Skip to content

Legal

Privacy Policy

Last updated: 26 September 2026

Automotive Spares Co. (commercial registration 7051694839), Riyadh, Saudi Arabia, operates store.as.com.sa and is the controller of the personal data processed through it. This policy explains what we collect, why, with whom we share it and the rights you have under the Saudi Personal Data Protection Law (PDPL).

We collect only what we need to sell and deliver parts and to comply with the law. We never sell personal data.

1.Data we collect

  • Identity and contact details: name, mobile number and e-mail address.
  • Delivery details: city, district, street address and, where provided, your Saudi National Address.
  • Order and payment records: the parts you bought, prices, invoices, payment reference and status. Card numbers are entered on Tap Payments' secure page and never reach our systems.
  • Account data: your mobile number, one-time verification codes and, if you choose to set one, a password stored only as a salted hash.
  • Vehicle details you share with us to check fitment, such as the chassis number (VIN).
  • Technical data: IP address, browser type, pages visited and error logs, kept for security and troubleshooting.
  • Messages you send us by e-mail or the contact form.

2.How we use your data

  • To process and deliver your orders, issue tax invoices and handle returns and warranty claims.
  • To verify your identity when you sign in with a one-time code and to protect accounts and payments against fraud.
  • To contact you about your order by SMS or e-mail.
  • To meet legal obligations, including tax, e-invoicing and consumer-protection rules.
  • To operate, secure and improve the Store using aggregated statistics.
  • To send offers only if you have asked for them; you can opt out at any time.

3.Legal basis

We process data to perform our contract with you, to comply with legal obligations, for our legitimate interests in running and securing the Store and, for marketing, with your consent.

4.Who we share data with

We share personal data only with service providers that need it to deliver our service, under contracts that restrict its use:

  • Tap Payments — payment processing (mada, cards and Apple Pay).
  • Mapit and courier partners — delivery within Saudi Arabia; DHL Express for international shipments.
  • Authentica — delivery of one-time verification codes by SMS.
  • Our ERP and warehouse systems, which store orders, invoices and customer records.
  • Cloudflare and our hosting providers — website delivery and security.
  • Authorities where the law requires it.

5.Transfers outside Saudi Arabia

Some providers may process data outside the Kingdom; we rely on their contractual and security safeguards as required by the PDPL.

6.Cookies and local storage

  • Essential cookies only: your session, the sign-in verification challenge and the cart. We do not use advertising cookies or third-party trackers.
  • Your cart is kept in your browser's local storage until you complete or clear it.
  • Visit statistics are our own and stay on our servers: two first-party cookies — as_vid (180 days) tells a returning visitor from a new one, as_sid (30 minutes) groups a single visit — record which pages were opened, how long each was visible, the device type, the language and the approximate country or region our network provider (Cloudflare) reports. We do not store your IP address, we send none of this to a third party, and we use no external analytics service.
  • If you add parts to the basket and do not finish the order, we keep the basket contents so we can help you complete it, and we may send a single reminder when we already have your address from your account or from checkout. Tell us at any time and those e-mails stop.

7.How long we keep data

  • Orders, invoices and payment records: for the period required by Saudi tax and commercial regulations.
  • Account data: until you ask us to delete your account, subject to the retention above.
  • Technical logs: up to 90 days. Visit statistics: up to 180 days, unfinished baskets: 90 days, then deleted automatically.

8.Security

Data is transmitted over encrypted connections and stored on access-controlled systems. Payment card data is handled exclusively by our PCI DSS-certified payment provider.

9.Your rights

Under the PDPL you may:

  • ask for a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • request deletion of data we no longer need to keep;
  • object to or restrict certain processing and withdraw consent to marketing at any time.

10.Contact and complaints

Send requests to [email protected] or call +966 11 496 9240 ext. 2. We answer within 30 days. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11.Children

The Store is intended for adults. We do not knowingly collect data from anyone under 18.

12.Changes

We will post any changes to this policy on this page with a new date.