1. Parties and roles
Alpha Technical Services Limited Company, trading as AlphaFleet, commercial registration 2055139789, Opposite Malabar Gold, King Abdulaziz Road, P.O. Box 35514, Al Jubail, Saudi Arabia.
For workspace data processed on documented customer instructions, the customer is controller and the operator is processor under Saudi PDPL. Our own enquiry, billing and security processing is covered separately by the Privacy Policy. A signed order or processing schedule identifies the customer, services, categories, individuals affected and duration.
2. Subject matter
Hosting and processing of workspace data — vehicles, drivers, trips, telematics, and video where enabled — to provide the fleet-management service.
3. Instructions
We follow lawful, documented customer instructions. The customer establishes the lawful basis and provides required notices and consents; administrative acceptance is not consent on behalf of drivers. We inform the customer if an instruction appears to conflict with data-protection law and seek clarification before following it.
4. Confidentiality
Personnel with access to personal data are bound by confidentiality obligations.
5. Security measures
Workspace isolation, encryption in transit, role-based access control, audit logging, and multi-factor authentication for administrative access — as described in the Terms of Service.
6. Sub-processors
Providers are engaged only as necessary for agreed processing under appropriate confidentiality, security and data-protection terms. The signed processing schedule identifies authorised sub-processors and the notice and objection procedure for changes. Request current information at miraj@atslco.com. We remain responsible for our processor obligations; this clause does not authorise unrelated disclosures or unlawful transfers.
7. Data-subject requests
We promptly refer workspace rights requests to the customer and assist with access, readable copies, correction and destruction, proportionate identity verification, relevant assessments and regulatory requests. We do not disclose workspace records without appropriate authority.
8. Breach notification
We notify the customer without undue delay of a breach affecting its workspace and provide available incident details, affected data, consequences and response measures, supplemented as information becomes available. The controller remains responsible for required authority and individual notifications; we assist it. Contractual notice does not replace statutory duties.
9. Data residency
Core workspace data is hosted in Saudi Arabia. International transfers require compliance with Saudi transfer regulations, safeguards and required assessments; a written instruction alone is insufficient. The processing schedule must address recipients in enabled integrations and any permitted transfer.
10. Deletion and return
Telematics is retained for one year; other operational categories follow the agreed service schedule. Financial records are retained for at least six years, longer where law requires. Customers have three months after cancellation to request export of data still held at miraj@atslco.com. This does not restore expired records. After that period we delete or anonymise workspace data, except legally required records or a documented legal hold, restrict retained records to that purpose, and remove backup copies through backup rotation.
11. Audits
We make information reasonably needed to demonstrate compliance available subject to confidentiality and protection of other customers. Routine customer audits are available annually on reasonable notice at the customer’s cost. This does not prevent a legally required audit, regulator access or necessary incident cooperation.
12. Liability and governing law
Contractual liability follows the Terms of Service subject to mandatory Saudi law. Caps do not exclude duties or liability that cannot lawfully be limited, or bind regulators or non-parties. Saudi law governs. Contact miraj@atslco.com for a signed agreement and processing schedule.
Related documents