Privacy policy

This policy explains how Recycling Bank collects, stores, uses, and shares your personal and business data, in compliance with the Saudi Waste Management Law 2021 and MWAN requirements.

• —Account information: full name, email address, phone number, and company representative name.
• —Company verification data: Commercial Registration (CR) number, VAT certificate, and CR certificate uploaded during registration.
• —Transaction data: material listings, booking records, shipment details, confirmed weights, and payment references.
• —Usage data: pages visited, actions performed, and timestamps — used for audit trails and platform security.

• —To verify your company identity and comply with Saudi Waste Management Law 2021, Article 14.
• —To facilitate transactions, logistics coordination, and escrow management between parties.
• —To generate environmental impact certificates and EPR compliance reports.
• —To investigate disputes and maintain audit records as required by MWAN regulations.
• —To send platform notifications related to your account, transactions, and shipments.

• —The Platform enforces a double-blind marketplace: buyer and seller identities are never disclosed to each other.
• —All transactions are executed through operational codes. Your company name and contact details are visible only to Platform administrators.
• —Logistics partners receive only the operational information required to complete their assigned shipment.

• —We do not sell your personal or business data to third parties.
• —Regulatory disclosure: we may disclose data to MWAN, government authorities, or courts when legally required.
• —Service providers: we share necessary data with Alibaba OSS (file storage) and Firebase (database/auth) for platform operations, both under strict data processing agreements.
• —Aggregated, anonymised data may be used for industry reports and carbon market analytics.

• —Transaction records and shipment documentation are retained for a minimum of 7 years to comply with Saudi commercial and environmental law.
• —Environmental certificates are retained indefinitely as they carry permanent legal and audit value.
• —Account data is retained for the duration of the account and 3 years after closure.
• —You may request deletion of non-legally-required personal data by contacting us.

• —Access: you may request a copy of the personal data we hold about you.
• —Correction: you may request correction of inaccurate data.
• —Deletion: you may request deletion of personal data not subject to legal retention requirements.
• —Portability: you may request your transaction history and certificate data in a structured format.
• —To exercise these rights, contact us through your account dashboard or at the address listed below.

• —All data is transmitted over HTTPS. Files are stored in Alibaba OSS (Saudi Arabia — Riyadh region) with access-controlled signed URLs.
• —Firebase Authentication handles all password management; passwords are never stored in plain text.
• —Admin access is restricted to verified Platform staff only.
• —In the event of a data breach affecting your personal data, we will notify you within 72 hours.

• —For privacy-related questions or to exercise your rights, contact us through your account dashboard.
• —This policy is governed by the laws of the Kingdom of Saudi Arabia.
• —Last updated: 2026.