1. Operator and scope
Alpha Technical Services Limited Company, trading as AlphaFleet, commercial registration 2055139789, Opposite Malabar Gold, King Abdulaziz Road, P.O. Box 35514, Al Jubail, Saudi Arabia.
We are the controller of website enquiries, account administration, billing and service-security data. For workspace personal data processed solely on a customer’s instructions, the customer is controller and we are processor under the Data Processing Agreement.
2. Information we collect
Enquiries: name, company, work email, phone, city, industry, fleet-size range, message and the consent record. Required fields are marked. Without required contact details and enquiry consent, we cannot handle a request through the form; you may contact us directly instead. With an enquiry we also record how you first reached this website in that browser session: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring website (its domain only) and the first page you opened.
Service data: account details, roles, and customer-provided vehicle, driver, trip, maintenance, financial and document records; location and telematics; and video only where enabled. Customers must inform affected individuals and establish a lawful basis.
Technical data includes browser, device and network information and security logs. Form protection can receive device/network signals. Do not submit unnecessary identity documents, payment-card details or sensitive personal data in an enquiry.
3. Purposes and lawful bases
Enquiry handling and demo arrangements rely on your specific enquiry consent. This does not authorise advertising, optional tracking or a paid subscription.
Service delivery and support rely on an applicable prior agreement or another basis permitted by Saudi PDPL. Billing and required disclosures rely on legal obligations. Security processing may rely on legitimate interests where permitted, after assessing necessity and individuals’ rights; this basis is not used for sensitive data. A new purpose requires an appropriate basis and any legally required consent.
4. Cookies and external features
Browser storage supports language, display preferences and authentication where applicable. We currently do not use advertising trackers. Form protection and embedded video may connect to external services; see the Cookie Policy. Enquiry consent is separate from any consent required for an optional feature. Session storage keeps your first-visit origin only until you close the tab, and it is sent only with an enquiry you submit.
5. Recipients and disclosure
We do not sell personal data. Access is limited to authorised personnel and providers needed for hosting, communications, support and security, under appropriate confidentiality and data-protection arrangements.
Enabled government, invoicing or vehicle-service integrations may send necessary records to the relevant service or authority on documented customer instructions and a lawful basis. We may also disclose data when Saudi law requires. Customers must provide notices appropriate to their enabled workflows.
6. Hosting and transfers
Core service data is hosted in the Kingdom of Saudi Arabia. Our business email, messaging and support operations are based in Saudi Arabia. External website features, including form protection and embedded video, may process technical data through international providers. Transfers subject to PDPL must meet the applicable transfer rules, safeguards and required assessments; an agreement or consent alone does not replace these requirements.
7. Retention and cancellation
Enquiries are retained for up to 12 months after last contact, then deleted or anonymised unless an identified legal obligation or dispute requires limited continued retention. Records needed for a resulting customer relationship follow the relevant service or statutory period.
Telematics is retained for one year. Video and other operational categories follow the periods specified for the enabled service. Financial records are retained for at least six years, and longer where applicable law requires, including relevant tax and capital-asset records. Statutory periods are measured from the event or period required by the applicable rule.
After cancellation, customers have three months to request export of records still held at miraj@atslco.com. This does not extend expired records or renew the service. After that period, workspace data is deleted or anonymised except records required by law or a documented legal hold. Retained records are restricted to that purpose. Backup copies are removed through backup rotation, not retained for routine use indefinitely.
8. Your rights
Subject to PDPL’s conditions and exceptions, you may request information about processing, access and a readable copy of your personal data, correction or updating, and destruction when it is no longer needed. Withdraw consent at miraj@atslco.com; withdrawal does not affect earlier lawful processing or a separate lawful basis.
We assess requests without undue delay and within 30 days. Where the implementing regulations permit an extension, we explain the reason and notify you of an additional period of no more than 30 days. We may request proportionate identity verification. For customer-controlled workspace records, contact your employer or fleet operator; we assist it as processor. You may complain to the competent authority, including SDAIA through its Personal Data Protection platform.
9. Security and incidents
We use access restrictions, workspace separation, encryption in transit and security logging. No online system guarantees absolute security. We notify the competent authority and affected individuals where Saudi law requires. For a breach affecting customer-controlled workspace data, we notify the customer without undue delay and assist its response.
10. Contact and updates
Privacy requests: miraj@atslco.com. Support and export: miraj@atslco.com. Telephone: +966596657825. You may write to the operator at the address in section 1.
Updates carry a version and effective date. We notify affected users of material changes where required and seek renewed consent where a change of purpose requires it. Updating this policy does not itself create consent to unrelated processing.