Privacy Policy and Data Processing Terms

ALLCHRONO

Privacy Policy and Data Processing Terms

The Privacy Policy, and the Data Processing Terms it refers to

Version 1.0 · 11 October 2026

Published at allchrono.com

Published in English and Arabic. The Arabic version prevails.

Part A · Privacy Policy

AllChrono Company (شركة آلكرونو), commercial registration 7052667909, registered at Ahmad Al Muradi Street, King Salman District, Riyadh 12434, Kingdom of Saudi Arabia ("AllChrono", "we", "us"), is the controller of the personal data described below.

Version 1.0 · published 11 October 2026

1 · What this covers

1.1 This policy covers personal data we handle when you use allchrono.com, buy a watch through it, or sell through it as a dealer.

1.2 It applies alongside the Platform Terms and the Dealer Terms. Where it conflicts with either on a question of personal data, this policy governs.

2 · Who to contact

2.1 Write to [email protected] for anything in this policy, including any request under clause 10.

2.2 You can also complain to the Saudi Data and Artificial Intelligence Authority. We would rather you came to us first.

2.3 Our data protection officer is reachable at [email protected]. Where a request concerns your personal data, send it there rather than to support, because the thirty day clock in clause 10.2 starts when it arrives at that address.

3 · The short version

We collect what we need to get a watch to you and to prove, later, that the sale happened the way we say it did. We do not sell personal data. We do not use it to advertise to you unless you ask us to. Most of what we keep, we keep because a tax, customs or anti money laundering rule tells us to.

4 · What we collect from a buyer

4.1 Account data. Name, email address, mobile number, and the password hash. We never see your password itself.

4.2 Order data. What you bought, when, at what price, the delivery address, and the order and shipment history attached to it.

4.3 Payment data. We do not hold your card number. Payment is taken by our licensed payment provider, who holds the card details and returns to us only a token, the last four digits, the card scheme and the result. Where you pay by bank transfer we hold the sending account name and the reference.

4.4 Residence and identity data. At checkout we ask you to confirm your country of residence, and we may ask for a national identity document or residency permit. We collect this because the tax treatment of your purchase depends on where you are resident, and we have to be able to evidence that to the tax authority. We do not use it for marketing and we do not pass it to the seller.

4.5 Acceptance data. When you place an order we record the date and time to the second, the version of the terms you accepted, a cryptographic hash of that text, the network address and device you used, and how your account was authenticated.

4.6 Technical data. Device, browser, operating system, and the pages you viewed. Used to keep the site working and to detect fraud.

4.7 Communications. Messages you send us, and our replies.

5 · What we collect from a dealer

5.1 Entity and registration data. Registered legal name, commercial registration number, tax registration number, registered address, and the declarations you make at onboarding.

5.2 Representative data. The name, capacity, email address and mobile number of the person who accepts our terms on the entity's behalf, and the acceptance record described at 4.5.

5.3 Screening data. The results of the sanctions, politically exposed person and adverse media screening we are required to carry out, and any identity document supporting it.

5.4 Settlement data. Bank account details for payout, and the payout history.

6 · Where it comes from

6.1 Mostly from you.

6.2 Some of it comes from our payment provider, our carriers, our authentication centres and our screening providers, in each case about transactions you are part of.

7 · Why we use it, and on what basis

What we do · Why · Basis

Create and run your account · To let you use the marketplace · Performance of a contract

Process and fulfil an order · To get the watch to you · Performance of a contract

Share your name and delivery address with the seller, the authentication centres and the carrier · They cannot deliver without it · Performance of a contract

Issue the sale document or tax invoice · We are required to · Legal obligation

Confirm your country of residence and keep the evidence · The tax treatment of the sale depends on it · Legal obligation

Screen dealers and transactions · Anti money laundering and sanctions rules · Legal obligation

Detect and investigate fraud and chargebacks · To protect buyers, dealers and ourselves · Legitimate interest

Keep acceptance records · To be able to prove what was agreed and when · Legal obligation and legitimate interest

Handle a return or a dispute · To resolve it · Performance of a contract

Send marketing · Only if you ask for it · Consent, withdrawable at any time

7.2 On the identity document at 4.4. We keep it for the period the Saudi tax rules require and no longer. We do not use it for any other purpose, we do not share it with the seller, and we do not use it to profile you.

7.3 We do not sell personal data. We do not share it with anyone for their own marketing.

7.4 We do not make decisions about you by automated means alone that produce a legal effect. Our fraud checks can flag an order, but a person decides what happens to it.

8 · Where your data goes

8.1 Personal data leaves the Kingdom on every order. This is structural, not occasional, and we would rather say so plainly than bury it.

Who · Where · What they get · Why

The seller · Kingdom, Gulf, United States or elsewhere · Your name and delivery address · He is the seller and the shipment originates with him

Authentication centre · New York · Your name, the order reference and the delivery address · Every watch is authenticated before it reaches you

Inspection centre · Jeddah or New York · The same, on a return · A returned watch is inspected at the centre nearest you, Jeddah if you are in the Gulf and New York if you are in the United States

Carrier · Global · Name, delivery address, mobile number, and the customs declaration · Delivery and customs clearance

Payment provider · Kingdom · Payment data · Taking the payment

AllChrono LLC · United States · Order, settlement and dealer data · Group settlement and support

AllChrono, Inc. · United States · Aggregated and, where necessary, individual records · Group management

Tax, customs and regulatory authorities · Kingdom and destination · Whatever the rule requires · Legal obligation

Professional advisers · Kingdom, United States · Only what the matter needs · Legitimate interest

8.2 We transfer personal data outside the Kingdom only where the Personal Data Protection Law permits it, and we put the safeguards it requires in place with each recipient. Part B of this file is the instrument we use for that.

