1. Introduction and Data Controller

This Privacy Notice explains how AMIT Trading Co., a company incorporated in the Kingdom of Saudi Arabia and operating the website www.garmin.sa, collects, uses, stores, and protects personal data in accordance with the Saudi Personal Data Protection Law (PDPL) issued pursuant to Royal Decree No. (M/19) dated 09/02/1443 AH corresponding to 16/09/2021 G and its implementing regulations, (As Amended).

For the purposes of applicable data protection laws, AMIT Trading Co. is the sole Data Controller responsible for the processing of personal data collected through this website and related services.

This Privacy Notice applies to personal data collected from users, customers, and visitors. Where consent is required under applicable law, such consent will be obtained through appropriate mechanisms and not solely by continued use of the website.

2. Categories of Personal Data We Collect

We collect and process personal data only to the extent necessary to provide our services, comply with legal obligations, and improve user experience, in accordance with the Saudi Personal Data Protection Law.

2.1 Personal Data You Provide Directly

When you interact with our website or services, you may provide personal data, including:

• Full name
• Contact details (such as phone number and email address)
• Delivery and billing address
• Payment-related information (processed through authorized payment service providers)
• Account or order-related information

Providing such data is voluntary; however, failure to provide certain information may affect our ability to deliver requested services.

2.2 Automatically Collected Data

When you visit our website, we may automatically collect limited technical data, subject to applicable consent requirements, including:

• Internet Protocol (IP) address
• Browser type and device information
• Website usage data (such as pages visited and interactions)
• Approximate location data derived from IP address

This data is collected through cookies and similar technologies and is used for website functionality, security, and performance analysis.

2.3 Data Received from Third Parties

We may receive limited personal data from third-party service providers acting on our behalf, such as:

• Delivery partners (for shipment and address confirmation)
• Payment service providers (for payment status confirmation)
• Such data is processed solely for the purposes for which it was shared and in accordance with applicable law.

3. Purposes of Processing Personal Data

We process personal data for specific and lawful purposes in accordance with the Saudi Personal Data Protection Law. These purposes include:

3.1 Processing and fulfilling orders and transactions. Managing customer accounts and requests. Communicating with users regarding orders, services, and operational matters

3.2 Complying with applicable laws, regulations, and regulatory requests. Maintaining records as required by law

3.3 Protecting the security and integrity of our website and systems. Preventing, detecting, and investigating fraud, misuse, or unlawful activity

3.4 Analyzing website usage and performance to improve functionality and user experience. Conducting internal analytics, subject to applicable consent requirements

3.5 Sending promotional communications or marketing materials only where permitted by law and based on the user’s explicit consent, which may be withdrawn at any time.

3.6 Interest-based advertising or similar technologies are used only where the user has provided explicit consent through the website’s cookie preference mechanism.

4. Disclosure and Sharing of Personal Data

4.1 We do not sell or disclose personal data to third parties except as described below and in accordance with the Saudi Personal Data Protection Law.

4.2 We may share limited personal data with third-party service providers who process data on our behalf and under our instructions, including:

• Payment service providers
• Logistics and delivery partners
• IT and website hosting providers
• Customer support and communication service providers
• Such service providers are contractually bound to:
• Process personal data only for the specified purposes
• Maintain confidentiality
• Implement appropriate security measures

4.3 We may disclose personal data where required to comply with applicable laws, regulations, court orders, or requests from competent authorities, or to protect our legal rights.

4.4 Personal data may be disclosed where necessary to perform a contract with the user or to provide requested services, limited to what is strictly required.

4.5 In certain cases, personal data may be transferred or accessed outside the Kingdom of Saudi Arabia, such as where service providers or technical infrastructure are located abroad. Any such transfer shall be carried out in compliance with applicable PDPL requirements and with appropriate safeguards in place.

5. Security of Personal Data

We implement appropriate technical, administrative, and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction, in accordance with the Saudi Personal Data Protection Law.

These measures include, where appropriate:

• Use of encryption and secure communication protocols
• Access controls and authentication mechanisms
• Compliance with recognized security standards for payment data, including the Payment Card Industry Data Security Standard (PCI DSS), where applicable
• Internal policies and procedures governing data access, handling, and retention

We regularly review and update our security measures to ensure their continued effectiveness and to address evolving risks.

While we take reasonable steps to protect personal data, users are responsible for maintaining the confidentiality of their account credentials and for taking appropriate measures to protect their devices and access information.

No method of transmission or storage is completely secure; however, we strive to maintain safeguards appropriate to the nature and sensitivity of the personal data processed.

6. Data Subject Rights

In accordance with the Saudi Personal Data Protection Law, individuals whose personal data we process have the following rights, subject to applicable legal requirements and limitations:

6.1 You have the right to request confirmation as to whether we process your personal data and to access such data.

6.2 You have the right to request correction of inaccurate, incomplete, or outdated personal data.

6.3 You have the right to request the destruction of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.

6.4 Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal.

6.5 Requests to exercise the above rights may be submitted by contacting us at: [email protected]

We may request additional information to verify identity before processing such requests, in accordance with applicable law.

7. Children’s Personal Data

Our website and services are not directed to children, and we do not knowingly collect or process personal data relating to individuals under the age of 18 without the involvement and consent of a parent or legal guardian.

Where personal data of a child is collected in connection with the provision of services, such processing shall be limited to what is strictly necessary and shall be carried out in accordance with the Saudi Personal Data Protection Law.

If a parent or legal guardian believes that a child has provided personal data to us without appropriate consent, they may contact us using the details provided in this Privacy Notice, and we will take appropriate steps to address the matter.

8. Updates to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legal requirements, regulatory guidance, or our data processing practices.

Any updated version of this Privacy Notice will be published on this website and will indicate the date of the most recent revision.

Where required by applicable law, we will take reasonable steps to inform users of material changes that affect the processing of their personal data. Such changes will not apply retroactively in a manner that adversely affects data subject rights, unless permitted or required by law.

Continued use of the website following publication of an updated Privacy Notice does not constitute consent to new or expanded processing activities where consent is required under applicable law.