Privacy Policy
What personal data we collect, why we hold it, who we share it with, and the rights you have over it.
Last updated: 6 September 2026
1. Who we are
Crossworld Freighters Establishment, trading as Crossworld Freighters, is the controller of the personal data described in this policy. We are registered in the Kingdom of Saudi Arabia under Commercial Registration number 4030408844, with our registered office at 6931 Al Madinah Al Munawarah Branch Rd, Mishrifah District 2485, Jeddah 23232.
We are a freight forwarder. We arrange the movement, clearance, transport and storage of cargo internationally, which necessarily involves sharing certain information across borders.
For any question about this policy or about your personal data, contact ops@crossworld-freighters.com.
2. Which law applies
Our processing is governed principally by the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, overseen by the Saudi Data & AI Authority (SDAIA).
Where we handle the personal data of individuals in the United Kingdom or the European Economic Area — for example a UK-based consignee or a contact at a UK customer — the UK GDPR or EU GDPR may also apply to that processing. Where two regimes apply, we follow the stricter requirement.
Crossworld Freighters Ltd (company number 13059049), registered at 483 Green Lanes, London N13 4BS, United Kingdom, is part of the same group. Where that company acts as controller for UK-contracted business, this policy applies to that processing as well.
3. What we collect
Almost all the personal data we hold is business contact information and shipment documentation. We do not seek sensitive personal data, and ask that you do not send it to us unless it is genuinely required for a shipment.
| Category | Examples |
|---|---|
| Contact details | Name, job title, company, email address, telephone number |
| Enquiry details | Origin, destination, cargo description, weights and volumes, target dates, and anything else you put in our quote form or an email |
| Shipment records | Bills of lading, air waybills, packing lists, commercial invoices, certificates of origin, delivery receipts and proof of delivery — these often name individuals such as shippers, consignees and drivers |
| Customs and compliance data | Importer and exporter identifiers, tariff classifications, declared values, licence details, and the results of sanctions and denied-party screening |
| Correspondence | Emails, messages and call notes recording instructions and agreements |
| Payment details | Billing contact, invoice and remittance information. We do not store card numbers. |
| Recruitment data | Where you apply for a role: the details in our careers form and whatever your CV contains. See section 11. |
| Website data | See section 10 |
We collect this from you directly, from your colleagues, and sometimes from third parties involved in a shipment — for example a carrier, an overseas agent, or a customs authority.
4. Why we process it
- To respond to enquiries and prepare quotations.
- To arrange, book, document and monitor the movement of cargo.
- To make customs declarations and meet border formalities.
- To carry out sanctions, export-control and denied-party screening.
- To invoice, collect payment and keep accounting records.
- To handle claims, disputes and insurance matters.
- To meet our legal, tax and regulatory obligations.
- To maintain the security and integrity of our systems.
5. Lawful basis
Under UK/EU GDPR, we rely on:
- Performance of a contract — to provide the services you have asked for, or to take steps before entering a contract, such as quoting.
- Legal obligation — customs, tax, sanctions and accounting record-keeping.
- Legitimate interests — responding to enquiries, administering and securing our business, pursuing claims and recovering debts, balanced against your rights and freedoms.
- Consent — where we send marketing to an individual who has opted in. You may withdraw consent at any time.
Under the Saudi PDPL, we process on the equivalent bases: performance of a contract to which you are party, compliance with a legal obligation, the legitimate interests of the Company where these do not prejudice your rights, and consent where required.
6. Who we share it with
Freight cannot move without sharing information. We disclose the minimum necessary to:
- Carriers and operators — shipping lines, airlines, hauliers, terminals and warehouses.
- Our agents and affiliates — Crossworld entities and vetted agent partners in the UAE, Sri Lanka, the United Kingdom and destination markets.
- Customs and government authorities — including the Zakat, Tax and Customs Authority (ZATCA) in Saudi Arabia, via the FASAH platform, and the equivalent authorities elsewhere.
- World Shipping Alliance partners — where your shipment routes through a member of that network.
- Professional advisers and insurers — accountants, auditors, lawyers, and cargo or liability insurers where a claim arises.
- Service providers — including our website host and the provider that delivers our online enquiry form to us.
We do not sell personal data, and we do not share it for third-party advertising.
7. International transfers
Cross-border transfer is inherent to freight forwarding: cargo data must reach the origin, transit and destination countries. Your data will therefore be transferred between Saudi Arabia, the UAE, Sri Lanka, the United Kingdom, and any other country a shipment touches.
Where the PDPL applies, transfers outside the Kingdom are made in accordance with the conditions for transfer set out in the PDPL and its Implementing Regulations. Where UK or EU GDPR applies, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses.
