العربية

Privacy Policy

How Mekavo collects, uses, and protects the personal data of Saudi Arabia workshop operators.

Last updated: 5 March 2026

This Privacy Policy explains how MEKAVO LTD (trading as "Mekavo"), registered in England and Wales (Company No. 16477044), collects, uses, stores, and protects your personal data when you use our website (mekavo.com) and our workshop management software platform (the "Service"). Mekavo is operated from the United Kingdom and serves workshops in Saudi Arabia and other countries.

We are committed to protecting your privacy and ensuring your data is handled in accordance with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 of 9/2/1443H, as well as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In your country, your data is also protected by the Personal Data Protection Law (PDPL).

1. Who We Are

MEKAVO LTD is the data controller for the personal data processed through Mekavo. Our registered office is:

MEKAVO LTD
76 Letchworth Rd
Leicester, LE3 6FH
United Kingdom

Email:

2. Data We Collect

We collect the following types of personal data:

2.1 Account Information

  • Full name, email address, phone number
  • Business name and address
  • Country and preferred language
  • Password (encrypted)

2.2 Customer Data You Store

  • Your customers' names, phone numbers, email addresses, and vehicle details
  • Job records, invoices, and payment history
  • Fahs and service reminder data

You are the data controller for your customers' data. Mekavo acts as a data processor on your behalf.

2.3 Usage Data

  • IP address, browser type, device information
  • Pages visited, features used, session duration
  • Referral source and search terms

2.4 Payment Data

  • Billing name and address
  • Payment card details are processed securely by Stripe — we never store your full card number

2.5 Communication Data

  • Support tickets, emails, and contact form messages
  • In-app feedback and feature requests

3. How We Use Your Data

We use your personal data to:

  • Provide, maintain, and improve the Mekavo platform
  • Process subscriptions, payments, and refunds
  • Send transactional emails (account confirmation, password reset, invoices)
  • Send SMS reminders on your behalf to your customers
  • Provide technical support and respond to enquiries
  • Analyse usage patterns to improve the Service
  • Comply with legal obligations (tax records, fraud prevention)
  • Send marketing communications (only with your explicit consent)

4. Lawful Basis for Processing

We process your data under the following legal bases:

  • Contract: Processing necessary to deliver the Service you signed up for
  • Legitimate interest: Improving our platform, preventing fraud, ensuring security
  • Consent: Marketing emails and non-essential cookies (you can withdraw at any time)
  • Legal obligation: Tax compliance, responding to lawful requests from authorities

5. Data Sharing

We do not sell your personal data. We share data only with trusted third parties who help us operate the Service:

  • Stripe — payment processing
  • DigitalOcean — cloud hosting infrastructure
  • Twilio / SMS provider — sending SMS reminders to your customers
  • Email provider — transactional and marketing emails
  • Analytics tools — anonymised usage data for product improvement

All third-party providers are contractually bound to protect your data and process it only on our instructions.

We may also disclose data if required by law, regulation, or legal process.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data: Retained while your account is active, deleted within 90 days of account closure
  • Customer data you stored: Deleted within 90 days of account closure (or upon your request)
  • Invoices and payment records: Retained for 7 years as required by UK tax law
  • Support tickets: Retained for 2 years after resolution
  • Usage/analytics data: Anonymised and aggregated after 26 months
  • WhatsApp messages: What you send to our WhatsApp number, and our replies, are kept for 6 years. After that, the phone number and the message text are removed; only anonymous records (date, country, cost) are kept

7. Cookies

We use cookies and similar technologies to operate the Service, remember your preferences, and analyse usage. For full details, see our Cookie Policy.

You can manage cookie preferences through your browser settings or our cookie consent banner.

8. Your Rights

Under Saudi Arabia PDPL and UK GDPR, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you
  • Right to rectification: Ask us to correct inaccurate or incomplete data
  • Right to erasure: Request deletion of your data ("right to be forgotten")
  • Right to restrict processing: Ask us to limit how we use your data
  • Right to data portability: Receive your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interest or direct marketing
  • Right to withdraw consent: Withdraw consent for marketing or non-essential cookies at any time

To exercise any of these rights, email us at . We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) at https://sdaia.gov.sa.

Because Mekavo is a UK company, you may also raise a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. International Data Transfers

Our servers are located in the United Kingdom and the European Economic Area (EEA). As a Saudi Arabia user, your data is transferred to and stored in the UK. We ensure appropriate safeguards are in place for international transfers, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • UK International Data Transfer Agreement (IDTA)
  • Adequacy decisions where applicable

10. Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure password hashing (bcrypt)
  • Regular security updates and vulnerability monitoring
  • Access controls and role-based permissions
  • Regular backups with encrypted storage

No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours.

11. Children

Mekavo is a business-to-business service and is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through a notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

MEKAVO LTD (trading as Mekavo)
76 Letchworth Rd, Leicester, LE3 6FH, UK

Privacy enquiries:
General enquiries: