العربية | English

Privacy Policy

Last updated: 30 October 2026

This policy explains how we collect, use, share and protect your personal data when you use drbaker.sa, or when you contact us. We do so in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued by Royal Decree No. (M/19) dated 9/2/1443H as amended, and its implementing regulations.

1. Who we are

The party responsible for your data (the controller) is: Dr.Baker Industrial Company, a Saudi company, Tax Registration No. 311675637400003. Address: Street 13, Industrial City, Al Madinah, Kingdom of Saudi Arabia. You can reach our data-protection contact about anything related to your data at: Email ksa@drbaker.de, phone +966 53 305 3045 and WhatsApp +966 53 305 3810.

2. Data we collect and where it comes from

  • Account data: name, phone number and email, and company details for business customers.
  • Business dealings: company name and contact-person details, quotation requests, orders and supply terms, and documents you send us such as your commercial register and VAT registration certificate.
  • Payment data: the bank-transfer details shown on the transfer receipt you send us.
  • Conversations: the content of messages you send us through WhatsApp and our contact forms (text, photos, voice notes and files), and your name and account ID as the messaging platform shows them to a business account.
  • Technical data: IP address, device and browser type, and usage data collected by the cookies and measurement tools described in this policy.

We receive this data from you directly when you use our services or contact us. We do not ask you for sensitive data such as health, religious or credit data.

3. Why we use your data

  • To create and manage your account.
  • To process and deliver your orders and provide after-sales service.
  • To prepare quotations and perform contracts and orders with businesses.
  • To take payment and issue invoices.
  • To answer your questions, messages and complaints.
  • To operate and secure the website and prevent fraud.
  • To measure use of the website.
  • To send marketing messages, only with your consent.
  • To comply with the law and respond to requests from competent authorities.

4. Legal basis for processing

We process your data on one of the following bases:

  • Performance of a contract: to fulfil your order, your account or our agreement with you.
  • Legal obligation: such as tax, e-invoicing and consumer protection.
  • Legitimate interest: to operate, secure and improve our services and to keep in business contact with companies, without overriding your rights.
  • Consent: for marketing messages, non-essential measurement tools and any case where the law requires your consent. You can withdraw your consent at any time.

5. Sharing your data

We do not sell your personal data. We share it only as needed with:

  • Competent government bodies in the Kingdom where the law requires it.

We also share it with service providers that process data on our behalf, under confidentiality obligations:

  • Hetzner: hosting of the website and database in Nuremberg (Germany).
  • Hetzner: storage of encrypted backup copies of the website and database (Finland).
  • Backblaze: storage of encrypted backup copies of our data (United States).
  • Google (Google Fonts): loading the website fonts; your device's IP address reaches Google when a page opens (United States).
  • Google (Google Analytics): measuring visits to the website and how it is used (United States).
  • Meta (WhatsApp): carrying your messages when you contact us on WhatsApp (United States).

When you message us on WhatsApp, Meta also processes your messages under its own policy.

6. Transfers outside the Kingdom

Your data is hosted outside the Kingdom of Saudi Arabia, in the following countries:

  • Germany: the Hetzner servers in Nuremberg that run the website and database.
  • Finland: encrypted backup copies at Hetzner.
  • United States: encrypted backup copies at Backblaze, and the services of Google and Meta.

We apply the safeguards the Regulation on Personal Data Transfer outside the Kingdom requires for these transfers, and we transfer only what is needed to provide the service.

7. How long we keep your data

We keep your data for as long as needed for the purpose we collected it for, and then for the periods required by the laws of the Kingdom, such as zakat, tax and commercial regulations. After that we delete the data or remove what identifies you.

8. Security

We take technical and organisational measures to protect your data against loss, misuse and unauthorised access, including:

  • Encryption of the connection between your device and our websites over HTTPS.
  • Administrative access to our servers over SSH is by key only.
  • Encrypted backups.
  • Access rights set for each user according to their work.

9. Your rights

The Law gives you the following rights:

  • To be informed how your data is collected and why it is processed.
  • To access your data and obtain a copy of it in a clear format.
  • To ask for your data to be corrected, completed or updated.
  • To ask for your data to be destroyed when it is no longer needed.
  • To withdraw your consent to processing at any time.

Withdrawing consent does not affect processing carried out before it. We may keep some data where the Law requires us to.

10. How to exercise your rights

Send your request to our data-protection contact at: Email ksa@drbaker.de, phone +966 53 305 3045 and WhatsApp +966 53 305 3810. We may ask you for proof of identity before we act on a request, so that we do not give your data to someone else. We answer your request within no more than thirty (30) days of receiving it.

11. Complaints

If you believe our processing of your data breaks the Law, you have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority. We ask you to contact us first so that we can try to solve the problem.

12. Data breach notification

If your data is leaked, damaged or accessed unlawfully, we notify the Saudi Data and Artificial Intelligence Authority within seventy-two (72) hours of becoming aware of it, and we notify you without delay if it is likely to cause you harm, as the Law requires.

13. Cookies and measurement tools

We use essential cookies to run the website, for example to keep you signed in, keep your shopping cart and remember your language. We also use the following tools:

  • Google Analytics: sets cookies that measure visits, the pages you open and where the visit came from.

Data from these tools reaches Google in the United States. The website also loads Google Fonts from Google's servers, so your device's IP address reaches Google when a page opens. You can refuse or delete non-essential cookies at any time in your browser settings; this does not stop you from using the website.

14. Electronic marketing messages

We send you marketing messages by text message, WhatsApp or email only after your prior consent. Every marketing message clearly shows Dr.Baker Saudi Arabia as the sender. You can stop these messages at any time by contacting us at: Email ksa@drbaker.de, phone +966 53 305 3045 and WhatsApp +966 53 305 3810. We stop them free of charge. Service messages, such as order confirmations, are sent because they are needed to provide the service.

15. Children

Our services are not directed at people under 18, and we do not knowingly collect their data without a guardian's consent. If you learn that a child has sent us their data, contact us so that we can delete it.

16. Changes to this policy

We may change this policy from time to time. We publish the updated version on this page with its "Last updated" date. If a change is material, we tell you about it in a suitable way before it takes effect.

17. Contact

Dr.Baker Industrial Company — Street 13, Industrial City, Al Madinah, Kingdom of Saudi Arabia. Email ksa@drbaker.de, phone +966 53 305 3045 and WhatsApp +966 53 305 3810.