8. How long we keep it
| Record | Retention |
|---|---|
| Customs declarations and supporting documents | At least 6 years, or longer where the customs authority in the relevant jurisdiction requires it |
| Accounting, invoicing and tax records | At least 10 years, in line with Saudi tax and commercial record-keeping requirements |
| Shipment files and correspondence | 6 years from completion of the shipment, aligned to claim limitation periods |
| Processing records and security logs | 5 years after the relevant processing ends, as required under the PDPL Implementing Regulations |
| Enquiries that do not become bookings | 24 months from last contact |
| Unsuccessful job applications | 12 months from the date you applied, unless you ask us to delete them sooner |
| Marketing consents and opt-outs | For as long as needed to honour your preference |
Where a claim, audit or investigation is open, we keep the relevant records until it is resolved. [ Confirm these periods match your accountant's and customs broker's advice before publishing. ]
9. Your rights
Subject to the law that applies to you and to the exemptions it allows, you may:
- ask what personal data we hold about you, and receive a copy;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete data we no longer have a lawful reason to keep;
- ask us to restrict how we use it while a concern is resolved;
- object to processing we carry out on the basis of legitimate interests;
- ask for your data in a portable form, where that right applies;
- withdraw consent at any time, where consent is the basis we rely on.
To exercise any of these, email ops@crossworld-freighters.com. We may need to verify your identity. We will respond within the period set by the applicable law, and in any event within 30 days.
Some data we cannot delete on request — customs and accounting records must be retained by law for the periods in section 8.
10. Cookies and this website
This website does not use advertising cookies, analytics cookies or tracking pixels. We do not profile visitors.
Our host, Cloudflare, processes technical information such as IP address and request headers in order to serve the site, provide encryption and protect against attack. Cloudflare may set a strictly necessary cookie for security purposes.
When you submit the enquiry form, it is delivered to us through a third-party form provider that passes the contents to our mailbox.
[ If analytics, a chat widget, advertising pixels or embedded video are added later, list them here and add a consent banner. ]
11. Recruitment
If you apply to us through our careers page, or send us a speculative CV, we process the details you give us in order to consider you for a role.
That normally means your name, contact details, location, the area and level of work you are interested in, and whatever your CV contains — employment history, qualifications and references. We rely on your consent, given when you submit the form, and on our legitimate interest in recruiting.
We ask candidates not to send us passport, iqama or national ID copies, bank details or medical information at application stage. If you send them anyway we will delete them and ask you to resend without. We collect what is legally required for employment and visa purposes only if we make you an offer.
Applications are read by the Crossworld Freighters management team and are not shared outside the group or sold to recruiters. We keep unsuccessful applications for 12 months so we can consider you for a role that opens later. You can ask us to delete your application at any time by emailing ops@crossworld-freighters.com, and we will do so.
12. Marketing
We may send service updates relating to shipments you have booked; these are not marketing and you cannot opt out of them while a shipment is live.
We will only send commercial or promotional messages to an individual where that person has opted in, or where permitted by law in a business-to-business context. Every such message includes a way to unsubscribe, and you can opt out at any time by emailing us.
13. Security
We apply organisational and technical measures appropriate to the risk, including access controls, encrypted transmission of documents, encryption of our website in transit, and restricting access to shipment files to the staff and agents who need them.
No system is perfectly secure, and email in particular is not a secure channel. Please do not send us identity documents, bank details or other sensitive material by unencrypted email unless we have asked you to.
14. Data breaches
If a personal data breach occurs that poses a risk of harm, we will notify SDAIA within 72 hours of becoming aware of it, as the PDPL requires, and will notify affected individuals without undue delay where the risk to them is high. Where UK or EU GDPR applies, we will also notify the relevant supervisory authority within 72 hours.
15. Children
Our services are business-to-business. This website is not directed at children and we do not knowingly collect personal data from anyone under 18.
16. Complaints
Please raise any concern with us first at ops@crossworld-freighters.com — we would rather put something right than have you go elsewhere.
You also have the right to complain to a regulator:
- Saudi Arabia — the Saudi Data & AI Authority (SDAIA), via the National Data Governance Platform.
- United Kingdom — the Information Commissioner's Office (ico.org.uk).
17. Changes
We may update this policy as our services or the law change. The date at the top shows when it last changed. Material changes will be highlighted on this page.
18. Contact
Crossworld Freighters
6931 Al Madinah Al Munawarah Branch Rd, Mishrifah District 2485, Jeddah 23232
Kingdom of Saudi Arabia
ops@crossworld-freighters.com · +966 53 185 3019