Your privacy matters to us. This Policy explains how GES Logistics collects, uses, stores, and protects your personal data in compliance with the Saudi Personal Data Protection Law (PDPL) and applicable international standards. Effective Date: 18 May 2026 Last Updated: 18 May 2026 1. Introduction This Privacy Policy ("Policy") describes how GES Logistics, operating as Overseas Development Co. Ltd., a company registered in the Kingdom of Saudi Arabia under commercial registration number 4030127383 ("GES Logistics," "we," "us," or "our"), collects, processes, stores, transfers, and protects personal data of individuals who interact with us, including visitors to our website, customers, partners, suppliers, job applicants, and other stakeholders. This Policy is issued in compliance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree No. M/19, "PDPL") and its Implementing Regulations, and supplemented by applicable international data protection standards where relevant. 2. Scope This Policy applies to: • All personal data collected through our website, online forms, applications, and digital platforms • Personal data we receive in the course of providing logistics services • Personal data of business contacts, suppliers, partners, and job applicants • Any other personal data processed by GES Logistics in connection with its business operations References in this Policy to "personal data" mean any information relating to an identified or identifiable natural person, as defined under the PDPL. 3. Personal Data We Collect We collect personal data that you provide to us directly, data we receive from third parties, and data we collect automatically through your use of our website and services. 3.1 Data You Provide Directly • Identification data: full name, job title, company name, role • Contact data: email address, telephone number, postal address, country • Commercial data: company information, shipment details, business requirements • Application data: CV, employment history, educational background, references (for job applicants) • Communications: messages, inquiries, feedback, correspondence • Authentication data: usernames, login credentials (if you access any restricted area) 3.2 Data Collected Automatically • Technical data: IP address, browser type, device type, operating system • Usage data: pages visited, time spent on the website, clickstream data, referring URLs • Cookies and similar technologies: as detailed in our Cookies section below 3.3 Data from Third Parties • Business partners, agents, and service providers • Public sources and business directories • Background verification services (for job applicants, where lawful) • Credit reference and compliance screening services We do not knowingly collect personal data from individuals under 18 years of age. If you become aware that we have collected personal data from a minor, please contact us so we can take appropriate action. 4. Legal Basis for Processing Under the PDPL, we process personal data on the following lawful bases: • Consent: Where you have given clear, informed, and specific consent to a particular processing activity (such as subscribing to updates) • Contract performance: Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract • Legal obligation: Where processing is required to comply with a legal or regulatory obligation in the Kingdom of Saudi Arabia or other applicable jurisdiction • Legitimate interests: Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and interests (such as for security, fraud prevention, and improving our services) • Vital interests: Where processing is necessary to protect the vital interests of an individual • Public interest: Where processing is necessary for the performance of a task carried out in the public interest 5. How We Use Personal Data We use personal data for the following purposes: 5.1 Service Delivery • Responding to inquiries and quotation requests • Providing logistics, freight, warehousing, and related services • Managing customer accounts and relationships • Processing payments and managing billing • Customs declarations and regulatory compliance 5.2 Business Operations • Managing supplier and partner relationships • Recruitment and employment processes • Internal administration, reporting, and analysis • Quality assurance and operational improvement • Risk management and fraud prevention 5.3 Communications • Sending service-related communications and updates • Responding to questions, feedback, and requests • Marketing communications (only where you have provided consent or where lawful under the PDPL) • Notifications about changes to our services or policies 5.4 Legal and Compliance • Complying with legal, regulatory, and contractual obligations • Responding to lawful requests from regulatory authorities • Establishing, exercising, or defending legal claims • Protecting our rights, property, and safety, and those of our employees, customers, and the public 5.5 Website and Technology • Operating, maintaining, and improving our website and digital services • Analyzing usage patterns and user behavior • Detecting and preventing security threats, fraud, and other unlawful activity 6. Sharing of Personal Data We may share personal data with the following categories of recipients: 6.1 Within Our Group With Unitrans Group affiliates and subsidiaries, including other companies within the Unitrans corporate group, for business operations, internal administration, and shared services. 6.2 Service Providers With third-party service providers who process personal data on our behalf, including IT and cloud service providers, customs brokers, transportation carriers, warehousing partners, financial institutions, and professional advisors. These parties are contractually required to protect personal data in accordance with PDPL requirements. 6.3 Business Partners With shipping lines, airlines, ground handlers, freight agents, and other logistics partners as necessary to deliver the services you have requested. 6.4 Regulatory Authorities With Saudi government authorities, customs (ZATCA), regulatory bodies (SFDA, SASO, CITC, MOI, MOD, and others), tax authorities, and other competent authorities as required by law or in connection with regulatory compliance. 6.5 Legal and Compliance Where required by law, court order, or other legal process; to protect our rights or property; to investigate fraud or security issues; or to comply with sanctions screening and anti-money laundering requirements. 6.6 Corporate Transactions In the context of a corporate transaction such as a merger, acquisition, restructuring, or sale of assets, in which case personal data may be transferred to the relevant counterparties subject to appropriate safeguards. We do not sell personal data to third parties. 