Privacy policy

bixdo.sa

Effective date: 1 Aug 2026
Last updated: 1 Aug 2026

1. Who we are

This website, www.bixdo.sa (the "Site"), is owned and operated by Meina Bixdo Trading Co Company for Trading & Import ("bixdo", "we", "us", "our"), a company registered in the Kingdom of Saudi Arabia.

Commercial Registration (CR) No.	7054452607
Customer support	support@bixdo.sa
Telephone / WhatsApp	+966 539833744
Privacy contact	privacy@bixdo.sa

For the purposes of the Saudi Personal Data Protection Law (Royal Decree No. M/19 of 1443H, as amended) and its Implementing Regulations (the "PDPL"), bixdo is the Data Controller of the personal data described in this policy.

2. Scope of this policy

This policy explains how we collect, use, disclose, transfer, retain and protect personal data when you:

visit or browse the Site;
create an account or place an order;
contact our customer care team;
subscribe to marketing communications;
interact with us on social media or through our advertising; or
attend an event, demonstration or clinic partnership activity where we collect your details.

It applies to individuals in the Kingdom of Saudi Arabia and to anyone else whose personal data we process in connection with the Site.

3. What personal data we collect

3.1 Data you give us

Category	Examples
Identity and contact	Full name, mobile number, email address, national/iqama ID where required for delivery or customs
Delivery	Shipping address, national address, delivery instructions, recipient name and number
Order and billing	Order history, invoice details, billing address, VAT details for business customers
Payment	Payment method type and the last four digits of the card. We do not collect or store full card numbers or CVV. These are handled directly by our payment providers
Account	Username, password (stored in hashed form), saved preferences and wish lists
Customer care	Correspondence, call and chat records, complaint and return records, warranty claims
Marketing	Consent status, communication preferences, competition and event entries
Content you submit	Product reviews, ratings, photographs, testimonials and other user-generated content

3.2 Data we collect automatically

Device and browser type, operating system, IP address, approximate location derived from IP, referring URL, pages viewed, time on page, search terms used on the Site, cart and checkout behaviour, and cookie and similar identifiers. See section 9.

3.3 Sensitive personal data

Some of our products are beauty devices and skincare products. If you voluntarily tell us about your skin type, skin concerns, sensitivities, allergies, or a medical condition or contraindication (for example when asking whether a device is suitable for you, when submitting a warranty or safety report, or when completing a skin quiz), that information may constitute health-related data, which is treated as sensitive personal data under the PDPL.

We collect this only where you choose to provide it, we process it solely to answer your enquiry or handle your claim safely, we apply enhanced access restrictions, and we do not use it for marketing or profiling.

3.4 Children

The Site is intended for adults. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we hold such data without verified guardian consent, we will delete it. If you believe a minor has provided us with personal data, contact privacy@bixdo.sa.

4. Why we process your data, and our legal basis

Under the PDPL we must have a lawful basis for each processing activity.

Purpose	Lawful basis
Creating and administering your account	Performance of a contract with you
Processing, fulfilling and delivering orders	Performance of a contract
Taking payment and preventing payment fraud	Performance of a contract; our legitimate interests
Handling returns, refunds, exchanges and warranty claims	Performance of a contract; compliance with a legal obligation
Providing customer support and safety guidance	Performance of a contract; your consent (for health-related information)
Issuing tax invoices and complying with ZATCA e-invoicing	Compliance with a legal obligation
Product safety, recall and regulatory reporting (including SFDA)	Compliance with a legal obligation; protection of vital interests
Sending marketing communications	Your explicit, opt-in consent
Personalising content and recommendations	Your consent (via cookie and preference settings)
Analytics, site performance and security monitoring	Our legitimate interests
Defending or bringing legal claims	Our legitimate interests; legal obligation

We rely on legitimate interests only where our interests are not overridden by your rights and freedoms, and never for sensitive personal data.

5. Marketing communications

We will only send you marketing emails, SMS, or WhatsApp messages where you have given specific, informed, freely given and clearly recorded opt-in consent. Consent to marketing is never bundled into acceptance of our Terms and Conditions or into placing an order, and refusing marketing will never affect your ability to purchase.

You may withdraw consent at any time, free of charge, by:

clicking the unsubscribe link in any email;
replying with the stop keyword indicated in any SMS or WhatsApp message;
changing your preferences in your account settings; or
emailing privacy@bixdo.sa.

Withdrawal takes effect promptly and in any event within 3 business days. We will continue to send you transactional messages relating to your orders, deliveries, warranty and safety notices, as these are not marketing.

We maintain a timestamped record of when and how each consent was given and withdrawn.

