Privacy policy

1. Who we are

Qniya Cars is an online platform that connects people who want to buy a luxury car in the Kingdom of Saudi Arabia with sellers: dealers, private owners and exporters. This policy explains how we collect and use personal data under the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its implementing regulations.

2. What we collect

Account data: your mobile number, which we verify with a one-time code, plus your display name and preferred language.

Requests: the text you write describing the car you want, the structured details we extract from it (make, model, budget, city and similar), and any photo you choose to upload.

Seller data: business name, commercial registration number, city, WhatsApp number, brands, and the offers you submit, including price, VIN, odometer reading, accident history and photos.

A private seller who asks for the verified badge sends one picture of an ID: seen only by us, kept in a private store, deleted when we decide and in any case 30 days after it was sent; nothing else of the ID is stored.

Deal records: the agreed price, the commission, the date and technical details recorded when the seller accepts the commission terms, completion confirmations, invoices and payment status. We never see or store payment card numbers; payments are processed by our payment provider.

Administrative records: an audit log of actions taken by our staff on the platform.

3. Why we use it

To run the marketplace: verify your phone, review requests, match them with suitable sellers, keep offers sealed until the window closes, rank offers and let you accept one.

To send you notifications about your requests, offers, deals and invoices, mainly on WhatsApp.

To issue and collect the brokerage commission, to prevent fraud and abuse, to resolve disputes and to comply with the law.

To measure and improve the service using aggregate figures.

4. Who we share it with

Sellers see the details of a request that matches them (the car, the budget, the city and your notes, with any contact details removed). They do not see your name, your phone number, your raw text or your photo. Dealers and importers can offer you cars for your request, and you see each car with its price. A seller's number is shown to you when you choose to call or message the seller, and the seller gets your number only through that call or message; we tell the seller that a buyer asked for the number, never who.

Request details are shared with importers who bring cars from Korea and the UAE (they may be outside the Kingdom), only if you ask for importers' offers when you send a request from the import screen. This is never done for you. These importers see the full request details, including the car, budget, city and your notes, but not your name or phone number, unless you call or message them.

Service providers process data on our behalf: our hosting and database provider, our web hosting provider, Meta (WhatsApp messaging), Taqnyat (sending the sign-in code by SMS), Cloudflare (network security and delivery of the website), our payment provider Moyasar, the commercial registration lookup service Wathq, and an AI provider that reads your request text and photo so we can turn them into a structured request.

We disclose data to authorities when the law requires it.

5. Where the data is stored

Our database and files are hosted in the European Union (Frankfurt, Germany). Transfers of personal data outside the Kingdom are made in line with the PDPL and its transfer regulations, relying on the standard contractual clauses issued by the Saudi Data and AI Authority (SDAIA).

6. How long we keep it

The raw text of a request and any photo you uploaded are permanently deleted 30 days after the request is completed, cancelled or rejected.

The Korea import calculator has been removed. The mobile numbers left on it earlier (with the figures entered and a one-way hash of the network address, never the address itself) are deleted 180 days after they were left.

The structured request details, offers, deal records and invoices are kept for as long as the law requires and as needed to establish, exercise or defend claims, including the commission.

7. Your rights

You may ask to access your personal data, obtain a copy, correct it, complete it, withdraw a consent you gave, or ask us to delete it, subject to the retention we are required to keep by law.

To exercise a right, contact us on: the phone number on the Qniya Cars WhatsApp Business profile. We reply within the period the law sets. You may also complain to the Saudi Data and AI Authority (SDAIA).

8. Security and breaches

We protect data with encrypted connections, per-user access rules in the database, restricted staff access and an audit log.

If a personal data breach could harm you, we will notify SDAIA and the people affected without undue delay and within the deadlines set by the PDPL, and tell you what happened and what to do.

9. Changes

We may update this policy. The date at the top shows the latest version, and we will tell you about material changes.