1. Introduction
CATRION respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Law ("PDP Law") and other applicable data protection regulations in the Kingdom of Saudi Arabia. This Privacy Notice explains how we collect, use, disclose, store, and protect your personal data when you visit any of CATRION websites including but not limited to (https://catrion.com) and mobile websites (collectively referred to as “Platforms”), and informs you of your rights under the law. By providing your personal data, you consent to the terms of this Privacy Notice and agree that we may collect, use, and disclose your personal data as described herein. You are not obligated to provide any requested information; however, if you choose not to, we may be unable to provide certain services or products.
2. General Terms
2.1 The Website: CATRION main website www.catrion.com and its affiliated sites is operated by CATRION Catering Holding Company, a Saudi Joint Stock company, registered with Commercial Registration No. 4030175741, having its principal office at Prince Sultan Road, Al Muhammadiyah District 5, P.O. Box 9178, Jeddah 21413, Kingdom of Saudi Arabia.
2.2 Personal Data: Any information that directly or indirectly identifies an individual, including but not limited to name, identification numbers, addresses, contact numbers, photos, and financial data.
2.3 PDP Law: Refers to the Personal Data Protection Law and its implementing regulations in the Kingdom of Saudi Arabia.
2.4 Applicable Law: Refers to data protection regulations in force within Saudi Arabia, including future amendments.
3. Who Are We and What Do We Do?
3.1 About CATRION: CATRION is a leading Saudi Arabian company with a 40-year history of innovation. Originally established to provide catering services to Saudia Airlines, it has since diversified into In-Flight services, Commercial Laundry, Retail, and Integrated Catering and Facilities Management.
3.2 Commitment to Data Protection: CATRION is committed to processing your personal data in accordance with the PDP Law and other applicable regulations.
3.3 Data Controller: For the purposes of the PDP Law, CATRION is the Data Controller responsible for determining how your personal data is processed.
4. How This Privacy Notice Applies
This Privacy Notice applies when CATRION acts as the Data Controller, determining the purposes and means of processing your personal data as a visitor to our website or user of our services.
5. How Is Your Personal Data Collected?
We collect personal data through various methods, including:
5.1 Direct Interactions: You may provide personal data by filling out forms or communicating with us directly, such as applying for a job, registering on our website, or providing feedback.
5.2 Automated Technologies or Interactions: As you interact with our website, we automatically collect technical data about your equipment, browsing actions, and patterns through cookies and similar technologies.
5.3 Third Parties or Publicly Available Sources: We may receive personal data from third parties or public sources, in compliance with the PDP Law.
5.4 Messaging Services: Data may be collected through SMS or similar tools, subject to your communication preferences.
6. How We Use Your Personal Data
6.1 We will only use your personal data in accordance with the PDP Law. We may use your personal data for the following purposes:
- To register you as a customer, vendor, or job applicant.
- To manage our relationship with you, including notifying you about changes to our terms or asking you to provide feedback.
- To administer and protect our business and website, including data analysis, system maintenance, and support.
- To deliver relevant content and advertisements on our website and evaluate their effectiveness.
- To comply with legal obligations and protect our legal rights.
6.2 We ensure that personal data is only processed for the purposes for which it was collected unless otherwise permitted by law.
6.3 Sensitive Personal Data: If we collect or process any sensitive personal data (e.g., health data, biometric data, religious beliefs), we will obtain your explicit consent, except where we are required or permitted by law to process such data without consent.
6.4 Automated Decision-Making and Profiling: We may use automated decision-making or profiling techniques to provide personalized content and services. If these processes have significant legal effects on you, we will provide you with an opportunity to request human intervention or challenge the decision.
6.5 Generative Artificial Intelligence: We may use AI technology to enhance efficiency and expedite service, ensuring that any data processed is handled securely and in compliance with the laws.
7. Disclosures of Your Personal Data
We may disclose your personal data to:
7.1 External Third-Party Service Providers: Who administer our Platforms, provide internet services, or host our data.
7.2 Professional Advisers: Including lawyers, bankers, auditors, and insurers for consultancy, legal, and insurance services.
7.3 Third Parties: In connection with a merger, acquisition, or sale of assets, ensuring that your data is protected in accordance with this Privacy Notice.
7.4 Legal Obligations and Protection: We may disclose your personal data if required by law, in response to legal proceedings, or to protect our rights, property, or safety, or those of others.
We ensure that all third parties who receive your personal data comply with the PDP Law and take appropriate measures to protect your information.
8. Data Retention
We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including any legal, regulatory, or reporting requirements. Personal data will be securely deleted or anonymized when no longer needed, in compliance with the PDP Law. If your personal data is no longer required, we will ensure it is securely destroyed or anonymized so that it can no longer be associated with you.
9. Data Breach Notification
In the event of a data breach that compromises your personal data, we will notify the Competent Authority as required by the PDP Law. If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay, providing information about the nature of the breach and the measures taken to mitigate it.
10. Third-Party Links
Our Platforms may contain links to third-party websites. We are not responsible for the privacy practices of these websites. Please review the privacy notices of any third-party sites you visit.
11. Data Protection of Minors
We do not knowingly collect personal data from children under the age of 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will delete it as soon as possible. We encourage parents and guardians to monitor their children’s online activities.
12. International Transfers
Your personal data may be transferred to and processed in countries outside Saudi Arabia. We ensure that such transfers comply with the PDP Law and provide a level of data protection equivalent to that in Saudi Arabia.
13. Data Security
We have implemented appropriate security measures to prevent unauthorized access, use, alteration, or disclosure of your personal data. However, no internet-based site can be fully secure, and we cannot be held responsible for unauthorized access beyond our control.
14. Your Legal Rights
Under the PDP Law, you have the following rights regarding your personal data:
- Right to Access: You can request access to your personal data.
- Right to Rectification: You can request corrections to inaccurate or incomplete data.
- Right to Erasure: You can request deletion of your data under certain circumstances.
- Right to Restrict Processing: You can request a restriction on processing under certain conditions.
- Right to Object: You can object to the processing of your data in some cases.
- Right to Data Portability: You can request the transfer of your data to another service provider.
- Right to Withdraw Consent: You can withdraw your consent at any time.
You may exercise your rights by contacting us at csdata@catrion.com.
16. Consent for Disclosure
You acknowledge and consent that we may disclose your personal data if required by law, or if we determine that such disclosure is necessary to comply with legal obligations, protect our rights, or protect the safety of others.
17. Complaints and Dispute Resolution
If you have any concerns or complaints about how we handle your personal data, you can contact us at csdata@catrion.com. You also have the right to file a complaint with the National Data Management Office or the relevant data protection authority in Saudi Arabia.
18. Regular Updates and Amendments
We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or other factors. We will notify you of significant changes by posting the updated notice on our Platforms or by other appropriate means. Please review the updated notice regularly to stay informed about how we are protecting your data.
19. Language
This Privacy Notice is provided in both English and Arabic. In case of any discrepancies between the two versions, the Arabic version will prevail.