7. International Data Transfers As a global logistics company operating in 16 countries and serving 100+ countries, we may transfer personal data outside the Kingdom of Saudi Arabia in the course of providing services. Such transfers will be carried out in compliance with the PDPL and its Implementing Regulations, including: • Transfers to jurisdictions providing an adequate level of data protection • Transfers subject to appropriate safeguards (such as contractual clauses, binding corporate rules, or other approved mechanisms) • Transfers necessary for the performance of a contract with you • Transfers for which you have given explicit consent • Transfers necessary for important public interest reasons Where required, we will obtain the necessary approvals from the Saudi Data and Artificial Intelligence Authority (SDAIA) or the National Data Management Office (NDMO) prior to any cross-border transfer. 8. Data Retention We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Retention periods are determined based on: • The nature and sensitivity of the data • The purposes for which the data is processed • Legal and regulatory requirements (including Saudi tax law, customs law, employment law, and commercial law) • The need to defend or establish legal claims • Industry standards and best practices When personal data is no longer required, it will be securely deleted, anonymized, or destroyed in accordance with our data retention policy. 9. Data Security We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, damage, or disclosure. These measures include: • Access controls and user authentication • Encryption of data in transit and at rest where appropriate • Network security, firewalls, and intrusion detection • Regular security assessments and audits • Employee training and confidentiality obligations • Incident response procedures • Physical security at our facilities In the event of a personal data breach that is likely to result in significant harm to data subjects, we will notify the relevant Saudi authorities and affected individuals as required by the PDPL and its Implementing Regulations. 10. Your Rights Under the PDPL Under the Saudi Personal Data Protection Law, you have the following rights with respect to your personal data: 10.1 Right to Be Informed You have the right to be informed about the collection and use of your personal data. 10.2 Right of Access You have the right to request access to the personal data we hold about you and to obtain information about how we process it. 10.3 Right to Rectification You have the right to request correction of inaccurate or incomplete personal data. 10.4 Right to Erasure You have the right to request deletion of your personal data in certain circumstances, subject to legal and regulatory retention requirements. 10.5 Right to Restrict Processing You have the right to request that we restrict the processing of your personal data in certain circumstances. 10.6 Right to Data Portability You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible. 10.7 Right to Withdraw Consent Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 10.8 Right to Object You have the right to object to certain processing of your personal data, including processing for direct marketing purposes. 10.9 Right to File a Complaint You have the right to file a complaint with the competent Saudi data protection authority (the Saudi Data and Artificial Intelligence Authority, SDAIA) if you believe your rights under the PDPL have been violated. To exercise any of these rights, please contact us using the contact details provided below. We will respond to your request within the time period required by applicable law. 11. Cookies and Similar Technologies Our website uses cookies and similar technologies to enhance your experience, analyze website usage, and deliver relevant content. Cookies are small text files placed on your device when you visit a website. 11.1 Types of Cookies We Use • Strictly necessary cookies: Required for the website to function properly • Performance and analytics cookies: Help us understand how visitors use the website • Functional cookies: Enable enhanced functionality and personalization • Marketing cookies: Used to deliver relevant advertising (only with your consent) 11.2 Managing Cookies You can manage your cookie preferences through your browser settings or through our cookie consent banner when you first visit the website. Please note that disabling certain cookies may affect the functionality of the website. 12. Marketing Communications Where permitted by law and subject to your consent (where required), we may send you marketing communications about our services, news, events, and updates. You can opt out of marketing communications at any time by: • Clicking the "unsubscribe" link in any marketing email • Contacting us using the details provided below • Updating your communication preferences if you have an account with us Opting out of marketing communications does not affect operational communications related to services we provide to you. 13. Children's Privacy Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete the information promptly. 14. Third-Party Websites Our website may contain links to third-party websites. This Privacy Policy applies only to GES Logistics. We are not responsible for the privacy practices of third-party websites, and we encourage you to review their privacy policies before providing any personal data. 15. Changes to This Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated through our website or by other appropriate means. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of our services after changes are posted constitutes acceptance of the updated Policy. 16. Contact Us and Data Protection Officer For questions, requests, or concerns regarding this Privacy Policy or our processing of your personal data, please contact: GES Logistics — Data Protection Overseas Development Co. Ltd. Jeddah, Kingdom of Saudi Arabia Email: privacy@geslogistics.com General Contact: connect.ksa@geslogistics.com Phone: 9200 14820 Data Protection Officer: privacy@geslogistics.com Regulatory Authority: If you wish to file a complaint regarding our processing of your personal data, you may contact: Saudi Data and Artificial Intelligence Authority (SDAIA) Kingdom of Saudi Arabia Website: sdaia.gov.sa Language This Privacy Policy is provided in English. In the event of any inconsistency between this version and any translated version, the version that complies with mandatory Saudi Arabian legal requirements shall prevail.
