Privacy Policy

Effective Date: 3 November 2026

Last Updated: 3 November 2026

GBE Logistics Establishment (“GBE,” “we,” “us,” or “our”), Unified National Number 7027048391, is committed to protecting the personal data it processes in connection with its services, in accordance with the Saudi Personal Data Protection Law and its Implementing Regulations.

This Policy explains what personal data we collect, why we use it, how we share and retain it, and how you can exercise your rights.

1. Scope

This Policy applies to personal data processed through www.gbe.sa, our electronic portals, shipping, delivery and logistics services, customer communications, recruitment activities, and applications to work or collaborate with GBE.

Depending on the relationship, it covers website visitors, customers and their representatives, senders, recipients, job applicants, couriers, and employees using our portals.

We may provide additional privacy notices for specific activities. Those notices should be read together with this Policy.

2. Personal Data We Collect

We limit collection to the personal data necessary for the relevant purpose. Depending on the service or relationship, this may include:

• Identification and contact details: Name, mobile number, email address, address, and business representative details.
• Identity verification details: National ID or residency permit number, issue and expiry dates, and nationality, where necessary and legally permitted. Our employees verify the original document by viewing it; we do not photograph it or retain a copy.
• Shipping and delivery details: Sender and recipient information, collection and delivery addresses, service-related location information, shipment details and status, proof-of-delivery photographs, and recipient signatures.
• Transaction and communication records: Requests, complaints, correspondence, and service-related call recordings.
• Recruitment and work-related information: Information provided in job applications and CVs, and account and work-related details necessary to operate the relevant portals and services.
• Technical information: Device and browser information, IP addresses, access and usage logs, and information collected through cookies and analytics technologies.

We do not collect payment card details. Please do not submit payment card details or unnecessary sensitive personal data through our website forms or correspondence.

3. How We Collect Personal Data

We collect personal data directly from you when you submit a request, use our portals, communicate with us, or interact with us during verification, collection, delivery, or other service activities.

We may also receive recipient information from a sender, merchant, or customer requesting a service. Technical information may be collected through your use of our website and portals.

We provide the information and notices required by applicable law to individuals whose personal data we process.

If you provide another person’s personal data, you should be authorised to do so and provide only accurate information necessary for the service. This does not remove GBE’s own legal obligations towards that individual.

4. Purposes and Legal Grounds for Processing

Depending on the circumstances, we process personal data to:

• Receive requests, prepare quotations, and provide shipping, delivery, tracking, and logistics services.
• Verify identity or authority where necessary and document collection and delivery.
• Manage accounts, portals, and relevant employment or contractual relationships.
• Handle enquiries and complaints and investigate service-related incidents.
• Protect our systems, prevent fraud and misuse, and improve service performance.
• Assess job applications and communicate with applicants.
• Meet legal obligations and respond to lawful requests from competent authorities.
• Conduct analytics and marketing activities where supported by an appropriate legal ground and any required consent.

We rely on the legal ground appropriate to each processing activity. This may include performing an agreement to which the data subject is a party, complying with a legal requirement, consent, or a legitimate interest where its legal conditions are satisfied and individuals’ rights and interests are respected.

At collection, we identify which information is required and which is optional. If information necessary for a service is not provided, we may be unable to provide all or part of that service. We do not make the service conditional on consent to unrelated, optional processing.

5. Marketing and Cookies

We distinguish necessary operational communications, such as shipment updates and responses to requests, from marketing communications.

Where we process personal data for direct marketing, we obtain the required consent. You can withdraw that consent through the available unsubscribe method or by contacting us. Opting out of marketing does not prevent necessary operational communications.

Our website uses cookies and similar technologies to operate its functions, remember preferences, and analyse usage. Technologies requiring consent are subject to your choice. We provide information about their purposes, durations, and how to manage your preferences.

6. Sharing Personal Data

Where supported by a lawful ground, we may share the minimum personal data necessary with:

• Parties involved in shipping, collection, delivery, and related logistics services.
• Providers of hosting, storage, backup, technical support, communications, and analytics services, as required for the relevant purpose.
• The relevant sender, recipient, or customer, to the extent necessary to monitor and document service delivery.
• Professional advisers and competent authorities where there is a need and lawful ground for disclosure.

We establish responsibilities and appropriate safeguards for service providers processing personal data on our behalf. This Policy does not give those providers unrestricted permission to use personal data for their own independent purposes.

7. Storage Location and Security

We store personal data and backups within the Kingdom of Saudi Arabia.

We implement appropriate organisational, administrative, and technical measures to protect personal data and restrict access according to work-related needs.

If future processing requires transferring personal data or disclosing it to a party outside Saudi Arabia, we will comply with the applicable legal requirements, safeguards, and notice obligations before doing so.

No technology can eliminate all security risks. This statement does not limit our legal obligations to protect personal data, respond to incidents, or provide required notifications.

8. Retention and Destruction

We retain personal data for as long as necessary to fulfil the purpose for which it was collected, taking into account the nature of the service, applicable legal retention requirements, and judicial proceedings requiring retention.

Retention periods vary by data category. Recruitment information, enquiries, and call recordings are not necessarily retained for the same periods as shipment records or financial documents.

Once the purpose has ended and no lawful retention requirement remains, we securely destroy the data or anonymise it so that the individual can no longer be identified.

Deleting an account does not necessarily result in the destruction of records that must be retained by law.

9. Your Rights

Subject to the applicable legal requirements and exceptions, you have the right to:

• Be informed about how your personal data is processed, its legal ground, and its purpose.
• Access your personal data and request a readable and clear copy.
• Request correction, completion, or updating of your personal data.
• Request destruction of personal data that is no longer needed.
• Withdraw consent where processing is based on that consent.

To submit a request, contact Support@gbe.sa, describe the right you wish to exercise, and provide information that helps us identify the relevant interaction.

We may request appropriate information to verify your identity or authority, without collecting more information than necessary.

We fulfil rights requests within 30 days. Where legally permitted, we may extend this period by up to 30 additional days, after notifying you in advance of the extension and its reasons.

Requests remain subject to applicable legal restrictions and exceptions, including protecting other individuals’ personal data and meeting mandatory retention requirements.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal or processing that continues on another lawful ground.

10. Enquiries and Complaints

For privacy enquiries, rights requests, or complaints, please contact:

GBE Logistics Establishment
Unified National Number: 7027048391
Email: Support@gbe.sa
Website: www.gbe.sa

You may also submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform (dgp.sdaia.gov.sa), in accordance with the applicable procedures.

11. Changes to This Policy

We may update this Policy to reflect changes to our services, processing practices, or legal requirements.

We publish the updated version and its effective date and provide additional notice or obtain new consent where legally required.

Continued use of the website does not, by itself, constitute consent to a new purpose that requires separate consent.