Data protection information for web user

1. What information does this document contain for you?

When visiting our website, we process your personal data, in doing so we ensure that we comply with the requirements of the Saudi Arabia Cabinet Decision No. 98/1443 amended by virtue of Saudi Arabia Cabinet Decision No. 604/1444 dated 29/08/1444H and as amended from time to time (PDPL), and other applicable data protection laws and regulations as may apply, such as GDPR1.

Below we would like to give you a detailed overview of how we process your personal data and your personal data rights.

2. Who is responsible for the data processing and who is the data protection officer (DPO)?

• 2.1. The Controller of the data processing is:
  
  
  • TK Elevator Saudi Arabia Ltd.
    Salah Eddin Ayoubi Street, Bawani Tower, 6th Floor
    P. O. Box 9812
    Riyadh 11423
    Kingdom of Saudi Arabia
    
    Phone: +966 11 4868 909
    Fax: +966 11 4868 901
    E-mail: info.sa@tkelevator.com
• 2.2. You can reach our Data Protection Officer at:
  
  
  • TK Elevator Saudi Arabia Ltd.
    One Sheikh Zayed Road, The H Dubai Office Tower, 11th floor
    Dubai PO. Box 27278.
    United Arab Emirates
    
    E-mail: dpo@tkelevator.com
    
    

3. Scope and amendments to this privacy statement.

• 3.1. This privacy statement applies exclusively to the use of our website. It does not apply to the websites of other service providers to which we provide a link. We accept no responsibility for third-party statements and guidelines of third parties. We recommend that you familiarize yourself with the privacy policies and practices of any such third parties.
• 3.2. We reserve the right to amend these data privacy rules from time to time in accordance with future changes relating to the collection and processing of personal data.

4. Which data categories do we use and where do they come from?

The personal data processed in our website will be collected from the following sources:

• 4.1. From your devices, when you visit our website our web servers save as standard the Internet Protocol (IP) address (a number that is automatically assigned to a computer when the Internet is used), the site from which you access our website, the files you access from us, the date of your visit and general information about your browser (version and type).
• 4.2. Directly from you, when you complete a contact form or register to receive personalized services. In these cases, you will be informed about the intended use and, if necessary, obtain your consent.
• 4.3. From the cookies, when you visit our website cookies identifiers are associated with your online identifiers provided by your devices. In these cases, you will be informed about the intended use and, if necessary, your consent will be requested for the installation of cookies on your devices. For more information visit our Cookies Policy.

5. What are the purposes and on what legal basis are your data processed?

The personal data can be processed for the following purposes:

• 5.1. Security purposes.
  The information collected from your devices (see point 4.1) are processed to ensure the stability and the security of the web server and to display our website to you (e.g. your phone. laptop or other device). These data may be analysed only in anonymized form for statistical purposes.
  
  
  • 5.1.1. Lawfulness of the processing:
    The processing is necessary for the purposes of the TKE’s legitimate interests (Art. 6.4 PDPL).
    
    

• 5.2. Product & Service requests.
  When you contact us through the contact forms or through the contact addresses provided on our website, we process your personal data to respond to your inquiries and fulfil your request, including to contact you if necessary. The personal data processed will be those that you decide to provide us with and/or those requested in the contact forms: e.g., first name, last name, email, street, zip code, town/city, telephone number and content of your request.
  
  
  • 5.2.1. Lawfulness of the processing:
    The processing is necessary for the performance of a contract (Art. 6.2 PDPL).
  • 5.2.2. Data retention:
    The information will be processed as long as necessary to fulfil your request and no longer than three (3) months after we receive your request.
    
    

• 5.3. Media.
  When contacting the spokesperson of your country/region for press information, your personal data will be processed to respond to your request. The personal data processed will be those you have voluntarily provided to the spokesperson including first name, last name and email address.
  
  
  • 5.3.1. Lawfulness of the processing:
    The processing is based on your consent (Art. 5.1 PDPL).
  • 5.3.2. Data retention:
    The information will be kept until you withdraw your consent.
    
    

• 5.4. Complaints.
  When making a complain related to one of our products or services, your personal data will be processed to respond to and manage your complaint. The personal data process will be those you decide to provide us when submitting your complaint: e.g., first name, last name, email, street, zip code, town/city, country, telephone number and content of your complain.
  
  
  • 5.4.1. Lawfulness of the processing:
    The processing is necessary for compliance with a legal obligation under any law other than PDPL (Art 6.2 PDPL).
  • 5.4.2. Data retention:
    The information will be kept during the time in which the claim remains in course, once finished, the information will be stored duly blocked for the time necessary in order to fulfil statutory obligations.
    
