Who we are
BAFCO International Shipping & Logistics Co. Ltd (“BAFCO”, “we”, “us”) is a freight forwarding and logistics company registered in the Kingdom of Saudi Arabia, with its head office in Jeddah. This policy explains what we do with personal data collected through bafcointl.com and through the enquiries, quotations and shipments that follow from it.
For the personal data described here, BAFCO is the data controller — we decide why and how it is processed.
- Legal name
- BAFCO International Shipping & Logistics Co. Ltd
- Registered address
- Batarfi Building #3, Hamza Shata St., Bagdadia West, P.O. Box 16272, Jeddah 21464, Saudi Arabia
- inquiry@bafcointl.com
- Telephone
- +966 12 642 0333
The law that applies
BAFCO is established in Saudi Arabia and serves customers in the Kingdom and the wider GCC. Our processing is governed by the Saudi Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended by Royal Decree M/148 of 1444H) and its Implementing Regulations, which have been in full force since 14 September 2024. The supervisory authority is the Saudi Data & AI Authority (SDAIA).
We do not target the European market. If you are nevertheless visiting from the EU or the UK, see Visitors from the EU and UK below.
The personal data we collect
Data you give us
When you submit the quotation or enquiry form, we collect the details you type into it: your name, company, email address, telephone number, the origin and destination of your cargo, the mode of transport, the volume or weight, and any message you add.
If you contact us by email, telephone or WhatsApp, or apply for a role, we hold whatever you choose to send us — including a CV and its contents if you apply for a job.
Data collected automatically with the form
So that we can answer you in context and filter automated spam, the form also records the page you submitted it from, your browser's user-agent string, and the date and time.
Data collected as you browse
Our hosting provider records standard server and security logs, including IP addresses, to keep the site available and to block abuse. If — and only if — you accept analytics cookies, Google Analytics also records pages viewed, approximate region, device and referral source. Decline and none of that is collected.
We do not ask for, and ask that you do not send us, sensitive personal data — health, religious or political information, or credit-card numbers — through the website form.
The BTD Driver App
Separately from this website, BAFCO operates the BTD Driver App — a mobile application used by BAFCO drivers and by third-party and contractor drivers who run trips on BAFCO's behalf. This section explains what the app collects and why. It applies only to people who use the app; if you have only visited this website, it does not concern you.
Location
The app collects precise and approximate location to show the driver's position on the map and to guide them along the assigned route.
The app also collects location in the background — while the app is closed or not in active use — so that an active trip keeps being tracked until the driver marks it complete. Background location is collected only during an active trip, and never at any other time.
Trip and route data
Trip and route details — pickup and drop-off points, distance and timestamps — are shared with BAFCO's dispatch team so they can coordinate the trip.
Camera
The app uses camera access to capture trip-related documents and photos when the driver is asked to provide them.
How this data is used
Location, trip and camera data from the app is used only for trip tracking and dispatch coordination. It is not sold, and it is not shared with third parties for advertising.
Deleting your account data
Drivers can ask us to delete their account data at any time by contacting it@bafcointl.com or +966 12 642 0333. We handle these requests as described in Your rights and How to exercise them above, subject to the retention periods in How long we keep it.
The BAFCO Customer Portal and Mobile App
Separately from this website, BAFCO operates the BAFCO Customer Portal — a web portal and a mobile application (Android) used by BAFCO's customers, and by the staff and authorised users working on their accounts, to follow shipments, view documents, request and review quotations and rates, and download reports. This section explains what the portal and the app collect and why. It applies only to people who log in to the portal or the app; if you have only visited this website, it does not concern you.
Account and login
To sign in we collect your email address and password (the password is stored only in protected form), and we keep an identifier for the device you sign in from. We link your login to your customer account so you only see your own company's data. To protect accounts, we record failed sign-in attempts, may temporarily lock an account after repeated failures, and show a security check (captcha) on sign-in where it is required. After you sign in, a secure session token is kept on your device so you stay signed in until you log out or the session expires.
Shipment, quotation and rate data
The portal shows shipment details held by BAFCO for your company — for example job and booking numbers, bill of lading and customer reference numbers, origin and destination ports, vessel and voyage, container details, status and dates, and charges. If you request a quotation or submit a rate enquiry, the details you enter (such as route, cargo type, volume and contact details) are sent to BAFCO's sales and operations teams so they can reply. Rate and quotation information is shown to you only for your own company.
Documents
You can view and download shipping documents that BAFCO has made available to your account. Which document types you can see is controlled by BAFCO for each customer. Where the portal lets you upload a document, the file you upload is stored with the related shipment and is visible to you and to BAFCO's staff handling that shipment.
Reports and downloads
When you export a report or shipment list (for example to Excel or PDF), the file is generated from the data you are allowed to see and is saved to your device.
Notifications
The mobile app may ask for permission to send notifications. If you allow it, notifications are used only to tell you about activity on your account, such as shipment or quotation updates. You can turn this off at any time in your phone's settings.
Location and camera
The portal and the mobile app do not collect your location, and they do not use your camera, microphone or contacts.
Preferences and device information
The portal and the app store simple preferences on your device, such as light or dark theme and your last-used filters, so they look and behave the way you left them. We also receive basic technical information when you connect — such as device type, app version, IP address and the time of access — to keep the service secure and to find and fix faults.
