Article One
The terms and expressions mentioned in these Regulations shall have the meanings indicated to each of them in Article 1 of the Electronic Commerce Law, issued by Royal Decree No. (M / 126) dated 7/11/1440 AH.
Article Two
The activity of the Service Provider shall be of an economic nature if it is continually done for the generation of profit, and the provisions of the Law and the Regulations shall apply to this activity.
Article Three
1. The place of business of the Practitioner (natural person) is the place that is determined in the Electronic Shop, or in the authentication certificate issued by the E-Shops Authentication Entity.
2. If the Practitioner (natural person) within the Kingdom does not have a place of business, then his place of business shall be his place of residence, in accordance with the registered National Address.
3. The place of business in which the Practitioner is practicing shall be appropriate to the nature of the activity and the scope of work undertaken in the place of business, and the exercise of the activity therein shall not prejudice public tranquility.
Article Four
1. The Consumer may correct an error in Electronic Communications if the Consumer notifies the Service Provider of the error within (24) hours of the time the Electronic Communication is sent.
2. The Service Provider shall comply with the correction of the error notified in accordance with paragraph (1) of this Article, unless the Consumer has benefited from the Service Provider's product or service, or otherwise derived utility from them.
3. The Service Provider may correct unintended errors in Electronic Communications sent to the Consumer, provided that this ability to correct errors is stipulated in the contract with the Consumer, and provided that the Consumer is notified of the error as soon as the Service Provider becomes aware of it, and before the product is shipped or service is commenced. The consumer has the option in this case to either continue to implement the contract with the Service Provider after the correction of the Electronic Communication, or to terminate the contract and recover the cost incurred for the product or service, and other costs resulting from this error.
Article Five
1. Any Data - whatever its source or form – that leads to specific knowledge of the Consumer’s identity, including: names, identity information, addresses, contact numbers, license numbers, records and personal property, account and bank card numbers, and still and moving pictures, is considered protected Personal Consumer Data.
2. The Service Provider shall comply with the following:
a. Protection of Personal Consumer Data from access, disclosure, alteration or processing for non-legitimate purposes, by applying technical and administrative measures commensurate with the nature of such Data.
b. Personal Consumer Data shall not be retained except for the purpose of fulfilling the obligations of the Service Provider, and shall not be used for any other purpose, such as advertising or marketing, without the express prior consent of the Consumer.
c. If the Personal Consumer Data is breached, the Service Provider must notify the Ministry - according to the mechanism determined by the Ministry - and the Consumer, within (3) days from the date of the Service Provider’s knowledge of the breach, with an explanation of the scope of the breach and its effects, and the measures taken to address it. The notice shall not exempt the Service Provider from liability towards the Consumer, and the Service Provider must comply with what is issued by the competent authorities in this regard.
3. If the Consumer’s relationship with the Electronic Shop is continuous and requires the establishment of an account to facilitate future contracts, the Service Provider may, after obtaining the consent of the Consumer, retain Personal Consumer Data until the Consumer requests the closure of this account, and the Service Provider shall allow for the closure of the account in a clear and easy fashion.
Article Six
1. Subject to the provisions of Article 6 of the Law, the Service Provider shall disclose in the Electronic Shop the following Data:
a. The Electronic Shop’s Privacy Policy (if any), including measures to protect Personal Consumer Data, and the scope of dealing with user profiles.
b. Procedures and methods used to receive and resolve Consumer complaints.
c. The Service Provider’s tax number (if any).
2. The Service Provider shall provide access to the Data contained in Article 6 of the Law and paragraph (1) of this Article by providing a link to it in the Electronic Shop, with an explanation of any subsequent amendment to the Data.
Article Seven
1. Subject to the provisions of Article 7 of the Law, the Service Provider shall include the following in the statement given to the Consumer clarifying the terms and conditions of the contract to be concluded :
a. Reference to the right to terminate the contract in accordance with paragraph (1) of Article 13 of the Law where termination is permissible, and the costs incurred by the Consumer in the exercise of this right, the steps the Consumer should take if he wishes to exercise the right to terminate the contract, or reference that the Consumer is not entitled to terminate the contract due to the applicability of paragraph (2) of Article 13 of the Law or Article 11 of the Regulations.
b. Details of the price to be paid, such as the original price, delivery costs, and taxes (if any) in addition to any other costs that may be incurred in the future, along with an indication of how they are calculated and their terms of entitlement.
c. After-sales services (if any) and conditions for the provision of these services.
d. The duration of the contract and its expiry date, if applicable.
e. Payment terms, recurring payments (if any), and shipping and delivery provisions if so required.
2. The Service Provider shall clarify to the Consumer the procedure for concluding the contract by stating in the field designated for payment that once this field has been clicked, the contract shall be concluded, and that the contract shall entail the obligation to pay, in a clear and easy fashion.
