1. Controller and scope

The data controller is ERAMCO (شركة ارم الحديثة للمقاولات العامة), based in Madinah, Kingdom of Saudi Arabia, Unified National Number 7026952460. Privacy contact: [email protected].

This policy applies to the public website, quotation requests, supplier and subcontractor registration and qualification, contact and recruitment routes, and any electronic payment service later approved for the website. It does not govern third-party websites or applications reached through external links.

2. Personal data we process

Depending on the route used, we may process:

Identity and contact data: name, organisation, role, phone, email, city and website.
Project and quotation data: requested service, work scope, expected programme, location, project summary, BOQs, drawings, specifications and attachments submitted by the user.
Supplier or contractor data: entity type, registration and VAT data, branch, disciplines, service regions, experience, workforce, representatives, notes, bank/IBAN evidence, certificates, licences and qualification documents voluntarily uploaded.
Recruitment and contact data: information placed in the email prepared by the website and any CV or attachment sent by email.
Technical and usage data: page URL, referrer, campaign parameters and advertising identifiers where present, browser and device information, and a one-way hash of the IP address used for security and abuse prevention. Analytics tools may also collect usage data after consent.
Payment data when enabled: transaction reference, amount, currency, status, time, invoice reference and limited information returned by the payment provider for reconciliation. The customer provides card or payment-method data directly to the payment provider under the approved configuration and the provider's notice.

3. How data is collected

We collect data directly from individuals when they complete a form, upload a file, send an email or WhatsApp message, or otherwise contact us; from the browser and device during a visit; and from service providers when they deliver a transaction, message or usage report.

The quotation form creates a lead record in ERAMCO's enquiry-tracking system and may direct the user to a communication channel or allow documents to be sent through the route displayed at the time of use. The recruitment form currently prepares a message in the user's email application and does not upload the CV to the website, although email providers process the data when it is sent. The vendor portal stores applications, drafts and documents in ERAMCO's systems.

4. Purposes and lawful basis

We process data for the following purposes, relying as applicable on consent, steps requested before entering a contract, contract performance, legal obligations and legitimate interests permitted by law:

Responding to enquiries, reviewing project opportunities, preparing quotations, negotiating and contracting.
Qualifying suppliers and contractors, validating documents, managing the supply network and communicating about an application.
Receiving and assessing recruitment applications and contacting candidates.
Invoicing, collection, accounting reconciliation, fraud prevention and transaction settlement when payment is enabled.
Operating, securing and measuring the website and improving content and services.
Maintaining records, evidencing transactions, complying with legal requirements, and handling claims and disputes.

5. Cookies, local storage and analytics

The website stores the visitor's analytics acceptance or rejection choice in browser local storage. Under the current website configuration, Google Analytics is loaded only after acceptance and the available IP-anonymisation setting is enabled.

Local or session storage may also hold a supplier-draft identifier and tracking token, interface preferences or a flag that prevents a help prompt repeating during a session. These items can be removed through browser settings, which may affect draft recovery or tracking.

6. Sharing and service providers

We do not sell personal data. We may provide the minimum necessary data to:

Website hosting, delivery and security provider (Cloudflare).
Database, storage and backend-functions provider (Supabase).
Analytics provider (Google Analytics) after consent.
Email and communications providers, and WhatsApp/Meta where the user chooses WhatsApp.
The approved payment provider, including Network International if its service is approved and activated.
Advisers, auditors and professional service providers, and public, regulatory or judicial authorities where disclosure is required or permitted by law.
Project or tender parties where necessary to review a request or perform a contract and subject to appropriate controls.

7. Processing locations and international transfers

The website uses service providers whose infrastructure may process data inside or outside Saudi Arabia. The database and storage used by website forms are currently hosted through Supabase in Frankfurt, Germany. Security, content-delivery, analytics, communications, email and payment services may operate from other locations.

Where personal data is transferred outside the Kingdom, ERAMCO will apply the applicable Saudi requirements for international transfers, including limiting transfers to what is necessary and selecting appropriate safeguards.

8. Retention

No single retention period applies to every record. Data is retained as needed to review a request, manage a relationship or perform a contract, and for accounting, tax, legal, evidence and claims requirements. When the purpose and lawful basis end, ERAMCO will take appropriate steps to destroy or anonymise the data in accordance with applicable requirements.

A draft link or tracking token may expire after the period shown to the user, but link expiry alone does not mean that the underlying application record or documents have been deleted. A person may ask about a specific record or exercise applicable rights using the contact below.

9. Security

ERAMCO applies organisational and technical measures appropriate to the nature of the data, including role-based access, encrypted connections, private attachment storage, file type and size validation, and abuse controls. No electronic method is completely risk-free, so controls are reviewed and incidents are handled in accordance with applicable requirements.

10. Data-subject rights

Subject to the Saudi Personal Data Protection Law and applicable regulations, rights may include being informed, access, obtaining a clear copy, correction, completion or updating, destruction where the conditions apply, withdrawal of consent where processing relies on consent and no other basis applies, and submitting a complaint to the competent authority.

To exercise a right or submit a privacy enquiry, email [email protected] with your name, contact details, request and relevant application, project or record reference. We may request reasonable information to verify identity and authority before disclosure, amendment or destruction. Some rights may be limited by legal, contractual or judicial requirements.

11. Other people's data and children

If a user submits another person's data or documents containing personal data, the user should ensure that they are authorised to do so and that the person is informed of this policy. ERAMCO's services are business-focused and are not intentionally directed to children.

12. Updates and contact

We may update this policy when services, laws or processing providers change. The review date will be shown on this page. Privacy enquiries and requests: [email protected].

Last updated: 22 October 2026.

Privacy Policy