    

• 5.5. Career.
  When visiting our career section to apply for a specific job or send us an unsolicited application, your personal data will be processed to manage your application in our open positions and/or to find job offers according to your experience. The personal data processed will be those you decide to provide us and/or requested in the job offer: e.g., first name, last name, email, street, zip code, town/city, country, telephone number, job experience, salary expectation, cover letter, CVs and any other information you decide to attach in your application.
  
  
  • 5.5.1. Lawfulness of the processing:
    When applying for an specific job offer, the legal basis for the processing is the performance of a contract (Art. 6.2 PDPL) and/or to take steps at your request prior to entering into a contract. When sending unsolicited applications, the legal basis for the processing is your consent (Art. 5.1 PDPL).
  • 5.5.2. Data retention:
    The personal data will be processed during the time stipulated in the data protection information included in the job offers and/or the career section. Unsolicited applications will be deleted two (2) years after you sent us your application.
    
    

• 5.6. Reports.
  The personal information you provide when submitting a report (name, contact information, facts reported, etc.) will be used to process the report (including investigation of the case and subsequent investigation and, if necessary, reporting to the authorities.
  
  
  • 5.6.1. Lawfulness of the processing:
    Performance of a task carried out following a legal obligation (Art 6.2 PDPL).
  • 5.6.2. Data retention:
    The information you provide when submitting an incident report will be stored for as long as is necessary to determine whether an investigation of the alleged facts needs to be conducted. If it is determined that it is not necessary to initiate an investigation, the information will be retained for the period necessary to comply with legal obligations. If it is determined that an investigation is required, the information will be stored for as long as necessary to conduct the investigation, implement measures and, if necessary, for the purposes of consistent criminal prosecution.
    
    

Automated individual decision-making processes that could have legal effects on you or could significantly affect you in a similar way do not take place in connection with your use of this website.

6. Who receives your data?

• 6.1. Unless the disclosure is mandatory for legal requirements, the information processed in our website will be processed within our Company only by persons and departments (e.g. recruitment department, sales department, marketing department, etc.), which need it for the above mentioned purposes.
• 6.2. Within our group of companies, some of your data is transferred to specific locations within the Group (Corporate/business area/group companies) if they perform centralized data processing tasks for the Group's affiliated companies (e.g. centralized IT applications). The transmission of personal data to the TK Elevator Group is carried out under the legitimate interest of TK Elevator Group (recital 48 GDPR) and in order to enable the controller to carry out its activities, including the operations of the central administration in accordance with Article 29(2) of the PDPL, as amended, and Article 2(4) of the Data Transfer Regulation. TK-Elevator group have located undertakings around the world, therefore your data can be transferred outside the Kingdom of Saudi Arabia, and for such data transfers legal requirements under the GDPR and the PDPL has been implanted, such us GDPR Standard Contractual Clauses in order to ensure an adequate level of protection for Personal Data outside the Kingdom in accordance with Article 29(2) of the PDPL, as amended, and Article 2(4) of the Data Transfer Regulation.
• 6.3. In addition, we partly use external service providers who are obligated by data processing agreements under data protection regulations to fulfil their data protection obligations (e.g., servers providers in the following areas: IT services and infrastructure, customer services, etc.). Some service providers can be located outside the Kingdom of Saudi Arabia. This is done in compliance with data protection requirements, in particular the assurance of an adequate level of data protection in accordance with Art. 29 PDPL and its implementing regulations.
  
  

7. Which data protection rights can you claim as the person affected?

• 7.1. You have the right to information about the personal data in question and the right of access, correction, completion, update or destruction in accordance with Art. 4 PDPL and its implementing regulations.
• 7.2. Insofar as you have provided us with your consent to process your personal data in accordance with Art. 5 PDPL, you can withdraw this consent at any time without affecting the lawfulness of processing based on your consent prior to its withdrawal.
• 7.3 If you would like to exercise any of these rights, please send a written request explicitly specifying your query to Data Protection Officer (see contact details in point 2.2).
• 7.4. You have the right to complain to the supervisory authority. The data protection authority responsible for us is:
  
  The Saudi Data & Artificial Intelligence Authority (SDAIA)
  Web: Saudi Authority for Data and Artificial Intelligence (sdaia.gov.sa)
  E-mail: Suggestions@sdaia.gov.sa