How we handle your data
This notice explains how the Veltrixair Industries BU collects, uses, keeps and shares personal data. It follows the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and guidance from the Saudi Data and AI Authority (SDAIA). Veltrixair Industries also runs a separate Data Privacy Advisory practice, and we hold ourselves to the same standards we advise our clients to follow. We wrote this notice to be read, not buried in legal qualifications.
Who we are
Veltrixair Industries is a Riyadh-headquartered company with three business lines. This notice covers the Industries line — crane installation, dismantling, modernisation, parts, inspections and 24/7 emergency response across Saudi Arabia. Our IT Products & Services and Data Privacy Advisory lines have their own separate notices.
Under Saudi data protection law, Veltrixair Industries (based in Riyadh) is the Data Controller for the Industries business line — meaning we decide why and how personal data is processed. Tarique Ahmad, our VP of Data Protection, is accountable for privacy matters and acts as our Data Protection Officer.
What data we collect
We only collect personal data when it's needed to deliver our crane services, meet regulatory requirements, or run the business properly. Every category of data we handle is listed below — there's nothing outside this list.
We don't normally handle sensitive personal data — health, biometric, racial, religious or political information — for clients or enquirers. The exception is workforce health data used for safety incidents or medical insurance, which we only handle with explicit consent and extra protection.
Why we collect it
We process personal data for six specific reasons, each with a documented legal basis. Data collected for one purpose never quietly gets reused for another — that's built into how we handle data.
- Service delivery. To respond to enquiries, prepare quotes, schedule site visits, deliver engagements, manage AMC contracts, and fulfil our contractual obligations to clients.
- Regulatory conformity. To meet SASO inspection certificate retention obligations, ZATCA invoicing requirements, HCIS site access protocols, Saudi Labour Law workforce records, and PDPL itself.
- Recruitment. To assess applications submitted via the Careers page, route to the appropriate hiring lead, and maintain a candidate pipeline for forecast openings.
- HSE & quality. To manage permit-to-work records, post-incident inspections, near-miss reporting, and the operational discipline that prevents safety events.
- Communication. To send transactional engagement updates (quote confirmations, visit coordination, invoice notifications) and — only with separate consent — the quarterly newsletter.
- Legitimate business operations. Internal financial controls, vendor management, audit, defence of legal claims, and the standard operations of running an industrial services enterprise.
How we use it
Data submitted through the Quote and Site Visit forms goes automatically to the right engineering lead, based on service line and site city. The reference number you get at submission (VTX-RFQ, VTX-VST, VTX-HR) follows your data through the whole engagement. We never add third-party data to what you submit. We never profile enquirers. We never sell or rent personal data, under any circumstance.
For our workforce, we only process what's needed for employment and Saudi Labour Law — things like Iqama renewals, training records, payroll, and end-of-service payments. We never use this data for marketing or profiling.
Photos and videos taken during site visits are only for technical purposes — recording an asset's condition, documenting a fault, or supporting a report. They're stored securely with time-stamps and access logs. If a person happens to appear in the shot, we blur out identifying details before using it externally.
Lawful basis under PDPL Article 5
Saudi data protection law sets out the legal grounds a company can rely on to process personal data. We rely on five of them, each tied to a specific activity.
- Consent. For the quarterly newsletter (separate, granular, withdrawable), and for marketing communications. Never the basis for engagement-critical processing.
- Contractual necessity. For quote preparation, AMC delivery, site visit coordination, engagement records, invoicing — the processing without which the service cannot be delivered.
- Legal obligation. For ZATCA records, SASO inspection certificate retention, Saudi Labour Law payroll records, HCIS site access logs, and statutory employment documentation.
- Legitimate interests. For internal audit, fraud prevention, defence of legal claims, and the operational discipline of running a safety-critical industrial services BU. Balancing test documented per PDPL.
- Vital interests. For HSE incident response, where processing of health data may be necessary to protect life — the rare basis, applied narrowly.
How long we keep it
We only keep personal data as long as we actually need it, plus any legal minimum that applies. The table below shows exactly how long. After that, the data is deleted or anonymised through a documented process.
Who we share with
We don't sell personal data. We only share it when necessary, and only with parties who are legally bound to keep it confidential and handle it properly.
