Privacy policy

The online store www.gbw.sa is run by GBW, which decides what personal data the site collects and what it is used for, and is responsible for it.

For any question about your data, write to goodbigwayksa@gmail.com or use the Contacts page.

• Account: name, email, mobile number and password.
• Orders: the delivery address and its point on the map, an extra phone number and a comment if you add them, and what you ordered.
• Business accounts: company name, commercial registration and VAT numbers, address, contact person and their phone, a copy of the commercial registration, and quote requests with any attached files.
• Job applications: name, phone, email, your message and your CV.
• Site chat: name, phone, messages and photos, and the page you wrote from.
• Technical data: IP address, browser and device type, the pages you visit, clicks, what you type into the site search, and page load speed.

• To create and protect your account: we confirm your mobile number with a code and send email confirmation and password-reset messages.
• To fulfil and deliver your orders and contact you about them.
• To verify business accounts and answer quote requests.
• To answer your chat messages and consider job applications.
• To understand how the site is used, fix faults and improve it, through overall statistics.
• To protect the site from misuse, for example by limiting repeated attempts.

We do not sell personal data and do not use it for advertising.

We use the following providers. Each receives only the data its job needs:

• Hetzner — our servers, which hold the database and files, in a data centre in Finland.
• Authentica (Saudi Arabia) — sends verification codes by SMS or WhatsApp; receives your mobile number.
• Resend (United States) — sends our emails; receives your email address.
• Telegram — our team receives chat messages and job applications there: name, phone and message.
• PostHog (United States) — site statistics. Receives the technical data, and your internal account number if you are signed in. We never send it your name, email or phone.
• Google Maps — when you pick an address on the map, the address is looked up from the point you choose, and from your location if you press the locate button.
• Government authorities, when the law requires it.

Some of these providers keep data outside Saudi Arabia: our servers are in Finland, PostHog and Resend are in the United States, and Telegram and Google operate worldwide. We send them only the minimum the purpose needs, in line with the Personal Data Protection Law and its regulations.

• Sign-in session — keeps you signed in for 7 days.
• Language — remembers the language you chose.
• Chat — links you to your conversation for 7 days.
• Statistics — a random PostHog identifier, kept for up to a year.
• Your cart and chosen address are kept in your own browser.

We use no advertising cookies. You can delete these in your browser settings; you will then need to sign in again.

To find faults in the site we may record how its pages are used: scrolling, clicks and moving between pages. Recordings do not include what you type into fields, such as passwords, codes and phone numbers, or the data sent with your order.

• Account — as long as your account exists; we delete it at your request.
• Orders — as long as Saudi law requires sales records to be kept, even after the account is deleted.
• Chat — deleted from the site 7 days after the last message; a copy stays in our team's work chat in Telegram.
• Job applications — while we consider them or they may suit a future opening; we delete them at your request.
• Cart — one day on our server.
• Statistics — no longer than needed to analyse the site.

Passwords are stored only as a one-way hash that cannot be turned back into the password. Documents, CVs and chat photos are kept in closed storage that cannot be reached from the internet, and the site works only over a secure connection (HTTPS).

• To know what we collect and why — which is what this page is for.
• To get a copy of your data.
• To correct or complete your data.
• To have your data deleted, except what the law requires us to keep.
• To withdraw your consent at any time.

You can change your name and mobile number in your account. For anything else, write to goodbigwayksa@gmail.com from the email address of your account; we reply within 30 days.

If you believe we have not respected your rights, you can complain to the Saudi Data & AI Authority (SDAIA).

We may update this page when the way the site works changes. The date of the last update is shown at the top.