cover the separate contractual, delivery and invoicing records created once a supply relationship begins. Those are governed by the agreement between Afiyatech and the customer organisation, and by our obligations under Saudi commercial, tax and medical device regulation.
A note on who the data is about. Almost everyone who contacts us does so in a professional capacity — as a laboratory manager, procurement officer, infection control lead or manufacturer representative. The PDPL applies to that data all the same, and we treat it accordingly. Being work contact data does not make it unprotected.
The personal data we collect
3.1 Quote requests
When you submit the form on the Request a quote page, we receive the fields you complete:
- Facility or organisation name
- Contact name and role
- Work email address and telephone number
- The product categories you are interested in, the approximate monthly volume and your indicative timeframe
- Any free-text notes you add
- The list of catalogue items you added to your enquiry before submitting
- The
AFY-reference we generate for the request, and the date and time it was sent
3.2 Manufacturer partnership enquiries
When you submit the form on the For suppliers page, we receive: company name, country, company website, contact name and role, work email and telephone, a link to your catalogue, the product categories offered, regulatory status, existing market presence, exclusivity expectations, company size, timeframe, and any notes you add.
3.3 Correspondence
If you email, telephone or message us, we keep the content of that correspondence and the contact details it carries, so that we can answer you and hold a record of what was asked, quoted or agreed.
3.4 Data collected automatically
Our hosting provider records standard web server logs for every request to the site: IP address, the page requested, the date and time, the referring page, and the browser and operating system reported by your device. These logs exist to keep the site available and to investigate faults and abuse. We do not use them to build a profile of you, and we do not combine them with the form data above.
3.5 Data kept on your own device
The enquiry list you build while browsing the catalogue is stored in your browser's local storage, on your own device, under the key afiyatech.enquiry.v1. It is not transmitted to us and we cannot read it — until you choose to submit a quote request, at which point its contents are included in that submission. How to clear it, and how to stop it being written at all, is covered in the cookies and local storage notice.
Data we do not collect
This is worth stating plainly, because of the sector we work in.
- No patient data. Nothing on this site asks for — or should be used to send us — patient identifiers, specimen records, test results or any other health data relating to an identified or identifiable individual. Please do not put such data into the notes fields or attach it to an email to us. If you send it to us in error, tell us and we will destroy it.
- No sensitive personal data. We do not ask for national identity or Iqama numbers, religious or ethnic information, biometric or genetic data, or health data about you.
- No payment card data. The site takes no payments and has no checkout.
- No advertising or analytics tracking. There are no advertising pixels, no analytics cookies and no cross-site tracking on this website.
- No automated decision-making or profiling producing legal effects or similarly significant effects for you. A person at Afiyatech reads and answers every enquiry.
Why we process it, and our lawful basis
Under Article 6 of the PDPL, processing requires a lawful basis. Ours are set out below.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Preparing and sending a quotation | Quote form fields, enquiry list, correspondence | Necessary to take steps at your request before entering into a contract, and to perform one |
| Answering questions about products, regulatory status, availability and lead times | Contact details, correspondence | Your request; our legitimate interest in responding to enquiries |
| Assessing a manufacturer partnership proposal | Partnership form fields, correspondence | Steps taken at your request before contracting; legitimate interest in evaluating market-entry proposals |
| Maintaining records of quotations, orders and supply, including lot-level traceability | Contact details attached to a transaction | Compliance with legal obligations under Saudi commercial, tax and medical device regulation |
| Keeping the site available, secure and free of abuse | Server logs; the hidden anti-spam field on the forms | Legitimate interest in the security and integrity of our systems |
| Sending an occasional operational notice to an existing contact — a recall, a discontinued line, a regulatory change | Work email address, role | Legitimate interest in supply continuity and patient safety. You can opt out at any time |
Our commitment: we do not sell personal data, we do not rent or exchange contact lists, and we do not send marketing to people who have not asked to hear from us. An enquiry is answered — it is not converted into a mailing list.
Transfers outside Saudi Arabia
Two of the services above process data outside the Kingdom.
- Form delivery. Quote and partnership submissions pass through FormSubmit, which operates outside Saudi Arabia, before arriving as an email in our Riyadh-managed inbox. The data is in transit through that service; we do not hold a working database there.
- Font and image delivery. Your browser requests the site's typefaces from Google and, on the Evidence page, reference logos from Wikimedia Commons. Those requests disclose your IP address to those operators. They are made by your browser, not by our server.
Transfers of personal data outside the Kingdom are governed by Article 29 of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom. We limit such transfers to what is necessary to deliver the service you asked for, we transfer the minimum data required, and no sensitive personal data is transferred through this website at all.