Article Eight
Subject to the provisions of Article 8 of the Law, the Service Provider shall submit to the Consumer after concluding the contract a downloadable receipt which includes the following Data:
a. The name of the Service Provider if the Service Provider is a Practitioner, or the trade name of the Service Provider if the Service Provider is a Trader, and a description of the product or service subject to the contract.
b. Confirmation of the contract and the date of its execution.
c. The total price of the product or service, and the value of taxes (if any) clarifying the details of the price, how it is calculated and the conditions of claiming it.
d. Shipping, transportation and delivery charges (if any).
e. The Service Provider’s tax number (if any).
f. The delivery date of the product or service.
g. The name of the carrier delivering the product, and delivery route tracking data (if any).
h. A summary of the replacement and refund provisions in cases where this is permissible (if applicable).
i. The method of payment, and confirmation of full payment if it has been made.
Article Nine
1. Subject to the provisions of Article 9 of the Law, a Service Provider practicing a profession subject to special regulation and requiring a license or permit to practice shall be obliged to disclose the license or permit number, its expiry date and the granting authority in the Electronic Shop.
2. The provisions of these Regulations are without prejudice to the provisions in force in the Kingdom in relation to the professional activity of the Service Provider.
Article Ten
1. Subject to the provisions of Article 10 of the Law, the Electronic Advertisement, when published or sent, shall include the following:
a. A clear statement that it is an advertisement.
b. Information related to the product or service that allows the Consumer to make an informed and conscious decision.
2. The Service Provider shall provide the Consumer with a means to request the cessation of the transmission of electronic advertisements, and the Service Provider shall cease sending electronic advertisements to the Consumer upon receipt of this request.
3. The Service Provider must comply with the provisions of the laws and regulations related to advertisements, and obtain the required licenses in accordance with the nature of the product or service.
Article 11
Subject to the provisions of paragraph (2) of Article 13 of the Law, the Consumer shall not be entitled to terminate the contract in the following cases, unless otherwise agreed:
a. If the subject of the contract is a product liable to deteriorate within the period of permissibility of the contract termination.
b. If the subject of the contract is a product that cannot be resold for health reasons.
c. If the subject of the contract is a product containing several elements that have been merged and cannot be returned to its original condition.
d. If the subject of the contract is a hotel reservation service, travel ticket, vehicle rental, transportation or event management service.
e. If the subject of the contract is a product designed and produced specifically for the Consumer according to the specifications of the Consumer’s request.
f. If the contract is concluded at a public auction.
g. If the subject of the contract is a product or service for which the price may be subject to change during the period in which the contract may be terminated, depending on a market characterized by continuous price volatility outside the control of the Service Provider, such as gold and silver.
Article 12
1. The Trader must register the main Electronic Shop in the commercial register within (30) days from the date of its establishment.
2. The application for registration on the Ministry's website shall include:
a. The name of the applicant.
b. The commercial registration number.
c. The activities to be carried out through the electronic shop.
d. A description of the main Electronic Shop and its address.
3. If the Practitioner wishes to register the Electronic Shop in the commercial register in order to become a Trader, the following information must be included in the application:
a. The Practitioner’s name and ID number.
b. The Practitioner’s residential address, phone number, and e-mail address.
c. The activities that will be practiced through the Electronic Shop.
d. A description of the main Electronic Shop in which the Practitioner operates, and its address.
4. The Trader shall notify the competent department of any change in the Data contained in the registration application, within (30) days of the change, by filling in the form prepared for that purpose on the Ministry’s website.
5. Without prejudice to the provisions of the Law of Commercial Register, the registration of the Electronic Shop in the Commercial Register shall be canceled if the Trader wishes to stop practicing the e-commerce activity.
Article 13
1. The Ministry shall establish a website for the authentication of Electronic Shops, to which the licensed authentication bodies shall be linked in accordance with Article 14 of the Regulations.
2. The Ministry shall supervise the work of the licensed authentication bodies linked to the Ministry's website to verify the extent of its compliance with the provisions of the Law and Regulations. The competent department shall respond to any violations of the provisions of the law and regulations that may occur from the Authentication Entities.
Article 14
1. In order for E-Shops Authentication Entities to be licensed, the applicant must be a company in accordance with the provisions of the Companies Law, and the license application shall be submitted in accordance with the form prepared for that purpose, in addition to the following:
a. Certificate of registration of the company in the commercial register.
b. Proof of the company's technical and administrative ability to provide the service.
c. Description of the services the company intends to provide.
d. Methodology for the authentication of Electronic Shops.
e. Technical and administrative measures and regulations applied for the purpose of data preservation and protection.
f. Data handling policy in case the service is discontinued for any reason.
g. Policy for handling and resolving complaints of Service Providers and Consumers.
h. Undertaking to provide the authenticated Electronic Shop’s Data immediately through the Ministry's website.
i. Details of the liaison officer responsible for supplying the Data.
j. Any additional information or documents requested by the Ministry.
