Last updated: 10 October 2026

Who we are

This website, www.kevu-group.com (the “Website”), is operated by Key Essential Vital Unit Medical Establishment (“KeVu”, “we”, “us” or “our”), a specialist supplier of surgical, sterilization, infection control and cleanroom products based in Riyadh, Kingdom of Saudi Arabia.

• Address: Al Jarifah Street, Jareer District, Riyadh 12837, Kingdom of Saudi Arabia.
• Commercial Registration No.: 7041228185.
• Email: [email protected].
• Mobile: +966 55 244 8092.

For the personal data described in this policy, KeVu is the “data controller” (the party that decides how and why personal data is used).

About this policy

This policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have. It applies to:

• visitors to our Website;
• people who contact us or request a quotation, sample or product trial;
• representatives of our customers and prospective customers, including government and private hospitals, day-surgery and aesthetic centers, pharmaceutical and medical device manufacturers, research and analytical laboratories, food and cosmetics production facilities, and medical distributors; and
• representatives of our manufacturers, suppliers and other business partners.

We handle personal data in line with the Saudi Personal Data Protection Law (issued by Royal Decree No. M/19) and its Implementing Regulations (the “PDPL”). Where the EU General Data Protection Regulation (Regulation (EU) 2016/679) or the UK GDPR applies to our processing (for example, if you contact us from the European Economic Area or the United Kingdom), we also follow those laws (together, the “GDPR”). Where this policy refers to a right or obligation under a specific law, it applies to you only where that law applies to your data.

Please do not send us patient or health data

Our Website and our business dealings are for professional purposes. Do not include patient information, medical records or any other personal health data in contact forms, emails or other messages to us. We do not need it to quote for or supply our products. If you send it to us by mistake, please tell us at [email protected] so that we can delete it.

The personal data we collect

Enquiry and contact details

Examples: Name, email address, phone number, organisation, sector, job title, and the content of your message.

How we get it: From you, through the Website contact form, email, phone or online meetings.

Customer and prospect relationship data

Examples: Name, job title, work email and phone, organisation, delivery and billing contacts, quotation and order history, supply agreement details, product specifications and consumption information, correspondence with clinical and procurement staff, and the names and roles of people involved in product trials, evaluation samples, staff training or stock and expiry monitoring.

How we get it: From you or your organisation, in the course of our business relationship.

Supplier and partner data

Examples: Name, job title, work contact details and correspondence of manufacturer, logistics and other business contacts.

How we get it: From you, your organisation or public business sources.

Compliance and documentation data

Examples: Contact names on regulatory registration, import, delivery and traceability records (for example batch and expiry documentation sent with shipments).

How we get it: From you and from our own operations.

Technical data

Examples: IP address, browser type and version, device type, operating system, pages visited, date and time of visits, and referring website.

How we get it: Automatically, through our web server and cookies or similar technologies.

Marketing preferences

Examples: Your choice to receive or not receive communications from us.

How we get it: From you.

We do not intentionally collect sensitive personal data (such as health, genetic, biometric, religious or political data) through the Website, and we do not ask for it.

Why we use your data, and our legal basis

We use personal data only where the law allows it. Each purpose below is followed by the legal basis we rely on.

• Responding to your enquiries and preparing quotations, specification reviews, samples and product trials. Legal basis: Steps taken at your request before entering a contract; our legitimate interest in running our business and answering business enquiries.
• Entering into and performing supply agreements: orders, delivery, invoicing, stock and expiry monitoring, staff training and technical support. Legal basis: Performance of a contract; our legitimate interest in managing our customer and supplier relationships.
• Meeting legal and regulatory duties, such as regulatory registration, batch traceability, tax, VAT and commercial record-keeping, and responding to authorities. Legal basis: Compliance with a legal obligation.
• Operating, securing and improving the Website, and preventing fraud and misuse. Legal basis: Our legitimate interest in a secure and working Website.
• Analytics and measuring how the Website is used, where we use non-essential cookies. Legal basis: Your consent.
• Sending news, product updates or marketing messages. Legal basis: Your consent, or our legitimate interest in business-to-business communication where the law allows it. You can opt out at any time.
• Establishing, exercising or defending legal claims. Legal basis: Our legitimate interest; compliance with a legal obligation.

Consent. Where we rely on your consent, you can withdraw it at any time by emailing [email protected] or, for cookies, by changing your cookie settings. Withdrawing consent does not affect processing carried out before you withdrew it.

Legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and interests. You can ask us for details of that assessment.

