1. Who we are

AWS Garage — VAT number 310467099600003. Address: 6946 Omar Jan Street, Al Rimal, Riyadh 13263, Saudi Arabia. Contact: through the channels published on awsg.sa or by visiting the centre.

We are the controller of the personal data we collect while providing vehicle maintenance, repair and inspection services and selling parts and lubricants.

2. What we collect

We collect only what we need to deliver the service, invoice it and meet our legal obligations:

• Contact details: name, mobile number, e-mail; for businesses: company name, VAT number, national address and contact person.
• Vehicle details: plate number, VIN, make, model and year, odometer reading, and the service history, quotations and invoices.
• Photos and videos of the vehicle taken during inspection or reception to document its condition and the work performed.
• Payment details: amount, date, method and reference. Card data is processed by a payment-gateway provider licensed by the Saudi Central Bank and is never stored by us in any form.
• Technical usage data: IP address, browser type and sign-in logs, for security and operation of the system.
• Our staff's data on hub.awsg.sa: account details and an audit log of the actions they perform.

3. Why we use it

We use the data for the following purposes and legal bases:

• To perform our contract with you: opening job cards, preparing quotations, carrying out the work, handing over the vehicle and invoicing.
• To communicate about your service: quotation, inspection-report and invoice links by SMS, e-mail or WhatsApp, and verification codes for signing in to the client portal.
• To receive payments through a licensed payment gateway and issue electronic tax invoices as required by the Zakat, Tax and Customs Authority.
• To comply with Saudi law (tax, commercial and consumer-protection rules) and respond to lawful requests from authorities.
• To secure the system, prevent fraud and improve service quality.

4. Payments

When you pay online you are taken to the page of a licensed payment-gateway provider, which processes your card data under the Payment Card Industry Data Security Standard (PCI DSS). We never see or store your full card number; we keep only the transaction reference, amount and status as proof of payment and for accounting reconciliation.

5. Who we share it with

We do not sell your data. We share it only with parties that process it on our behalf and only as far as needed:

• The payment-gateway provider, to complete payments.
• Our accounting and invoicing system (Daftra), to issue invoices and keep financial records.
• SMS and e-mail providers, to send links, notifications and verification codes.
• Hosting and infrastructure providers (Supabase, Vercel and Netlify) that run the website and the system, under data-protection agreements.
• Government and judicial authorities when legally required.

6. How long we keep it

Invoices and financial records are kept for the periods required by Saudi tax and commercial regulations. A vehicle's service history is kept for as long as you remain a client, because the maintenance history is essential to service quality and warranty. Temporary inspection data (such as photos not tied to an invoice) is deleted within a reasonable period, and other data is deleted or anonymised once it is no longer needed.

7. How we protect it

We use encryption in transit (HTTPS), role-based access for each staff member, two-step verification for staff accounts, time-limited client links protected by verification codes, audit logs for sensitive actions, and regular backups.

8. Your rights

Under the PDPL you have the right to:

• Know what data we hold about you and receive a copy of it.
• Ask us to correct inaccurate data.
• Ask us to delete your data where the law does not require us to keep it (for example invoices).
• Withdraw your consent to marketing communication at any time.
• Lodge a complaint with the Saudi Data & AI Authority (SDAIA) as the competent authority.
• To exercise any of these rights, contact us through the channels published on awsg.sa or the client portal; we will respond within the statutory period.

9. Cookies

The website and the system use strictly necessary cookies only: to keep you signed in and to remember your language and theme preferences. We do not use advertising or tracking cookies.

10. Minors

Our services are directed at adult vehicle owners and businesses; we do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy when our services or the law change. The date is shown at the top of the page; for material changes we will notify you through the contact details we hold.

12. Contact

AWS Group — 6946 Omar Jan Street, Al Rimal, Riyadh 13263, Saudi Arabia — contact channels published on awsg.sa.