Privacy Policy

Yakan is a service for licensed motor vehicle dealers and traders in the Kingdom of Saudi Arabia. This policy explains what we do with personal information when you visit yakan.ai, contact us, or use the Yakan app.

1. Who we are

The service is provided by:

We decide what personal information is collected and why, so we are responsible for it under Saudi law.

In this policy, we and us mean Bidhra Alzaytun Company For Trading, and you means the person using the service.

We handle personal information in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations. The regulator is the Saudi Data and Artificial Intelligence Authority.

2. Who this policy is for

Yakan is a business tool for licensed dealers and traders. It is not for consumers and it is not for anyone under 18.

This policy covers four groups:

• Website visitors — anyone who visits yakan.ai or contacts us through it, whether or not they ever use the app.
• Dealers — you, if you use the app.
• Sellers — the person we buy a vehicle from. Sellers do not use the app; they receive a secure link from us and enter their details there.
• Buyers — the person who eventually buys a vehicle from a dealer. Buyers do not use the app; a dealer enters limited details about them so ownership can be transferred.

If you are a Seller or a Buyer, section 6 is written for you. If you have only visited our website, section 5 is the only part that applies to you.

3. The short version

This is a summary. The detail below is what counts.

If you only visit our website, see section 5 — it is short, and the rest of this policy does not apply to you.

What we collect. Who you are, confirmed through Nafath. Your mobile number. Details and photographs of vehicles. Your transactions and payments. Details of Sellers and Buyers. Basic technical information about your device.

Why. To confirm who you are, to price and check vehicles, to carry out our agreements with you, to transfer vehicle ownership, to take payments, to meet our legal obligations, and to keep the service secure and working.

Who else sees it. Government platforms such as Nafath and Absher. Our payment provider, messaging provider, e-signature provider, vehicle data providers, cloud provider and software partner. Regulators and law enforcement where the law requires. Section 9 names them.

Do we sell your information? No. We never sell personal information and we never share it for anyone else's advertising.

Where it is kept. On Google Cloud servers in Belgium, with safeguards described in section 10.

How long we keep it. While you have an account, and afterwards for as long as Saudi law requires — usually 10 years for identity and transaction records.

Do we track you? No. We do not collect your location and we do not track you across other apps or websites.

Your rights. To see your information, get a copy, correct it, and have it deleted where we are not required to keep it. Section 12.

Contact. [email protected]

4. What we collect

4.1 Confirming who you are

To open an account you verify your identity through Nafath, the Kingdom's national identity service. Nafath tells us:

• Your full name
• Your National ID or Iqama number
• Your date of birth
• Your nationality
• That the check succeeded, and when

Verification lasts 12 months, so we record the date and ask you to confirm again when it expires.

We do not ask you to photograph or upload your ID card, and we do not store pictures of identity documents. Nafath is more secure, and Saudi law restricts copying official identity documents.

We do not collect fingerprints, face scans or any other biometric information, and Nafath does not provide any to us.

4.2 Contacting you

• Your mobile number, which we confirm with a one-time code sent over WhatsApp
• Whether you prefer Arabic or English
• Anything you send us when you contact support, and our replies

4.3 Your business

• Your commercial registration or work document, and whether it is valid
• Your VAT registration number, if you have one
• The address of your premises
• The results of the checks in section 4.8

4.4 Vehicles and transactions

Most of this is about vehicles, not people. It becomes personal information where it connects to you or someone else, so we treat it that way.

• Vehicle identification numbers, typed in or photographed
• Photographs of vehicles, inside and out
• Mileage, specification and features
• Prices proposed, quoted and agreed
• The full history of each submission and transaction, including every status change and its date
• Vehicle inspection results
• Signed agreements and the record of who signed them and when

About photographs. A photo can contain more than the car — a number plate, a document on a seat, someone in the background, or hidden information about where and when it was taken. Please do not photograph people or documents. We remove hidden location information from photographs when they are uploaded, and we delete personal information we find in an image that we do not need.

4.5 Payments

Payments are handled by a licensed payment provider. You enter your card details directly into their secure system.

We never see or store your full card number, expiry date or security code. We receive:

• Whether the payment worked
• The amount, currency, date and time
• A reference number
• The card type and last four digits, so we can show you a receipt

Where money moves by bank transfer, we hold the bank account number (IBAN) and the account holder's name.

4.6 Location

We do not collect your location. The app does not ask for access to your device's location, and we do not fit tracking devices to vehicles.