8.3 We never transfer more than the recipient needs. A seller gets a name and an address. He does not get your identity document, your payment data or your purchase history.

8.4 The basis on which each transfer is made. Where the transfer is to the seller, the authentication centre, the inspection centre, the carrier or the payment provider, it is necessary to perform the contract you entered into with us and cannot be avoided without the order failing. Where the transfer is to AllChrono LLC or to AllChrono, Inc., it rests on the safeguards in Part B of this file, which binds each recipient to the standard this policy sets. Where the transfer is to a tax, customs or regulatory authority, it rests on the legal obligation that compels it.

8.5 A transfer impact assessment is completed before launch and reviewed annually. It covers each recurring route out of the Kingdom, what is sent, to whom, under what instrument, and what happens if that instrument fails. It is held with the record at clause 11.4 and is produced to the Saudi Data and Artificial Intelligence Authority on request.

8.6 Onward transfer. No recipient in the table at clause 8.1 may pass your personal data to anyone else except where Part B permits it, and no recipient may use it for its own purposes. A carrier may pass a customs declaration to a customs authority, because that is what a customs declaration is for.

9 · How long we keep it

What · How long · Why that long

Acceptance records · Not less than ten years · They are the evidence that a contract exists

Order, invoice and tax records · As the Saudi tax rules require · Legal obligation

Residence and identity evidence · As the Saudi tax rules require · Legal obligation

Anti money laundering and screening records · Ten years from the end of the relationship · Legal obligation

Account data · While your account is open, then one year · So you can come back

Technical and fraud data · Thirteen months · Covers a full chargeback cycle

Marketing consent · Until you withdraw it, then a record that you did · Evidence of consent and of its withdrawal

9.2 When a period ends we delete the data or anonymise it so it can no longer identify anyone.

10 · Your rights

10.1 You can ask us to tell you what we hold about you, to give you a copy, to correct it, to destroy it, or to stop using it for a particular purpose. You can withdraw consent to marketing at any time.

10.2 We answer within thirty days. If we cannot do what you ask, we tell you why.

10.3 Some things we cannot delete on request, because a tax, customs or anti money laundering rule requires us to keep them. Where that applies we tell you which record it is and for how long.

11 · Keeping it safe

11.1 Data is encrypted in transit and at rest. Access is limited to people who need it for their job and is logged.

11.2 Payment card details never touch our systems.

11.3 We review access, retention and security at least annually.

11.4 We keep a record of processing activities, covering each purpose, the categories of data and of individual, who receives it, how long it is kept, which transfers leave the Kingdom and under what instrument. It is maintained by the data protection officer and produced to the Saudi Data and Artificial Intelligence Authority on request.

12 · If something goes wrong

12.1 If personal data is lost, disclosed or accessed without authority, we notify the Saudi Data and Artificial Intelligence Authority within seventy two hours of becoming aware of it.

12.2 Where the breach is likely to cause you serious harm, we tell you directly and without undue delay, in plain language, and we say what we are doing about it.

12.3 We keep a register of every incident, including those we decide are not notifiable, and why.

13 · Children

13.1 The marketplace is not for anyone under eighteen. We do not knowingly collect their data, and we delete it if we find it.

14 · Changes

14.1 We publish a version number and a date. Where a change materially affects you we tell you before it takes effect.

14.2 The version that applied to your order is the version in force when you placed it. We keep every version.

15 · If you are in the United States

15.1 This clause is for you in addition to everything above, not instead of it. Where it gives you more than a clause above, it governs.

15.2 We do not sell your personal information and we do not share it for cross context behavioural advertising. We have never done so and this policy would have to change before we could.

15.3 What we collect about you falls into these categories: identifiers, which means your name, email address, postal address and phone number; commercial information, which means what you bought and what you returned; financial information, which means the fact and amount of a payment, never the card itself; government identifiers, which means the identity document described at clause 4.4 and only where the tax rules require it; internet activity, which means how you used the site; and inferences we draw for fraud screening.

15.4 Where it comes from, why we use it and who gets it are at clauses 6, 7 and 8. How long we keep it is at clause 9.

15.5 Your rights. You may ask us what we hold, ask for a copy in a portable form, ask us to correct it, ask us to delete it, and ask us to limit how we use sensitive information. We will not treat you differently for asking, and nothing about the price you pay or the service you get changes because you exercised a right.

15.6 How to ask. Write to the address at clause 2.3. We confirm within ten business days that we have your request and answer it within forty five days, and we tell you if we need longer.

15.7 If you ask through someone else, we will ask for proof that you authorised them.

15.8 Your personal information leaves the United States. Clause 8 sets out where it goes and why. In particular, where the order is routed through the Kingdom your data is handled there under Saudi law.