Who can see your data
Your company's data is visible to you, to the other authorised users of your company account, and to BAFCO staff who handle your shipments, quotations and account. Some quotation information is processed in BAFCO's sales system. We use service providers to host and run the portal and to store documents; they act only on our instructions.
How this data is used
Account, shipment, quotation and document data is used only to provide the portal and the app, to serve your shipments and requests, to keep accounts secure, and to support you. It is not sold, and it is not shared with third parties for advertising.
Deleting your account data
You can ask us to delete your account data at any time by contacting it@bafcointl.com or +966 12 642 0333. We handle these requests as described in Your rights and How to exercise them below, subject to the retention periods in How long we keep it. Shipment, shipping-document and invoice records that BAFCO must keep for legal, customs, tax or accounting reasons are not deleted before those periods end.
Why we use it, and our legal basis
Saudi PDPL requires a documented legal basis for every purpose. Ours are:
- Answering your enquiry and quoting
- Steps taken at your request before entering into a contract. Without these details we cannot price a shipment.
- Delivering the shipment
- Performance of our contract with you, including passing consignee and shipper details to carriers, ports and customs.
- Customs, tax and record-keeping
- Compliance with legal obligations in Saudi Arabia — ZATCA customs and VAT records, and commercial books.
- Security and preventing abuse
- Our legitimate interests in keeping the site and your data safe.
- Analytics
- Your consent, given through the cookie banner and withdrawable at any time.
- Recruitment
- Steps taken at your request before a possible employment contract.
We do not sell personal data, and we do not use it to build advertising profiles.
Transfers outside Saudi Arabia
Freight is international by nature, so some data necessarily leaves the Kingdom: consignee and shipper details go to agents, carriers and customs authorities in the destination country, and our Google and Cloudflare tools process data on servers outside Saudi Arabia.
Article 29 of the PDPL permits these transfers where they are necessary to perform a contract to which the data subject is party, or to serve the Kingdom's interests, and where the transfer does not prejudice national security. We transfer only what the specific shipment or tool requires, and we place confidentiality terms on the parties who receive it.
How long we keep it
| What | How long | Why |
|---|---|---|
| Enquiry and quotation records | 24 months after our last contact with you | Freight buying is cyclical; an enquiry often revives a season later. |
| Shipment, customs and accounting records | At least 6 years | Saudi commercial, customs and VAT record-keeping obligations. |
| Job applications | 12 months after the decision, unless you ask us to keep them on file | So we can consider you for a later opening. |
| Analytics data | 14 months | Google Analytics retention setting; only ever collected with consent. |
| Server and security logs | Up to 30 days | Abuse investigation and availability. |
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
How we protect it
The site is served only over HTTPS. Enquiry data sits in Google Workspace and Google Sheets behind account controls, and access is limited to the BAFCO staff who need it to answer you. We review who holds access as people join and leave.
No transmission over the internet is ever completely secure. If a breach occurs that is likely to harm you or your data, PDPL requires us to notify SDAIA within 72 hours and to tell you where the risk to you is high — and we will.
Your rights
Article 4 of the PDPL gives you the following rights over your personal data:
- To be informed
- To know why we collect your data and what we do with it — which is what this policy is for.
- To access
- To ask whether we hold data about you and to see it.
- To obtain a copy
- To receive your data in a readable, transferable format.
- To correct
- To have data that is wrong, incomplete or out of date put right.
- To destroy
- To have data erased where we no longer need it, or where you withdraw the consent it rested on.
- To withdraw consent
- To turn off analytics at any time, without giving a reason and without losing any part of the site.
Some rights have limits. We cannot destroy a customs declaration or an invoice that Saudi law requires us to keep, and we cannot always act on a request that would compromise someone else's data or an active investigation. Where we refuse, we will tell you why.
How to exercise them, and how to complain
Write to us at inquiry@bafcointl.com, or by post to the address above, and tell us what you want us to do. We answer within 30 days. If a request is complex or you have sent several, we may take up to a further 30 days and will tell you if so. There is no charge.
We may need to confirm your identity first — that protects you, not us.
If you are not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA), the national supervisory authority, at sdaia.gov.sa. We would rather you came to us first so we can put it right.
Visitors from the EU and UK
BAFCO's services are directed at Saudi Arabia and the GCC. We do not market to the EU or the UK, we do not price in euros or pounds, and we do not monitor the behaviour of people there — so we do not consider ourselves established in, or targeting, those markets for GDPR or UK GDPR purposes.
If you are in the EU or UK and believe we hold data about you, the rights in this policy are available to you on the same terms regardless. Write to us and we will handle your request exactly as we would any other.
Children
This is a business-to-business site. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.
Changes to this policy
If we change what we collect or why, we will update this page and move the effective date at the top. Where a change materially affects you, we will say so prominently rather than leave you to spot it.
Contact us
Questions about your data
Email inquiry@bafcointl.com or call +966 12 642 0333. Post: BAFCO International Shipping & Logistics Co. Ltd, Batarfi Building #3, Hamza Shata St., Bagdadia West, P.O. Box 16272, Jeddah 21464, Saudi Arabia.
