Privacy Policy

1. Who We Are

Goava, a limited liability company established in the Kingdom of Saudi Arabia under Commercial Registration No. 7050316699 (referred to below as "Goava", "we", or "us"), is the data controller responsible for the personal data described in this Privacy Policy.

We process personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations.

2. Scope of This Policy

This Privacy Policy applies only to the goava.sa website and to the data we collect through it.

The processing of customer data within the Goava platform — including any data our customers catalog or manage using our product — is governed by separate agreements with those customers and is not covered by this Policy.

3. What We Collect and Why

We collect only the data listed below, each for the purpose stated:

(a) Demo and contact requests: name, work email, organization, phone number, and your message — used solely to respond to your request.

(b) Newsletter: your email address — collected only with your prior opt-in consent, and used to send you the newsletter you subscribed to.

(c) Anonymous, cookieless website analytics: we use a self-hosted instance of Umami analytics. It sets no cookies, uses no identifiers that persist from one day to the next, relies on a salted hash that rotates daily, and does not store raw IP addresses. This gives us aggregate statistics about how the website is used, without identifying individual visitors.

(d) Server security logs: IP address, requested URL, and user agent — kept for a maximum of 30 days, to protect the website against abuse and to investigate security incidents.

4. What We Do Not Collect

We do not use advertising trackers. We do not engage in cross-site tracking. We do not sell personal data. We do not build behavioral profiles of visitors. We do not collect payment data through this website.

5. Where Data Is Stored

All personal data collected through goava.sa is stored on servers located in the Kingdom of Saudi Arabia. Backups are also stored within the Kingdom.

6. Cross-Border Transfers

By default, we do not transfer personal data outside the Kingdom of Saudi Arabia. The only exception is transactional email delivery (for example, confirming a demo request or a newsletter subscription), which is carried out through our email delivery provider, Zoho Mail, whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia. Where delivery of a message involves processing outside the Kingdom (for example, when the recipient's mail service is located abroad), it is carried out with appropriate safeguards and in accordance with the conditions for cross-border transfer set out in the PDPL and its Implementing Regulations.

7. Sharing and Processors

We share personal data only with the following processors, who act on our instructions: our hosting provider (infrastructure within the Kingdom of Saudi Arabia) and our email delivery provider, Zoho Mail (Zoho Corporation), whose service for our account is hosted in data centers within the Kingdom of Saudi Arabia.

We share data with no other parties, except where disclosure is required by the laws of the Kingdom or by a request from a competent authority.

8. Retention

Demo and contact leads: 24 months after our last contact with you. Unconfirmed newsletter signups: deleted after 30 days. Server security logs: a maximum of 30 days. Consent records: kept for the life of the consent, to demonstrate that consent was given.

When a retention period ends, the data is destroyed or anonymized so that you can no longer be identified.

9. Your Rights Under the PDPL

Under the PDPL, you have the right to: be informed about how your personal data is processed; access your personal data; obtain a copy of your personal data; request correction of inaccurate data; request destruction of your data; and withdraw your consent at any time where processing is based on consent.

You do not need an account to exercise these rights. Send your request to privacy@goava.sa and we will respond within 30 days.

10. Direct Marketing

We send direct marketing (such as our newsletter) only with your prior opt-in consent. Every marketing message includes a clear opt-out mechanism, and opt-out requests are honored immediately.

11. Cookies and Local Storage

The goava.sa website is designed to operate without tracking cookies: our analytics are cookieless, and we use only the local storage strictly necessary for the website to function (for example, remembering the selected site language). For details, please see our Cookie Policy.

12. Security Measures

We protect personal data with technical and organizational measures appropriate to the limited data we collect, including: encryption in transit (TLS) for all connections to goava.sa; strict access controls so that only authorized personnel can access personal data; and encrypted backups stored within the Kingdom of Saudi Arabia.

13. Children

The goava.sa website and our services are directed at business professionals and are not directed at minors. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@goava.sa and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Each version of this Policy carries a version number and an effective date, and the current version, together with its effective date, is always published on this page. For material changes, we will provide reasonable notice on the website.

15. Contact and Complaints

For any questions, requests, or complaints regarding this Policy or our processing of your personal data, contact us at privacy@goava.sa.

If you are not satisfied with our response, you have the right to escalate your complaint to the Competent Authority — the Saudi Data and Artificial Intelligence Authority (SDAIA).