If you would prefer your enquiry not to pass through a service outside the Kingdom, do not use the web form. Email contact@afiyatech.com or telephone +966 58 121 8534 instead, and we will handle it exactly the same way.
How long we keep it
We keep personal data only as long as the purpose it was collected for requires, plus any period the law obliges us to retain it. When a period ends, the data is destroyed or irreversibly anonymised.
| Record | Kept for | Why |
|---|---|---|
| An enquiry that does not lead to a supply relationship | 24 months from last contact | Laboratory procurement cycles are long, and enquiries are frequently revived at the next budget round |
| Quotations, orders, invoices and delivery records | 10 years from the end of the financial year | Saudi commercial books and VAT record-keeping requirements |
| Lot and traceability records attached to a supplied product | As required by medical device regulation and the product's shelf life | Post-market surveillance and recall management |
| Manufacturer partnership enquiries not taken forward | 24 months | Market-entry conversations reopen when a category changes |
| General correspondence | 24 months from last contact, unless attached to a transaction record | Continuity of the conversation |
| Web server logs | Short term, per our hosting provider's standard retention | Fault diagnosis and abuse investigation |
| The enquiry list in your browser | Until you clear it | It is on your device and under your control |
How we protect it
- The website is served over HTTPS, and form submissions are encrypted in transit.
- Access to the enquiry inbox and to customer records is limited to the staff who need it, on named accounts.
- The forms carry a hidden anti-spam field, so that automated submissions are discarded rather than processed.
- We collect the minimum data needed to answer an enquiry, which is itself the strongest protection available.
- We hold no patient data, no payment card data and no sensitive personal data through this website, so a compromise of the site could not expose them.
No system is absolutely secure, and we do not claim otherwise. What we do commit to is that we do not collect what we do not need, and we do not keep what we no longer need.
If something goes wrong
If a personal data breach occurs, we will notify the Saudi Data & AI Authority within the period the PDPL requires, and we will notify you directly, without undue delay, where the breach is likely to cause you harm.
Your rights under the PDPL
Where we hold personal data about you, the Personal Data Protection Law gives you the following rights. They apply to data we hold, not to data your employer holds about you.
- To be informed — to know the legal basis and the purpose for which we collect your data. That is what this document is for.
- To access — to obtain confirmation of whether we hold your personal data, and to see it.
- To obtain a copy — to receive your personal data in a readable, clear format.
- To correct — to have inaccurate, incomplete or out-of-date data corrected, completed or updated.
- To request destruction — to have your personal data destroyed where it is no longer necessary for the purpose it was collected for. This right does not override a legal obligation on us to retain a record.
- To withdraw consent — where our processing rests on your consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.
Exercising any of these rights is free of charge, and we will not treat you differently for having done so.
Exercising your rights, and complaints
Email contact@afiyatech.com with “PDPL request” in the subject line, or write to the Riyadh address in section 1. Tell us which right you are exercising and enough detail to find your record — normally the email address you used and, if you have it, the AFY- reference from your enquiry.
We may need to verify your identity before acting, so that we do not disclose one person's data to another. We will respond within the period set by the PDPL and its implementing regulation, and in any event within 30 days of a verified request. If a request is complex and we need longer, we will tell you why before that period ends.
If you are not satisfied with our response, you may complain to the competent supervisory authority — the Saudi Data & AI Authority (SDAIA). We would ask that you raise it with us first, so that we have the chance to put it right.
Cookies and local storage
This website sets no advertising cookies, no analytics cookies and no cross-site tracking of any kind. It stores one item in your browser — the enquiry list you build while browsing the catalogue — on your own device.
The detail, including how to clear it and what happens if you block browser storage, is in the cookies and local storage notice.
Children and young people
This is a business-to-business website addressed to laboratory, hospital and manufacturer professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data to us, tell us and we will destroy it.
Changes to this policy
We review this policy at least annually, and whenever we change how the site handles personal data — for example if the form route changes, or if we introduce analytics. The effective date and version number at the top of this page always reflect the current text.
Where a change materially affects your rights or how your data is used, we will say so prominently on this page, and we will notify existing contacts directly where the change requires it.
Contact
Questions about this policy, or about how we handle personal data:
| contact@afiyatech.com — subject line “PDPL request” | |
| Telephone | +966 58 121 8534, Sunday – Thursday, 08:30 – 17:30 (AST) |
| Post | Afiyatech Commercial Company, Zaid Ibn Thabit, Al Malaz District, Riyadh, Saudi Arabia |
Language: this policy is published in English. If it is translated into Arabic and the two versions differ, the Arabic version prevails for the purposes of Saudi law.