Privacy Policy
The purpose of this Privacy Policy is to explain how Petro Rabigh collects, uses, stores, shares, and protects personal data obtained through its websites, mobile applications, and electronic services. This Notice is established in compliance with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL) and its Implementing Regulations to ensure transparency, lawful processing, and protection of personal data.
The Notice also informs website visitors and users of their rights regarding personal data processing and outlines the security and privacy measures implemented by Petro Rabigh to safeguard personal information.
This Privacy Notice applies to all visitors, users, applicants, and individuals interacting with Petro Rabigh's websites, mobile applications, and electronic services. It covers personal data collected through online forms, recruitment portals, registrations, cookies, analytics tools, and electronic transactions. The Notice applies to all departments, employees, contractors, and third parties involved in processing website visitor data and ensures compliance with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL).
| Abbreviation | Description |
|---|---|
| PDPL | Personal Data Protection Law |
| SDAIA | Saudi Data & Artificial Intelligence Authority |
| DPO | Data Protection Officer |
| KSA | Kingdom of Saudi Arabia |
| PII | Personally Identifiable Information |
| IT | Information Technology |
| MFA | Multi-Factor Authentication |
| IP | Internet Protocol |
| CV | Curriculum Vitae |
| Term | Description |
|---|---|
| Personal Data | Any information that directly or indirectly identifies an individual, including name, ID number, contact details, employment information, or technical identifiers. |
| Sensitive Personal Data | Personal data relating to racial or ethnic origin, religious beliefs, health data, biometric data, genetic data, criminal records, or any data classified as sensitive under the PDPL. |
| Data Subject | The individual to whom the personal data relates, including prospective employees and job applicants. |
| Processing | Any operation performed on personal data, whether automated or manual, including collection, recording, storage, use, sharing, transfer, retention, or deletion. |
| Controller | The entity that determines the purpose and means of processing personal data. For this Notice, Petro Rabigh acts as the Data Controller. |
| Processor | Any natural or legal person that processes personal data on behalf of the Controller. |
| Consent | Any freely given, specific, informed, and explicit indication of the data subject's agreement to the processing of personal data. |
| Data Breach | Any unauthorized access, disclosure, loss, destruction, alteration, or misuse of personal data. |
| International Data Transfer | Transfer, storage, or access of personal data outside the Kingdom of Saudi Arabia. |
| Third Party | Any external organization or individual authorized to receive or process personal data for recruitment-related purposes. |
| Technical Data | Information automatically collected from systems or devices, such as IP addresses, browser type, operating system, and device identifiers. |
| Cookies | Small text files stored on a user's device to improve website functionality, analytics, and user experience. |
This Privacy notice governs the collection, use, disclosure, and protection of personal data by Petro Rabigh ("we," "us," or "our") when individuals visit our websites or use any of our mobile applications operated by us. We are committed to safeguarding your privacy in accordance with the Personal Data Protection Laws of the Kingdom of Saudi Arabia.
We collect and process various categories of personal data during your interaction with our website. This includes contact forms, where visitors may provide names, telephone numbers, email addresses, contact preferences, and message content. When applying for a position through the recruitment portal, or when registering or accessing our electronic services, applicants and users may be asked to create an account for authentication purposes, which typically involves providing basic login credentials (usernames and passwords). In addition, the recruitment process requires applicants to submit personal data such as identity details (including passports and/or official identifiable cards), contact information, qualifications, and CVs/resumes.
This information is used exclusively for assessing suitability for employment opportunities and for managing the recruitment process. Additionally, web analytics tools may capture technical information including IP addresses, browser type, device details, and usage metrics to monitor site performance and user behavior.
When using Petro Rabigh's electronic services, we may also collect personal data necessary for membership registration and renewal, certificate issuance, document authentication, authorized signatory services, commercial facilitation transactions, event or delegation participation, and sectoral council engagement. This may include identity information (such as National ID number), National Address details, business affiliation details, membership or subscription identifiers, account credentials, authorization and verification information, transaction references, and payment-related metadata, collected solely to deliver and administer the requested services in accordance with applicable laws and regulations.
Personal data shall not be processed for purposes other than those stated in this Privacy Notice unless permitted under applicable laws or with your consent.
We use web analytics and security monitoring tools that may automatically collect technical information such as IP addresses, browser type, device identifiers, operating system details, access timestamps, and usage metrics. This information is used to ensure platform security, monitor system performance, improve user experience, and support service optimization.
For more information about how we use cookies and similar tracking technologies, please refer to our dedicated Cookie Policy, which explains the types of cookies we use, the purposes of processing, and the available options for managing your preferences and consent.
We collect personal data through direct and indirect means.