4.7 Your device and how you use the app

Collected automatically:

• Device model, operating system, and app version
• A device identifier
• Your internet address, and the country it suggests you are in
• Language settings
• A notification token, if you turn notifications on
• Which screens you visit and what you do
• When you sign in, and for how long
• Error reports and crash logs
• Sign-in records, including failed attempts

We use this to run the service, fix problems, keep it secure, and understand what is working.

4.8 Information we get from elsewhere

We do not obtain credit reports about you, and we are not a member of any credit bureau.

5. If you visit our website

This section covers yakan.ai on its own. If you have not used the app, nothing else in this policy applies to you.

What we collect when you visit:

• Your internet address, and the country it suggests you are in
• Your browser and device type
• Which pages you view, and when
• The site you came from, if any

If you contact us through the website or by email, we collect your name, email address, phone number if you give it, the name of your business, and whatever you tell us. We use it to reply, and we keep it for 3 years after we last hear from you unless you become a customer, in which case section 11 applies instead.

Cookies. We use cookies and similar tools to make the site work and to understand how it is used. Cookies needed to make the site function are always on. Any cookie used to measure or analyse usage is set only if you agree, and you can change your mind at any time through your browser settings or our cookie controls.

We do not use the website to advertise to you, and we do not track you across other websites.

Our legal reason for this is our legitimate interest in running and improving our website and answering enquiries — except for optional cookies, where we rely on your consent.

6. Information about other people

When you use Yakan you give us information about people who are not you. Once we have it, we are responsible for it, and those people have rights against us.

6.1 Sellers

You give us the Seller's mobile number. We then contact the Seller ourselves. The Seller confirms their identity through Nafath and gives us, through a secure link and not through you:

• Confirmation of who they are
• Which vehicle they are selling
• The agreed price and the mileage
• The bank account to be paid into

This is deliberate. The Seller's identity and bank details come from the Seller, not from the dealer, and the dealer never sees them.

6.2 Buyers

When you sell a vehicle you enter:

• The Buyer's National ID or Iqama number
• The Buyer's date of birth
• The agreed price and the mileage

We need this to transfer ownership through Absher and Tam and to meet our obligations against money laundering. The payment itself happens outside the app.

6.3 What we each have to do

If you give us someone else's information, you are confirming that you are allowed to, that you have told them, and that you have pointed them to this policy. Do not enter someone's details without their knowledge.

For our part, where we get information about a Seller or Buyer from someone else, we tell that person, as Saudi law requires.

Sellers and Buyers have the same rights as dealers under section 12, and can contact us at section 17.

7. Why we are allowed to do this

Saudi law requires a proper reason for each thing we do. Ours are:

Where we rely on our legitimate interest, we have weighed it against your rights and concluded it does not harm them. You can ask us to explain.

Where we rely on your consent, you can withdraw it at any time and we will stop. Withdrawing does not undo what we did beforehand, and stopping marketing will not affect your account. You cannot withdraw consent to things the law requires us to do.

8. Automated decisions

Software does two things here worth knowing about.

Estimates. When you submit a vehicle, the app produces an estimated price range automatically. It is clearly labelled as an estimate, it is not an offer, and it does not commit us to anything.

Checks. Automated checks and models help our team assess vehicles and counterparties — screening results, consistency checks, risk flags.

No decision that affects you is made by software alone. Every approval, rejection, price and escalation is made by a person who can take account of anything you tell them. If you disagree with a decision, contact us and a person will look at it again.

We use third-party artificial intelligence services to run parts of the service. They work only on our instructions and are not permitted to use your information to train their own systems.

9. Who else sees your information

Only where we need them to. We do not sell personal information and we do not share it for anyone else's advertising.

9.1 Government and regulators

Where we report a suspicious transaction, the law forbids us from telling you.

9.2 Companies that work for us

Each company below handles information on our instructions only. Each is under a written agreement to use it only as we say, keep it secure and confidential, help us with your requests, and delete or return it when we stop working together. We check that each protects your information to the standard we are required to meet.

We use the following kinds of company:

• Identity verification providers, who connect us to Nafath — based in Saudi Arabia
• Vehicle transfer providers, who connect us to Absher and Tamm — based in Saudi Arabia
• Payment providers, licensed in Saudi Arabia, who process payments
• Vehicle inspection providers — based in Saudi Arabia
• Insurance providers — based in Saudi Arabia
• Electronic signature providers, who handle the signing of agreements
• Messaging providers, who send WhatsApp messages and one-time codes
• Vehicle data providers, who identify and value vehicles
• Google Cloud, which hosts our systems and stores our data — Belgium
• Our software partner, who builds and supports our software
• CRM software, which holds our record of customer relationships
• Analytics providers, who give us error reports and usage statistics

You can ask us at any time for the names of the companies we currently use and where they are based. Email [email protected].

