Last updated: September 14, 2026
This Privacy Policy explains how Public Trans Company (‘the Company’, ‘we’, ‘us’, or ‘our’) collects, uses, shares, stores, and protects personal data when employees and other authorized users access the Employee Portal and Self-Service Application (“the Portal”).
We process personal data in accordance with the Saudi Personal Data Protection Law (“PDPL”), its Implementing Regulations, and other applicable Saudi laws and cybersecurity requirements.
We may process personal data necessary to provide and secure the Portal, including identification, contact, employment, authentication, transaction, service-request, device, and usage information. In connection with certain employee services (e.g., sick leave, medical reimbursements), the Portal may also process health data, classified as sensitive data under the PDPL. This data is processed only to the extent necessary, based on the employment relationship and applicable legal obligations, with restricted access limited to authorized HR/medical personnel.
We may collect personal data directly from you, from authorized organizational systems and personnel, and from approved service providers or external authorities where permitted or required by law.
We use personal data to operate and secure the Portal, provide employee services, process requests, manage access, comply with legal obligations, and improve organizational services.
Processing is based on the employment or contractual relationship, legal obligations, requested employee services, legitimate interests permitted under the PDPL, or consent where legally required.
Providing information required for authentication or an employee service is mandatory. Without it, you may be unable to access the Portal or complete the requested transaction.
The Portal may use essential cookies or similar technologies to maintain your session, protect the Portal, remember language preferences, and support security and performance.
Disabling essential cookies may prevent the Portal from working correctly. Any future non-essential cookies will be subject to applicable notice and choice requirements.
Personal data may be shared, where necessary, with:
We do not sell or rent employee personal data. Service providers must follow contractual confidentiality, security, and data-protection requirements.
Health data is shared only with authorized HR/medical personnel or service providers strictly involved in the relevant service, and is not disclosed to your manager beyond what is necessary for approval workflows. Providers processing health data are subject to additional confidentiality obligations.
Where personal data must be transferred or accessed outside Saudi Arabia, the transfer will be performed only in accordance with the PDPL, the Regulation on Personal Data Transfer outside the Kingdom, and applicable safeguards.
We retain personal data only for as long as necessary for employment administration, Portal operation, legal compliance, security, audit, disputes, and record-keeping.
Retention periods are determined by the purpose of processing, the employment relationship, applicable laws, and the Organization’s approved retention schedule.
When data is no longer required, it will be securely destroyed or anonymized unless continued retention is legally required.
We apply appropriate organizational and technical measures to protect personal data. Users must keep their login credentials secure and report any suspected unauthorized access. Including access controls, encryption where appropriate, and monitoring. In the event of a personal data breach posing risk to affected individuals, the Company will notify SDAIA and affected individuals in accordance with the PDPL and its timelines.
Subject to applicable law, you may request access to, a copy of, correction of, or destruction of your personal data and may withdraw consent where applicable. To exercise these rights, contact compliance@ptco.com.sa. Subject to applicable law, you may:
You may also file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe your data has been processed in violation of applicable law.
We may update this Privacy Policy when the Portal, integrated systems, processing activities, or applicable laws change. Updates will be published in the Portal with a revised “Last updated” date.
Organization: Public Trans Company
Privacy Contact: Compliance Department
Email: compliance@ptco.com.sa