Privacy Policy

Who we are

BAFCO International Shipping & Logistics Co. Ltd (“BAFCO”, “we”, “us”) is a freight forwarding and logistics company registered in the Kingdom of Saudi Arabia, with its head office in Jeddah. This policy explains what we do with personal data collected through bafcointl.com and through the enquiries, quotations and shipments that follow from it.

For the personal data described here, BAFCO is the data controller — we decide why and how it is processed.

Legal name

BAFCO International Shipping & Logistics Co. Ltd

Registered address

Batarfi Building #3, Hamza Shata St., Bagdadia West, P.O. Box 16272, Jeddah 21464, Saudi Arabia

Email

inquiry@bafcointl.com

Telephone

+966 12 642 0333

The law that applies

BAFCO is established in Saudi Arabia and serves customers in the Kingdom and the wider GCC. Our processing is governed by the Saudi Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended by Royal Decree M/148 of 1444H) and its Implementing Regulations, which have been in full force since 14 September 2024. The supervisory authority is the Saudi Data & AI Authority (SDAIA).

We do not target the European market. If you are nevertheless visiting from the EU or the UK, see Visitors from the EU and UK below.

The personal data we collect

Data you give us

When you submit the quotation or enquiry form, we collect the details you type into it: your name, company, email address, telephone number, the origin and destination of your cargo, the mode of transport, the volume or weight, and any message you add.

If you contact us by email, telephone or WhatsApp, or apply for a role, we hold whatever you choose to send us — including a CV and its contents if you apply for a job.

Data collected automatically with the form

So that we can answer you in context and filter automated spam, the form also records the page you submitted it from, your browser's user-agent string, and the date and time.

Data collected as you browse

Our hosting provider records standard server and security logs, including IP addresses, to keep the site available and to block abuse. If — and only if — you accept analytics cookies, Google Analytics also records pages viewed, approximate region, device and referral source. Decline and none of that is collected.

Why we use it, and our legal basis

Saudi PDPL requires a documented legal basis for every purpose. Ours are:

Answering your enquiry and quoting

Steps taken at your request before entering into a contract. Without these details we cannot price a shipment.

Delivering the shipment

Performance of our contract with you, including passing consignee and shipper details to carriers, ports and customs.

Customs, tax and record-keeping

Compliance with legal obligations in Saudi Arabia — ZATCA customs and VAT records, and commercial books.

Security and preventing abuse

Our legitimate interests in keeping the site and your data safe.

Analytics

Your consent, given through the cookie banner and withdrawable at any time.

Recruitment

Steps taken at your request before a possible employment contract.

We do not sell personal data, and we do not use it to build advertising profiles.

Who we share it with

We share personal data only where it is needed to do the job you asked for, or where the law requires it. In practice that means:

• Carriers, shipping lines, airlines, hauliers, port and terminal operators and overseas agents involved in moving your cargo.
• Saudi Customs / ZATCA and other government authorities, where a shipment, tax or licensing requirement makes it mandatory.
• Google, which provides the form-handling, spreadsheet, email and analytics tools described in our Cookie Policy.
• Cloudflare, which hosts and protects this website.
• Our professional advisers, insurers and auditors, under confidentiality.

When you send the enquiry form, it is delivered to a Google Workspace inbox at BAFCO and recorded in a private Google Sheet that only authorised BAFCO staff can open.

Transfers outside Saudi Arabia

Freight is international by nature, so some data necessarily leaves the Kingdom: consignee and shipper details go to agents, carriers and customs authorities in the destination country, and our Google and Cloudflare tools process data on servers outside Saudi Arabia.

Article 29 of the PDPL permits these transfers where they are necessary to perform a contract to which the data subject is party, or to serve the Kingdom's interests, and where the transfer does not prejudice national security. We transfer only what the specific shipment or tool requires, and we place confidentiality terms on the parties who receive it.

How long we keep it

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

How we protect it

The site is served only over HTTPS. Enquiry data sits in Google Workspace and Google Sheets behind account controls, and access is limited to the BAFCO staff who need it to answer you. We review who holds access as people join and leave.

No transmission over the internet is ever completely secure. If a breach occurs that is likely to harm you or your data, PDPL requires us to notify SDAIA within 72 hours and to tell you where the risk to you is high — and we will.

Your rights

Article 4 of the PDPL gives you the following rights over your personal data:

To be informed

To know why we collect your data and what we do with it — which is what this policy is for.

To access

To ask whether we hold data about you and to see it.

To obtain a copy

To receive your data in a readable, transferable format.

To correct

To have data that is wrong, incomplete or out of date put right.

To destroy

To have data erased where we no longer need it, or where you withdraw the consent it rested on.

To withdraw consent

To turn off analytics at any time, without giving a reason and without losing any part of the site.

Some rights have limits. We cannot destroy a customs declaration or an invoice that Saudi law requires us to keep, and we cannot always act on a request that would compromise someone else's data or an active investigation. Where we refuse, we will tell you why.

How to exercise them, and how to complain

Write to us at inquiry@bafcointl.com, or by post to the address above, and tell us what you want us to do. We answer within 30 days. If a request is complex or you have sent several, we may take up to a further 30 days and will tell you if so. There is no charge.

We may need to confirm your identity first — that protects you, not us.

If you are not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA), the national supervisory authority, at sdaia.gov.sa. We would rather you came to us first so we can put it right.

Visitors from the EU and UK

BAFCO's services are directed at Saudi Arabia and the GCC. We do not market to the EU or the UK, we do not price in euros or pounds, and we do not monitor the behaviour of people there — so we do not consider ourselves established in, or targeting, those markets for GDPR or UK GDPR purposes.

If you are in the EU or UK and believe we hold data about you, the rights in this policy are available to you on the same terms regardless. Write to us and we will handle your request exactly as we would any other.

Children

This is a business-to-business site. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

Changes to this policy

If we change what we collect or why, we will update this page and move the effective date at the top. Where a change materially affects you, we will say so prominently rather than leave you to spot it.

Contact us