Privacy Policy
Effective 11 June 2026 · Last updated 11 June 2026
This Privacy Policy explains how Y LOT collects, uses, shares, and protects personal data when you visit ylot.net or contact us. We handle personal data in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.
01 Who we are
The data controller responsible for your personal data is:
- Legal entity
- شركة محصول اليمن لتجارة الأغذية — Mahsool Al-Yemen Food Trading Company, operating as “Y LOT”
- Commercial Registration
- 4030584415
- Unified number
- 7039350405
- Registered address
- Building 7180, Abdulrahman bin Ahmed Al-Sudairi, Jeddah 23436, Kingdom of Saudi Arabia
- sales@ylot.net
- +966 592 264 224
In this policy, “Y LOT”, “we”, “us”, and “our” refer to the entity above.
02 Scope
This policy covers personal data we collect through ylot.net and through direct business communication with us by email or WhatsApp. Y LOT is a business-to-business supplier of green coffee. Our services are intended for businesses, not consumers, and are not directed at children.
03 What personal data we collect
Information you give us
- Sample requests. When you complete our Request Samples form, we collect: your full name, company or roastery name, your role, email, phone/WhatsApp number, country, business website (optional), years in business (optional), annual green coffee volume, how you heard about us (optional), the lots you select, your preferred sample format, and any notes you add.
- Harvest list. If you join our harvest list, we collect your email address.
- Direct contact. If you email or message us, we collect whatever information you choose to include.
- Arranging delivery. If you qualify for samples or place an order, we collect the shipping address and contact details needed for delivery. This is usually arranged by email or WhatsApp, not through the website.
Information collected automatically
When you visit ylot.net, our hosting, security, and analytics providers may collect technical data such as your IP address, device and browser type, the pages you view, the site that referred you, and similar usage data. This is collected through cookies and similar technologies — see section 05.
04 How we use your data and our legal basis
We use personal data only for clear, stated purposes, and we collect only what we need for them:
| Purpose | Legal basis under the PDPL |
|---|---|
| Respond to your sample request or inquiry and send samples | Steps taken at your request; our legitimate interest in serving qualified buyers |
| Manage the buyer relationship — quotations, orders, support | Our dealings with you; legitimate interest |
| Send harvest-list emails about new lots and updates | Your consent (you opt in and can withdraw at any time) |
| Understand site traffic and improve the website | Legitimate interest; consent for analytics cookies |
| Keep tax, zakat, and commercial records | Compliance with a legal obligation |
| Protect the site and prevent misuse | Legitimate interest |
We do not use your data for purposes that are incompatible with the ones above without a new legal basis.
05 Cookies and analytics
We use cookies and similar technologies for the following purposes:
- Essential. Set by our content-delivery and security provider (Cloudflare) to deliver the site and protect it against abuse.
- Analytics. Google Analytics (GA4), to understand how visitors use the site.
- CRM / marketing. HubSpot tracking, to recognise returning visitors and link inquiries to our customer records.
You can refuse or delete cookies through your browser settings; essential cookies are required for the site to function correctly. Google Analytics and HubSpot involve transfers of data outside the Kingdom — see section 07.
06 Who we share your data with
We do not sell your personal data. We share it only with service providers who process it on our behalf, under agreements that require them to protect it and use it only for the services we engage them for:
- Hostinger — website hosting and business email.
- HubSpot — customer relationship management (CRM).
- Cloudflare — content delivery and website security.
- Google — website analytics (Google Analytics / GA4).
- Courier and logistics providers — to ship physical samples, using only the details needed for delivery.
We may also disclose personal data to government authorities, regulators, or professional advisors where the law requires it (for example, the Zakat, Tax and Customs Authority, or a competent court).
07 International data transfers
Y LOT is based in Saudi Arabia. Some of our service providers — including HubSpot and Google — store or process data outside the Kingdom, including in the United States, and we also serve buyers in the United States. Where personal data is transferred outside Saudi Arabia, we do so in line with the PDPL’s rules on cross-border transfers: we use providers that offer appropriate safeguards, and we limit transfers to what is necessary for the purposes described in this policy.
08 How long we keep your data
- Client and transaction records: kept for the duration of our relationship and for up to ten years after your last transaction, to meet Saudi tax, zakat, and commercial record-keeping requirements.
- Prospect and sample-request data that does not lead to an order: kept for up to 24 months from last contact, then deleted or anonymised.
- Harvest list: kept until you unsubscribe.
We stop keeping personal data once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it longer.
09 How we protect your data
We apply organisational and technical measures appropriate to the risk — including access controls, reputable service providers, and encryption of data in transit (HTTPS) — to protect personal data against loss, misuse, or unauthorised access. No system is completely secure, but we work to protect your data and review our measures as needed.
10 Personal data breaches
If a breach occurs that may harm your personal data, rights, or interests, we will notify the Saudi Data & Artificial Intelligence Authority (SDAIA) within the period required by law, and inform affected individuals where the law requires it.
11 Your rights
Under the PDPL, you have the right to:
- Be informed about how and why we process your data, and the legal basis for it.
- Access your data and request a copy in a readable format.
- Correct data that is inaccurate or incomplete.
- Request destruction of your data when it is no longer needed.
- Withdraw consent at any time — for example, by unsubscribing from the harvest list. Withdrawing consent does not affect processing already carried out.
12 Complaints
If you believe we have not handled your personal data properly, please contact us first at sales@ylot.net so we can put it right. You also have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).
13 Children
The site and our services are intended for businesses, not for children. We do not knowingly collect personal data from anyone under the age of 18.
14 Third-party links
Our site may link to third-party services such as Instagram and WhatsApp. We are not responsible for their privacy practices; please review their own policies before sharing data with them.
15 Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows the current version, and we will post material changes on this page.
16 Contact
For any question about this policy or your personal data:
Y LOT — Mahsool Al-Yemen Food Trading Company
Building 7180, Abdulrahman bin Ahmed Al-Sudairi, Jeddah 23436, Saudi Arabia
sales@ylot.net · +966 592 264 224