Overview
Zilij X ("we", "our", or "us") is a last-mile delivery and logistics company operating in the Kingdom of Saudi Arabia. We are committed to protecting your personal data in accordance with the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 and its implementing regulations.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our services, website, or mobile application.
1. Data We Collect
We collect the following categories of personal data:
- Identity data: Full name, national ID number (where required), date of birth
- Contact data: Phone number, email address, physical address
- Delivery data: Sender and recipient details, delivery address, parcel contents description
- Location data: Real-time GPS location during active deliveries
- Payment data: Transaction records, payment method type (we do not store full card numbers)
- Technical data: IP address, device type, browser type, app usage data
- Communication data: Records of calls, messages, or emails with our support team
2. How We Use Your Data
We use your personal data for the following purposes:
- Processing and fulfilling delivery orders
- Tracking shipments and providing real-time updates
- Communicating with you about your orders, services, and support
- Processing payments and issuing invoices
- Verifying identity and preventing fraud
- Improving our services, platform, and customer experience
- Complying with legal obligations under Saudi law
- Sending service-related notifications (not marketing without consent)
3. Legal Basis for Processing
Under the PDPL, we process your data based on one or more of the following legal bases:
- Contractual necessity: To fulfill delivery contracts and service agreements
- Legal obligation: To comply with Saudi regulations including ZATCA, SDAIA, and relevant authorities
- Legitimate interest: To improve our services and prevent fraud
- Consent: For marketing communications, where we will always ask your permission first
4. Data Sharing
We do not sell your personal data. We may share your data only with:
- Delivery partners and couriers: Only the data needed to complete your delivery
- E-commerce platforms: Such as Zid and Salla, when integrated through our API
- Payment processors: To securely process transactions
- Government authorities: When required by Saudi law or judicial order
- Technology service providers: Cloud hosting, SMS, and communication services under strict data protection agreements
All third parties are required to handle your data securely and in compliance with PDPL.
5. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes described in this policy, or as required by Saudi law. Specifically:
- Delivery records: 5 years (as required by commercial regulations)
- Financial and invoice records: 10 years (as required by ZATCA)
- Account data: Until account deletion + 1 year
- Communication records: 2 years
After the retention period, data is securely deleted or anonymized.
6. Your Rights
Under the PDPL, you have the following rights regarding your personal data:
- Right to access: Request a copy of your personal data we hold
- Right to correction: Request correction of inaccurate or incomplete data
- Right to deletion: Request deletion of your data (subject to legal retention requirements)
- Right to data portability: Receive your data in a structured, readable format
- Right to withdraw consent: Withdraw consent for marketing at any time
- Right to object: Object to processing based on legitimate interest
To exercise any of these rights, contact us at info@zilijx.sa
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data including:
- SSL/TLS encryption for all data in transit
- Secure encrypted servers hosted within or compliant with Saudi data residency requirements
- Access controls — only authorized personnel can access personal data
- Regular security audits and vulnerability assessments
- Staff training on data protection and privacy
8. Cookies and Tracking
Our website uses essential cookies to ensure proper functionality. We do not use tracking or advertising cookies without your explicit consent. You can control cookie settings through your browser at any time.
9. Children's Privacy
Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website or sending you an email. The date at the top of this page indicates when the policy was last updated.
11. Contact Us
If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact us:
You also have the right to file a complaint with the Saudi Data & AI Authority (SDAIA) if you believe your data rights have been violated.