9.3 Others

• Our advisers — lawyers, auditors, accountants and insurers, all bound to confidentiality
• Our parent company, where needed for group governance, audit and financial reporting
• A buyer or investor, if our business is sold, merged or restructured, under confidentiality
• Sellers and Buyers, only as far as a transaction requires

10. Information leaving Saudi Arabia

Our systems run on Google Cloud servers in Belgium, and some of the companies in section 9.2 are outside the Kingdom. So some information about you is handled outside Saudi Arabia.

Saudi law allows this where it is necessary to carry out our agreement with you, where it does not harm the Kingdom's interests, and where proper safeguards are in place. Before information goes anywhere outside the Kingdom we:

• Check what protection the receiving company offers and record our assessment
• Put a written agreement in place holding them to a standard equivalent to Saudi law
• Review that assessment regularly

You can ask us what protections apply to any transfer — section 17.

Information currently goes to: Belgium, and the countries listed in section 9.2.

11. How long we keep things

We keep information as long as we need it, and no longer. Mostly the law decides, not us.

When the time is up we destroy the information, or strip out everything that identifies anyone. Information that can no longer identify anyone may be kept and used for analysis.

12. Your rights

Under Saudi law you can:

• Know what we are doing — why we collect your information, whether you have to give it, what happens if you do not, and who sees it. That is what this policy is for.
• See your information — ask whether we hold it and get access.
• Get a copy — in a clear, readable form.
• Correct it — if it is wrong, incomplete or out of date. Note that anything confirmed through Nafath comes from the national identity system, so changes have to be made there first and reach us when you next verify.
• Have it deleted — where we no longer need it. This is not absolute; section 13 explains.
• Withdraw consent — where we relied on it.
• Complain — to us, and to the regulator.

How. Email [email protected], or use Support in the app. Tell us what you want and enough for us to find your records.

We will check who you are first, so we do not hand your information to someone else. We will reply within 30 days. If it is complicated we may need longer, and we will tell you why.

It is free. If a request is excessive or repeated we may charge a reasonable fee or decline, and we will explain.

If we cannot do what you have asked, we will tell you why and what you can do about it.

If you are not happy. Reply to us and say so. You can also complain to the Saudi Data and Artificial Intelligence Authority at sdaia.gov.sa. You do not have to come to us first.

13. Closing your account

You can delete your account in the app, under Profile then Settings, or at yakan.ai/delete-account.

What deletion actually means. Saudi law requires us to keep certain records, so:

Deleted or made anonymous straight away:

• Your profile and preferences
• Marketing consents
• Support messages not connected to a transaction
• Usage statistics, disconnected from you
• Draft submissions with no transaction attached
• Your access to the service

Kept, because the law requires it:

• Identity records — 10 years
• Transactions, agreements and payments — 10 years
• Anything connected to a suspicious transaction report — 10 years
• Accounting and tax records — as tax law requires
• Anything involved in a legal claim, investigation or regulatory request, until it ends
• Information about a Seller or Buyer, where our duty is to them rather than to you

Anything we keep is moved to restricted storage, seen only by staff who need it for that legal purpose, and never used to run the service, for analysis or for marketing. It is destroyed when the time is up.

If you have an open transaction you cannot close your account until it finishes. We will tell you what is outstanding.

14. Keeping information safe

We take organisational and technical steps to protect your information:

• Encryption when information travels and when it is stored
• Two-factor sign-in for staff, and access limited to what each role needs
• Access to live data logged and reviewed
• National ID, Iqama, bank account and card numbers are masked in the app, in our internal tools and in our logs — never shown or recorded in full
• Card details handled entirely by our payment provider, never reaching our systems
• Secure development practices, code review and security testing
• Backups, tested regularly
• Staff vetting, training and confidentiality obligations
• Written security requirements on every company that works for us

No system is perfectly safe. If something goes wrong we will tell the regulator within 72 hours, and we will tell you promptly if it is likely to cause you serious harm.

15. Children

Yakan is a business tool for licensed dealers. It is not for children and we do not knowingly collect information from anyone under 18. If we find that we have, we delete it. If you think a child has given us information, tell us — section 17.

16. Changes

We may update this policy. If something important changes — a new purpose, a new type of information, a new company seeing it, or a change in where it is stored — we will tell you before it takes effect, in the app and by message, and we will ask your permission where the law requires.

Every version is dated, and previous versions are available on request.

17. Contact us