If you do not provide data that we need to deal with your request or perform a contract, we may not be able to respond or to supply you with products.

Who we share your data with

We do not sell your personal data. We share it only where needed and only with:

• Service providers that process data on our behalf and under our instructions, such as website hosting, IT support, email and form-handling services, and analytics tools;
• Manufacturers, logistics providers, customs and clearing agents, where we need to share delivery or contact details to fulfil an order;
• Professional advisers, such as lawyers, accountants and auditors;
• Authorities and regulators, such as the Saudi Food and Drug Authority, tax authorities and courts, where the law requires it or where it is needed to establish or defend legal claims; and
• A buyer or successor, if our business is sold or reorganised, who must continue to protect your data under this policy.

Our service providers must keep personal data secure and may use it only for our purposes.

Transfers of data outside your country

Some of our service providers, manufacturers and partners are located, or store data, outside Saudi Arabia and outside the European Economic Area. Where we transfer personal data abroad, we do so only as the applicable law permits. Depending on the case, this means relying on an adequacy decision or approval, standard contractual clauses or equivalent contractual safeguards, or another lawful mechanism, and taking steps to make sure your data stays protected. You can ask us for information about the safeguards we use by emailing [email protected].

Our Website is hosted [by (hosting provider name) in (country), to be confirmed].

How long we keep your data

We keep personal data only as long as needed for the purposes in this policy, and then delete or anonymise it. Our retention periods are:

• Enquiries that do not lead to a business relationship: [24 months] after our last contact with you.
• Customer, supplier and partner records, contracts and correspondence: For the duration of the relationship, plus the period required by applicable Saudi law for tax, VAT, commercial and regulatory record-keeping, or the limitation period for legal claims.
• Compliance and traceability records: For the period required by regulatory and legal obligations.
• Website server logs and technical data: [12 months].
• Marketing preferences and contact details used for marketing: Until you withdraw consent or opt out.
• Cookies: See the cookie section below.

How we protect your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure and alteration. These include encrypted (HTTPS) connections on our Website, access limited to staff who need the data for their work, and confidentiality obligations for staff and service providers. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to harm you, we will notify you and the competent authority as the law requires.

Your rights

Depending on the law that applies to you, you have the following rights over your personal data:

• Be informed about how we collect and use your data (this policy);
• Access your data and obtain a copy of it;
• Correct data that is inaccurate or incomplete;
• Erasure or destruction of your data, where it is no longer needed or the law allows it;
• Restrict our use of your data in certain situations (GDPR);
• Object to processing based on our legitimate interests, and to direct marketing at any time (GDPR);
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible (GDPR); and
• Withdraw your consent at any time, where we rely on it.

To exercise any right, email [email protected]. We may ask you to verify your identity first. We will reply within the period set by the law that applies, which is generally 30 days under the PDPL and one month under the GDPR. We do not normally charge a fee. If a request is clearly unfounded or excessive, or the law allows us to refuse it, we will explain why.

You also have rights relating to automated decision-making under the GDPR. We do not make decisions about you based solely on automated processing, and we do not carry out profiling that has legal or similarly significant effects.

Complaints

We would like the chance to resolve any concern first, so please contact us at [email protected]. You also have the right to complain to a data protection authority:

• In Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA); and.
• In the European Economic Area or the United Kingdom: the data protection authority in the country where you live, work or believe an infringement took place.

Cookies and similar technologies

Cookies are small text files stored on your device. We use the following types:

• Strictly necessary: Make the Website work, keep it secure, and remember your cookie choices. No consent is needed.
• Analytics [remove if not used]: Show us, in aggregate, how visitors use the Website so we can improve it. Consent is needed.
• Marketing [remove if not used]: Measure and improve advertising and show relevant content. Consent is needed.

When you first visit the Website, you can accept or reject non-essential cookies through our cookie banner, and you can change your choice at any time through the cookie settings link on the Website. You can also block or delete cookies in your browser settings, although parts of the Website may then not work properly.

Children

The Website is intended for business and professional users and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

Links to other websites

The Website may contain links to third-party websites, including those of our manufacturers or partners. We are not responsible for their privacy practices, so please read their privacy policies.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The “Last updated” date at the top shows when it was last revised. If we make a significant change, we will make it clear on the Website or contact you directly where the law requires.

Contact us

For any question about this policy or about how we handle your personal data, or to exercise your rights, contact:

Key Essential Vital Unit Medical Establishment (KeVu)
Al Jarifah Street, Jareer District
Riyadh 12837, Kingdom of Saudi Arabia
Email: [email protected]
Mobile: +966 55 244 8092