1. Introduction
This Privacy Policy describes how Climatech Charger, operated by Alshirka Albadail Almumayaza For Energy Company (شركة الشركة البدائل المميزة للطاقة), a limited liability company, Commercial Registration Unified National Number 7040924792 ("Climatech", "we", "us") collects, uses, shares and protects personal information when you visit climch.com, send a form or quote request, use our charging network or use our services. We handle it under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Our charging network, charge point management platform (CPMS) and driver portal are still in development. The parts of this policy about them apply once you use them.
2. Information we collect
We collect what you give us when you use the contact or careers form or the quote wizard, register for an RFID card or sign up for our CPMS portal. Website forms ask for your name, phone number, email address, company, city, project type, number of chargers and your message. The quote wizard also asks for your district, vehicle, parking type, cable distance and electrical supply. Job applicants send their CV by email to careers@climch.com. On our charging network we automatically record session data: charger ID, start and end time, energy delivered in kWh and connector type. If you sign in with an RFID card or the mobile app, we link the session to your account. Our website also receives technical data: IP address, browser type, pages visited and referring page. Apart from the cookieless measurement in section 10, analytics and advertising tools receive it only if you accept them.
3. How we use your information
We use your information to: (a) answer enquiries and provide quotes, (b) run and maintain charging services and our CPMS platform, (c) bill you for energy used and process payments, (d) send service notices, maintenance alerts and, with your consent, marketing messages, (e) meet legal obligations, including SEC, SASO and tax reporting, and (f) improve our services through aggregated, de-identified analytics.
4. Legal basis for processing
Under PDPL, we process personal data on these bases: (a) performing a contract with you, such as a charging session, (b) meeting a legal obligation, (c) our legitimate interest in running and improving our services, where your rights do not override it, and (d) your explicit consent for marketing messages and any non-essential cookies.
5. Sharing of information
We do not sell your personal data. We share information only with: (a) service providers bound by contractual or published data protection obligations, namely Cloudflare for website hosting, security, Turnstile bot protection, form rate limiting, email delivery of form submissions and Web Analytics, Google for Tag Manager, Analytics, Ads, Maps and YouTube, Microsoft for Clarity, Sanity for website content, Meta's WhatsApp when you message us, payment processors, and telecommunications carriers for charger connectivity, (b) charging network roaming partners when you use cross-network charging, limited to the data needed for billing and authentication, (c) regulatory authorities when Saudi law requires it, and (d) successors in a corporate transaction.
6. Data storage and international transfers
Our website and its forms run on Cloudflare's global network, and Google and Microsoft process the website's analytics and advertising data, so this data may be processed outside the Kingdom of Saudi Arabia. When it is, we make sure the transfer meets PDPL requirements, including any approval the competent authority requires and appropriate safeguards.
7. Data retention
We keep personal data only as long as the purposes in this policy need it. Form submissions go to our business email and are kept while we follow up your enquiry or project. To prevent spam, we keep a one-way hash of your IP address and of each submission for 10 minutes. Job applications are kept for the recruitment process, unless you agree to a longer period. Charging session data is kept for 7 years for accounting and tax compliance. Marketing data is kept until you withdraw consent. Account data is kept for the life of your account plus 6 months after closure.
8. Your rights
Under PDPL, you have the right to: (a) access the personal data we hold about you, (b) request correction of inaccurate data, (c) request deletion of your data subject to our legal retention obligations, (d) object to certain processing, (e) withdraw consent for marketing or non-essential cookies at any time, and (f) lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).
9. Security
We protect personal data with administrative, technical and physical safeguards, including encryption in transit and at rest, role-based access controls, bot protection on our forms and regular security reviews. We do not take payments on our website. PCI-DSS compliant payment providers process card payments for charging or other services. No internet transmission is completely secure, so we cannot guarantee absolute security.
10. Cookies
We ask for your choice on your first visit. Until you accept, our marketing tools do not enable analytics or advertising cookies. Google Tag Manager loads alongside Cloudflare's cookieless Web Analytics script described below. Google Tag Manager runs Google Analytics 4 and Google Ads conversion measurement in Google Consent Mode with every setting denied. In that mode they set no cookies and store no identifier on your device. They send Google cookieless signals, such as a page view, a call tap or a form submission, with the page address and the browser data and IP address that come with any web request. Google uses these signals to estimate visits and results in aggregate, and we remove ad click identifiers from them. Cloudflare, our hosting provider, adds its Web Analytics script to our pages before you choose. It sets no cookies and stores no identifier on your device. It sends Cloudflare the page address, the page that referred you, the browser data and IP address that come with any web request, and page-speed measurements, which Cloudflare reports to us only in aggregate. If you accept, Google Analytics 4 and Google Ads may also use cookies, and we load Microsoft Clarity, which shows how pages are used, including clicks and scrolling, so we can improve them. We save your choice in the climch_pixel_consent cookie for 180 days, and you can change it at any time from "Cookie settings" in the site footer. We also store your theme preference in your browser. The contact page displays an embedded Google Map automatically, independently of your marketing-cookie choice. The map may use Google's own cookies or browser storage. Once it loads, Google receives your IP address and browser data under Google's privacy policy. The "Open in Google Maps" link opens Google Maps directly. Some blog articles include a YouTube video. Nothing loads from YouTube until you press play. When you do, the video plays from youtube-nocookie.com, and Google receives your IP address and browser data under Google's privacy policy. Once playing, the player may use Google's own cookies or browser storage.
11. Children's privacy
Our services are for businesses and individuals over 18. We do not knowingly collect personal information from anyone under 18.
12. Changes to this policy
We may update this Privacy Policy. The "Last updated" date at the top shows the most recent revision. We will tell registered users about material changes by email or with a prominent notice on our website.
13. Contact us
To ask about this policy or use your PDPL rights, contact us at privacy@climch.com, info@climch.com or +966 55 111 2998, or write to: Alshirka Albadail Almumayaza For Energy Company, King Fahad Branch Road, As Salamah, Al Olaya, Riyadh 12311, Kingdom of Saudi Arabia. We reply within 30 days.
