1. Who we are

Windmason Arabia (“Windmason,” “we,” “us,” or “our”) provides HVAC products, project solutions, and related business services in Saudi Arabia. For personal data collected through windmason.sa and our own enquiry channels, Windmason determines the purposes and means of processing that data.

2. Personal data we collect

Depending on how you interact with us, the data may include:

• Contact and business details: your name, job title, company, work email, phone number, city, and preferred contact method.
• Enquiry and project details: the messages, AHU or HVAC specifications, location, drawings, photographs, files, timing, and other information you choose to provide for an enquiry or quotation.
• Business records: correspondence, proposal and contract information, and invoicing details when relevant to a commercial relationship.
• Website information: IP address, browser and device details, pages visited, approximate location derived from technical data, security logs, and cookie information where these technologies are used.

We collect information directly when you complete a website or advertising lead form, call, email, message us, or provide project documents. We may receive your submitted details from platforms you use to contact us, such as Meta lead forms or WhatsApp. Limited technical information may be collected automatically when you use the website.

Please do not send identity documents, sensitive personal information, or payment card details through a general enquiry form unless we specifically request them through an appropriate channel.

3. Why we use your data and our legal bases

We use personal data for the stated purposes and will provide any further notice or obtain consent where required before using it for a materially different purpose.

4. Required and optional details

Fields marked as required in a form are needed to process that request, such as a way to contact you and enough information to understand the enquiry. Other fields are optional. If you do not provide the required details, we may be unable to respond or prepare a proposal. Extra project details may help us give a more useful response.

5. Cookies and third-party platforms

Our website may use cookies or similar technologies for essential functions, security, preferences, analytics, or advertising measurement, depending on the tools enabled on the site. Where consent is required for non-essential technologies, we will ask for it through the available website controls. You can also manage cookies through your browser. Disabling some cookies may affect site functions.

When you submit a form or message through Meta, WhatsApp, or another third-party platform, that platform also processes information under its own privacy terms. We receive the information you choose to send to Windmason through that channel.

6. Who may receive your data

We may share relevant data only as needed with authorised Windmason staff; contractors working on your project; providers that support website hosting, email, communications, customer records, analytics, security, or advertising lead delivery; professional advisers; and public authorities where disclosure is legally required. Service providers should process data for the agreed purpose and under appropriate protections. We do not sell personal data.

7. Processing outside Saudi Arabia

Some website, communication, or advertising service providers may process or store personal data outside the Kingdom of Saudi Arabia. Where that occurs, we assess the transfer and apply the requirements and safeguards of Saudi Arabia’s Personal Data Protection Law and its regulations. You may contact us for information about the relevant provider, location, and safeguards for your data.

8. How long we keep data and how we dispose of it

We keep enquiry data while the request is active and for a limited follow-up period appropriate to the business relationship. Contract, project, and invoicing records are kept for the periods needed to perform the agreement, comply with applicable law, and address legitimate claims. Website security records are kept for the period needed to investigate and prevent incidents. Where consent is the basis for promotional contact, we stop that use when you withdraw consent, subject to any separate lawful need to keep a record of the request.

When data is no longer needed, we delete it or make it anonymous using appropriate methods, unless a law requires or permits further retention. The exact period depends on the record type, the last interaction, applicable legal requirements, and whether a dispute or security matter is ongoing. You can ask us about the period that applies to a particular record.

9. How we protect data

We apply organisational and technical measures appropriate to the information and risks, including limiting access to authorised personnel and protecting the systems used to store and transmit information. If a personal-data incident occurs, we will take the actions and provide notifications required by applicable law.

10. Your rights

Subject to the Saudi Personal Data Protection Law and its regulations, you may:

• Be informed about the collection and use of your personal data.
• Request access to your data and a readable copy of it.
• Ask us to correct, complete, or update inaccurate data.
• Request destruction of data when it is no longer needed for its purpose, subject to lawful retention requirements.
• Withdraw consent where we rely on consent, without affecting earlier lawful processing.

To make a request, email [email protected] with “Privacy request” in the subject line. We may need to verify your identity before acting. We will respond without undue delay and within the time required by applicable regulations; where permitted, we will explain any extension or limitation.

11. Marketing choices

A request for a quote or technical discussion does not, by itself, require you to subscribe to unrelated promotional messages. Where you receive promotional messages from us, you may opt out using the method in the message or by emailing [email protected]. We may still send messages needed to respond to your enquiry or manage an existing agreement.

12. Contact and complaints

For a privacy question, rights request, or complaint, contact Windmason Arabia at [email protected], call +966 54 328 8265, or write to Ar Rabwah 2109, Riyadh 12821, Kingdom of Saudi Arabia. Please describe your concern so we can investigate and respond.

If you are dissatisfied with our response, you may submit a complaint to the competent personal-data protection authority in Saudi Arabia through the channels made available by the Saudi Data and Artificial Intelligence Authority (SDAIA).

13. Changes to this policy

We may update this policy when our services, data practices, or legal requirements change. The latest version and its update date will be displayed on this page. If a change materially affects how we use data, we will provide additional notice where required.