- OEM partners. Demag, Konecranes, Stahl and other authorised channels — for parts ordering, technical support, warranty claims, and OEM-credentialed training enrolment.
- Sub-contractors and specialist vendors. Civil works contractors, NDT specialists, transport vendors — bound by data processing agreements where personal data is exchanged.
- Regulatory bodies. SASO, ZATCA, SDAIA, HCIS, Civil Defence, Ministry of Human Resources — where required by law or formal regulatory request.
- Professional advisors. External legal counsel, auditors, insurers — under professional confidentiality and engaged for specific defined purposes.
- Banking and payment processors. For SAR-denominated transactions and WPS-compliant payroll, under standard banking confidentiality.
- Cloud infrastructure. Tier-1 cloud providers operating SDAIA-aligned KSA-region data centres where available; where not available, transfers governed under Section 08 below.
We never share personal data with outside marketing platforms, data brokers, ad networks, or anyone looking to build a profile on you for commercial use. We don't run any ad-funded parts of this business.
Cross-border transfers under PDPL Article 29
We prefer to keep data inside Saudi Arabia. When it has to leave — say, through cloud systems or international vendors — that transfer has to meet specific legal conditions under Saudi law, like regulator-approved safeguards, your explicit consent, or contractual necessity.
Every transfer outside the Kingdom is documented — which country it's going to, the legal basis for it, the safeguards in place (like encryption and access controls), and whether regulators need to be notified.
For India-based Veltrixair Industries operations supporting the Industries BU (back-office, design support, IT services), transfers are governed by both PDPL Article 29 and the India Digital Personal Data Protection Act 2023. The bilateral framework is documented and regularly reviewed.
Your rights under PDPL Article 4
Saudi law gives you eight specific rights over your own personal data. They're listed below, along with how to use them. We respond to every request within 30 days of confirming your identity, and it's free unless the request is clearly unreasonable or excessive.
Right to be informed
To know that we hold personal data about you, the purposes for which it is processed, and the lawful basis. This notice is the primary instrument of that right.
Right of access
To obtain a copy of the personal data we hold about you, in a structured and intelligible format.
Right to correction
To request correction of inaccurate or incomplete personal data, with confirmation once corrected.
Right to erasure
To request deletion where the lawful basis no longer applies, subject to retention obligations under Saudi law.
Right to restriction
To request limited processing while a correction or objection is being assessed, or where lawfulness is contested.
Right to object
To object to processing based on legitimate interests, and to direct marketing — including the newsletter — at any time.
Right to portability
Where processing is based on consent or contract and is automated, to receive personal data in a transferable format.
Right to withdraw consent
Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect prior lawful processing.
To use any of these rights, just email privacy@veltrixair.com with a short description of what you need and proof of identity. We'll acknowledge it within 5 working days and give you a full response within 30. If we can't fulfil a request — for example, because we're legally required to keep the data — we'll explain exactly why.
Cookies & tracking
Our website deliberately uses very few cookies. We don't use advertising cookies, tracking pixels, or anything built for retargeting ads. What we do use falls into two categories.
- Strictly necessary. Cookies required for the site to function — form submission state, language preference, accessibility settings. These are set without consent under PDPL because the site cannot operate without them.
- Analytics (consent-based). Pseudonymised analytics that record page visits and referrer source in aggregate. Set only with explicit consent. Withdrawing consent removes the cookie immediately and prevents future setting.
We don't use Google Analytics, Meta Pixel, LinkedIn Insight Tag, or any similar ad-tracking tool. That's a deliberate choice — we don't run paid ads, so we have no use for the kind of data those tools collect.
Contact & complaints
For anything privacy-related — using a right, raising a concern, reporting a breach, or just asking a question — start here. Our VP of Data Protection personally reviews privacy correspondence.
Privacy contact channel
Riyadh, Kingdom of Saudi Arabia
We will never retaliate against anyone for exercising their privacy rights. Whatever your relationship with us — client, employee, or someone just enquiring — submitting a privacy request won't affect it. We see these rights as a normal part of how we work, not a complaint to manage.
This notice is reviewed annually and on material change to processing activities. Material changes are communicated to known data subjects (workforce, AMC clients, active candidates) via email; web visitors are notified via a banner at the top of the page for 30 days. The version reference at the top of this document — VTX-PRIV-CRN-001 — is incremented on every revision.