6. Who we share your data with

We do not sell your personal data. We share it only as follows:

Service providers acting on our instructions (processors):

e-commerce platform and hosting provider — Shopify
payment gateways and BNPL providers — mada, Apple Pay, Tabby, Tamara, STC Pay
logistics, warehousing, fulfilment and last-mile delivery partners, including any third-party logistics provider or Importer of Record acting on our behalf — Amazon, Noon

Each processor is engaged under a written agreement requiring them to process data only on our instructions, apply appropriate safeguards, store and process the data within the Kingdom of Saudi Arabia, and delete or return data at the end of the engagement.

Brand owner and manufacturer. Where we need to investigate a product fault, honour a warranty claim, or meet a product safety obligation, we share only anonymised technical case information — such as the model, serial number, fault description and images of the product itself — with the manufacturer or brand owner. We do not share your name, contact details, address or order records with them. Where the manufacturer is located outside the Kingdom, see section 7.

Authorities. We may disclose personal data where required by Saudi law or by a competent authority, including SDAIA, the Ministry of Commerce, ZATCA, the SFDA, Saudi Customs, or a court order.

Corporate transactions. If we sell or restructure part of our business, personal data may be transferred as part of that transaction, subject to the same protections.

7. Your data stays in the Kingdom

We do not transfer your personal data outside the Kingdom of Saudi Arabia.

Your personal data is stored and processed on infrastructure located within the Kingdom. Every service provider we engage to process personal data on our behalf is contractually required to host and process that data within the Kingdom, and not to transfer, replicate, back up or make it accessible outside the Kingdom without our prior written instruction.

Where we need to work with a party outside the Kingdom — for example when investigating a product fault with the manufacturer — we do so using anonymised or aggregated technical information only, from which you cannot be identified. We do not send your name, contact details, address, order records or any other identifying information outside the Kingdom.

The only exception is where disclosure outside the Kingdom is required by Saudi law or by order of a competent Saudi authority or court.

If this position ever changes, we will update this policy, notify you in advance, and comply in full with Article 29 of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom before any transfer takes place.

8. How long we keep your data

Data	Retention period
Tax invoices and transaction records	6 years from the end of the relevant tax period, as required by ZATCA
Account data	For as long as your account is active, then 24 months of inactivity, then deleted or anonymised
Order, delivery and returns records	5 years, to support warranty, consumer protection and dispute periods
Warranty and product safety records	The warranty period plus 3 years
Customer service correspondence	24 months from case closure
Marketing consent records	For the duration of the consent plus 3 years after withdrawal, as evidence of compliance
Cookie and analytics data	26 months
Health-related information you volunteer	Only as long as needed to resolve your enquiry or claim, then deleted

Where a retention period expires, we securely delete or irreversibly anonymise the data.

9. Cookies and similar technologies

We use cookies and similar technologies to operate the Site, remember your cart and language preference, measure performance, and — where you consent — to personalise content and measure advertising.

Strictly necessary cookies are required for the Site to function (session management, cart, security, load balancing) and are set without consent.

Analytics, functional and advertising cookies are set only after you give consent through our cookie banner. You can change or withdraw your choices at any time.

Most browsers also allow you to block or delete cookies, though blocking strictly necessary cookies may prevent parts of the Site from working.

10. Your rights

Under the PDPL you have the right to:

Be informed of the legal basis and purpose for collecting your personal data;
Access your personal data held by us;
Obtain a copy of your personal data in a readable and clear format;
Request correction of data that is inaccurate, incomplete or out of date;
Request destruction of your personal data where it is no longer needed for the purpose it was collected;
Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact privacy@bixdo.sa with enough detail to identify you and your request. We may ask for proof of identity before acting. We will respond within 30 days of receiving a valid request, and we do not charge a fee unless a request is manifestly excessive or repetitive.

We may be unable to fully action a destruction request where we are required to retain the data by law — for example tax invoices — and we will tell you if that applies.

Complaints. If you are not satisfied with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain directly to the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels.

11. Security

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit (TLS), access controls on a need-to-know basis, logging and monitoring, staff confidentiality obligations and training, and contractual security obligations on our processors.

No system is completely secure. If a personal data breach occurs that may cause harm to you or to your data, we will notify SDAIA within 72 hours of becoming aware of it, and we will notify you without undue delay where the breach is likely to cause you serious harm.

12. Changes to this policy

We may update this policy from time to time. The current version will always be available on the Site with the "last updated" date shown at the top. Where changes are material — for example a new purpose of processing or a new category of recipient — we will notify you by email or a prominent Site notice, and where the change requires it, we will seek fresh consent.