Your Data Rights

1. Your rights under the PDPL

The Saudi Personal Data Protection Law (PDPL) grants you specific rights over your personal data. Goava is committed to honouring each of them:

Right to be informed — you have the right to know how and why we collect and process your personal data, as set out in our Privacy Policy.

Right of access — you have the right to ask whether we hold personal data about you and to access that data.

Right to obtain a copy — you have the right to receive a copy of your personal data in a clear and readable format.

Right to correction — you have the right to have inaccurate, incomplete, or outdated personal data corrected, completed, or updated.

Right to destruction — you have the right to request the destruction of your personal data when it is no longer needed, or in the other cases provided for by the PDPL.

Right to withdraw consent — where our processing relies on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

2. How to exercise your rights

To exercise any of these rights, email us at privacy@goava.sa from the email address associated with your data. You do not need an account with us to submit a request.

Please state which right you wish to exercise and include enough detail for us to locate your data. A dedicated request form is coming to this page; until then, email is the fastest channel.

3. What happens next

Once we receive your request, we will send you an acknowledgment that includes a reference number so you can track it.

We will verify your identity through the email address you used, to protect your data from unauthorized requests.

We will respond within 30 days of receiving your request. Where a request is complex or we receive multiple requests, this period may be extended once, and we will notify you of the extension and the reasons for it before the original period ends, in accordance with the PDPL.

4. Limits of what we hold

We only hold the personal data described in our Privacy Policy. If your request concerns data we do not hold, we will tell you so.

Our website analytics are anonymous and cannot be linked back to you as an individual. Because this data is not personal data, there is nothing for us to retrieve or erase in response to a rights request concerning it.

5. Complaints

If you are not satisfied with our response, or you believe we have processed your personal data in violation of the PDPL, you may escalate your complaint to the Competent Authority, the Saudi Data and Artificial Intelligence Authority (SDAIA).

We encourage you to contact us first at privacy@goava.sa so we can try to resolve the matter directly.