Privacy Policy

1. Who We Are

Goava, a limited liability company established in the Kingdom of Saudi Arabia under Commercial Registration No. 7050316699 (referred to below as "Goava", "we", or "us"), is the data controller responsible for the personal data described in this Privacy Policy.

We process personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations.

2. Scope of This Policy

This Privacy Policy applies only to the goava.sa website and to the data we collect through it.

The processing of customer data within the Goava platform — including any data our customers catalog or manage using our product — is governed by separate agreements with those customers and is not covered by this Policy.

3. What We Collect and Why

We collect only the data listed below, each for the purpose stated:

(a) Demo and contact requests: name, work email, organization, phone number, role, organization type, area of interest, and your message, together with the language of the form, the page from which it was submitted, the date of your request, the record of your consent, and the business correspondence we exchange with you about your request — used solely to respond to your request and to follow up on it. We manage these requests in our customer relationship management system, Bigin by Zoho CRM, described in section 7.

(b) Newsletter: your email address — collected only with your prior opt-in consent, and used to send you the newsletter you subscribed to.

(c) Anonymous, cookieless website analytics: we use a self-hosted instance of Umami analytics. It sets no cookies, uses no identifiers that persist from one day to the next, relies on a salted hash that rotates daily, and does not store raw IP addresses. This gives us aggregate statistics about how the website is used, without identifying individual visitors.

(d) Server security logs: IP address, requested URL, and user agent — kept for a maximum of 30 days, to protect the website against abuse and to investigate security incidents.

4. What We Do Not Collect

We do not use advertising trackers. We do not engage in cross-site tracking. We do not sell personal data. We do not build behavioral profiles of visitors. We do not collect payment data through this website.

5. Where Data Is Stored

All personal data collected through goava.sa is stored on servers located in the Kingdom of Saudi Arabia. This includes the demo and contact requests that we manage in Bigin by Zoho CRM, whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia. Backups of the website's data are also stored within the Kingdom.

6. Cross-Border Transfers

By default, we do not transfer personal data outside the Kingdom of Saudi Arabia. The first exception is transactional email delivery (for example, confirming a demo request or a newsletter subscription), which is carried out through our email delivery provider, Zoho Mail, whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia. Where delivery of a message involves processing outside the Kingdom (for example, when the recipient's mail service is located abroad), it is carried out with appropriate safeguards and in accordance with the conditions for cross-border transfer set out in the PDPL and its Implementing Regulations.

The second exception concerns the demo and contact requests that we manage in Bigin by Zoho CRM (see section 7). They are stored in data centers within the Kingdom of Saudi Arabia, where the service for our account is hosted. Where the provider's technical support for the service involves access to that data from outside the Kingdom, such access is carried out with appropriate safeguards and in accordance with the conditions for cross-border transfer set out in the PDPL and its Implementing Regulations.

7. Sharing and Processors

We share personal data only with the following processors, who act on our instructions:

(a) our hosting provider (infrastructure within the Kingdom of Saudi Arabia);

(b) our email delivery provider, Zoho Mail (Zoho Corporation), whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia; and

(c) our customer relationship management provider, Bigin by Zoho CRM (Zoho Corporation), whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia. We use it to manage and follow up on demo and contact requests and our related business correspondence with you. This provider receives the details you submit through the demo and contact forms — your name, work email, organization, phone number, role, organization type, area of interest, and message — together with the language of the form, the page from which it was submitted, the date of your request, and the record of your consent.

We share data with no other parties, except where disclosure is required by the laws of the Kingdom or by a request from a competent authority.

8. Retention

Demo and contact leads: 24 months after our last contact with you; the same period applies to the copies held in Bigin by Zoho CRM and to the business correspondence about them recorded there. Unconfirmed newsletter signups: deleted after 30 days. Server security logs: a maximum of 30 days. Consent records: kept for the life of the consent, to demonstrate that consent was given.

When a retention period ends, the data is destroyed or anonymized so that you can no longer be identified. For data held in Bigin by Zoho CRM, we also delete the records from the service's recycle bin, and the provider deletes them from its encrypted backups three (3) months after their deletion.

9. Your Rights Under the PDPL

Under the PDPL, you have the right to: be informed about how your personal data is processed; access your personal data; obtain a copy of your personal data; request correction of inaccurate data; request destruction of your data; and withdraw your consent at any time where processing is based on consent.

You do not need an account to exercise these rights. Send your request to privacy@goava.sa and we will respond within 30 days.

10. Direct Marketing

We send direct marketing (such as our newsletter) only with your prior opt-in consent. Every marketing message includes a clear opt-out mechanism, and opt-out requests are honored immediately.

11. Cookies and Local Storage

The goava.sa website is designed to operate without tracking cookies: our analytics are cookieless, and we use only the local storage strictly necessary for the website to function (for example, remembering the selected site language). For details, please see our Cookie Policy.

12. Security Measures

We protect personal data with technical and organizational measures appropriate to the limited data we collect, including: encryption in transit (TLS) for all connections to goava.sa; strict access controls so that only authorized personnel can access personal data; and encrypted backups of the website's data stored within the Kingdom of Saudi Arabia.

13. Children

The goava.sa website and our services are directed at business professionals and are not directed at minors. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@goava.sa and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Each version of this Policy carries a version number and an effective date, and the current version, together with its effective date, is always published on this page. For material changes, we will provide reasonable notice on the website.

15. Contact and Complaints

For any questions, requests, or complaints regarding this Policy or our processing of your personal data, contact us at privacy@goava.sa.

If you are not satisfied with our response, you have the right to escalate your complaint to the Competent Authority — the Saudi Data and Artificial Intelligence Authority (SDAIA).