Direct collection occurs when you voluntarily provide personal data by completing forms on our website or through our mobile application platforms, availing or subscribing to our services, or communicating with us directly. Personal data collected through these means is processed for the following purposes:
Indirect collection from third parties: We may also obtain personal data from third-party sources, including publicly accessible profiles on professional networking platforms (such as LinkedIn) and other social media channels, in accordance with the PDPL and its Implementing Regulations. This indirect collection is undertaken only when:
The personal data collected from these sources is used exclusively for:
We process personal data in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Our legal bases include obtaining the data subject's explicit consent, fulfilling contractual obligations, complying with legal requirements, or pursuing legitimate business interests, provided these do not override the rights and freedoms of individuals. Where consent is used, it is obtained transparently and may be withdrawn at any time.
We are committed to protecting your personal data through robust security practices. We implement physical, technical, and organizational measures to safeguard your information against unauthorized access, alteration, disclosure, or destruction. These include data encryption (both in transit and at rest), access restrictions, multi-factor authentication, regular security testing, and ongoing staff training in data protection.
Your personal data is stored either within secure facilities in the Kingdom of Saudi Arabia or through certified cloud service providers that adhere to equivalent security standards and comply with applicable data protection laws. All storage environments are monitored and governed by strict security controls.
We regularly review and enhance our security protocols to address new risks and ensure compliance with legal and regulatory developments. Should a data breach occur that compromises your personal data, we will notify you and the relevant authorities promptly, in line with legal obligations.
We do not sell, rent, or otherwise disclose your personal data to external parties, except as outlined in this Privacy Notice. We may share your data with third-party vendors, service providers, travel agencies, or port authorities, among others ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties designed to safeguard your personal information — they cannot use your personal information unless we have instructed them to, and they will not share it with any organization apart from us. They also commit to protecting the data they hold on our behalf and to retaining it only for the period we instruct.
Petro Rabigh requires its business partners to use personal data only for the agreed purposes, to implement appropriate security measures, and to always protect the rights and confidentiality of individuals. We may disclose personal data to regulatory or legal authorities when such disclosure is required under applicable laws and regulations.
We operate with affiliates and vendor partners who may operate in third countries, which means personal data may be stored and processed by us or our service providers.
By providing personal data for any of the purposes stated above, you acknowledge that your personal data may be transferred to or stored in third countries outside of the Kingdom, and we will take necessary measures to safeguard personal data in accordance with the contractual obligations and data protection requirements applicable to the provision of services.
Your personal data will only be transferred if we or our vendor partners:
Should future business requirements necessitate international data transfers, we will ensure appropriate safeguards are in place to protect your data and will inform you of any such changes.
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, you have specific rights concerning your personal data, including the right to be informed, the right to access your data, the right to correct or update it, the right to request its erasure, the right to restrict its processing, and the right to withdraw your consent at any time. We are committed to enabling you to exercise these rights and will respond to all valid requests within thirty (30) days of receipt. For more information about how your personal data is processed, or to submit a request, please contact our team at privacy@petrorabigh.com.
We do not knowingly collect or process personal data relating to minors or individuals who fully or partially lack legal capacity, except where such processing is permitted under applicable laws and regulations and is necessary for the provision of our services.
Where the processing of personal data relates to a minor or an individual who fully or partially lacks legal capacity, such processing shall be carried out only with the consent of the legal guardian or authorized representative and in accordance with the requirements of the PDPL and its Implementing Regulations.
In such cases, we take additional measures to protect the best interests, rights, and privacy of the data subject, including limiting access to such data, applying enhanced security controls, and restricting processing to the minimum necessary for the specified purpose.
If you believe that personal data relating to a minor or a legally incapacitated individual has been collected or processed without appropriate authorization, please contact us using the details provided in this Privacy Notice so that we may take appropriate action.
We have implemented reasonable technical and organizational measures designed to protect your personal data against unauthorized access, accidental loss, or intentional destruction. Our security framework includes both physical and digital safeguards to ensure the confidentiality, integrity, and availability of your personal information.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law. Retention periods vary depending on the category of data and applicable legal obligations. Unsuccessful candidate applications are retained only for the period necessary to fulfill recruitment purposes (typically not exceeding 1 year) and are then securely deleted or anonymized. Applicants may request earlier deletion of their personal data, subject to any legal or regulatory obligations requiring retention.
After this retention period expires, we will securely dispose of your personal data using methods that prevent unauthorized access, recovery, or reconstruction of the information.
If you have any concerns regarding how we handle your personal data or believe we may have breached applicable data protection laws, you are encouraged to contact our team by emailing privacy@petrorabigh.com.
If you are not satisfied with our response, or if we do not respond within thirty (30) days, you may escalate your concern to our Data Protection Officer using the contact details below.
If you have questions or comments about this privacy notice, you may contact our Data Protection Officer (DPO):
Alternatively, you have the right to file a complaint with the relevant Competent Authority.
We reserve the right to update this Privacy Notice periodically to reflect changes in our practices, legal requirements, or service offerings. Any modifications will be posted on our website, and we encourage you to review this notice regularly to stay informed about how we protect your personal data.
This Privacy Policy was last revised and updated on August 20, 2026.