2. After the Authentication Entity obtains the license, the Ministry shall allow it to be linked to the authentication site. The Ministry may exempt internationally accredited Authentication Entities from the provisions of paragraph (1) of this Article and allow them to be linked to the authentication site.
Article 15
1. The licensed E-Shop Authentication entity shall specify the Data necessary for authentication, provided that the following Data is provided:
a. The name, address and means of communication of the Service Provider, and an indication of whether it is a Trader or Practitioner, a Saudi or a non-Saudi.
b. The identity information of the Practitioner, or the Trader's Commercial Registration.
c. Names of the authorized signatories of the Service Provider if the Service Provider is a legal person, and names of those who manage it.
d. The platform through which the Service Provider conducts e-commerce activities.
e. Licenses issued by the competent authorities (if any).
2. The E-Shop Authentication Entity shall issue a statement of authentication to the applicant and publish it on its website
Article 16
Authenticated Service Providers shall:
1. Publish the statement of authentication clearly in the Service Provider’s Electronic Shop.
2. Notify the Authentication Entity of any change to the authenticated Data under Article 15 within (30) days from the date of the change.
Article 17
E-Shop Authentication Entities linked to the Ministry's website shall:
a. Implement institutional and administrative measures to store, preserve, protect and retrieve data, taking into account potential risks.
b. Provide qualified and trained staff to provide authentication services in accordance with the provisions of the Law and Regulations.
c. Publish the terms, conditions and procedures of providing the authentication service in the Electronic Shop.
d. Publish the Authentication Entity’s policy for handling complaints from applicants seeking authentication and Consumers on its Electronic Shop.
e. If the Authentication Entity’s Data is breached, the Authentication Entity must notify the Ministry - according to the mechanism determined by the Ministry - and the affected Electronic Shops within (3) days from the date of the Authentication Entity’s knowledge of the breach, clarifying the scope and effects of the breach and the measures taken to address it. The notice shall not exempt the Authentication Entity from its liability towards the beneficiaries of its services, and the Authentication Entity must comply with what is issued by the competent authorities in this regard.
f. Make data and records available to the Ministry upon request.
g. Comply with the provisions of the Laws and Regulations related to data protection issued by the competent authorities.
Article 18
1. An electronic platform that acts as an intermediary between the Service Provider and the Consumer is any website or application that provides services for the facilitation of e-commerce transactions, such as online advertisement services or the promotion of products or services, or enabling the acceptance of orders or payment, or any other service that facilitates the practice of e-commerce.
2. The intermediary platform shall:
a. Publish clearly in the platform the terms and conditions of using the platform, the rights and obligations of its users, the methods of storing personal data and restrictions to its use, the policy used for handling complaints from Service Providers and Consumers, and the policy of settling disputes between Service Providers and Consumers.
b. Publish any material modification to the services provided in its electronic shop and notify registered users at least (1) week before the implementation of the modification.
c. Disclose required platform Data in accordance with Article 6 of the Law and the Regulations.
d. Request the Service Provider’s Data on the platform, contact information, documentation of authentication (if any), and certificate of registration in the Commercial Register (if any), store this Data in a manner that ensures its preservation and protection in order for it to be accessed when needed, update the Data periodically, and submit the Data to the Ministry if requested.
e. Delete any content that violates the provisions of the Law, Regulations, and terms and conditions of using the platform.
f. Enhance the cyber security of the platform, adhere to what the competent authorities issue in this regard, and ensure rapid handling of any incident or breach of the platform to ensure its return to its usual functionality as soon as possible, without prejudice to the cyber security of the platform.
g. Notify the Ministry if the platform is breached - according to the mechanism determined by the Ministry - and those affected by this breach within (3) days from the date of the platform’s knowledge of the breach, clarifying the scope and effects of the breach, and the measures taken to remedy it. The notice shall not exempt the platform from liability to the beneficiaries of its services, and the platform must adhere to what is issued by the competent authorities in this regard.
h. Maintain adequate data on contracts concluded by the platform, and store them in a manner that ensures their safety, to be accessed when needed for a period not less than (3) years from the date of concluding the contract, subject to the provision of Article 5 of these Regulations, unless another law stipulates a longer duration.
Article 19
The application of the provisions of the Law and the Regulations shall not prejudice the competences prescribed for other authorities in regulation, monitoring and supervision in accordance with the relevant laws, regulations and decisions.
Article 20
These Regulations shall come into force from the date of their publication in the Official Gazette.