Gulf Cryo Holding Company and its subsidiaries
Effective date:
Gulf Cryo Holding Company, together with its regional subsidiaries and affiliates (collectively referred to as "Gulf Cryo", "we", "us", or "our"), manufactures and distributes industrial, medical, and specialty gases across 10 countries in the Middle East and North Africa. This notice sets out how Gulf Cryo collects, uses, stores, and shares personal data in connection with our website, contact and enquiry forms, customer and supplier relationships, and operational activities.
This notice applies to individuals who interact with Gulf Cryo through the website at gulfcryo.com (including the Contact Us form), as business contacts and procurement representatives of our customers, suppliers, and partners, visitors to our production and distribution facilities, and any other person whose personal data Gulf Cryo processes in the course of its operations.
Gulf Cryo processes personal data in compliance with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the Kingdom of Saudi Arabia’s Personal Data Protection Law (Royal Decree M/19 of 2021), Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK), and equivalent legislation in each country where we operate. Where our processing activities are subject to the European General Data Protection Regulation (GDPR) or UK GDPR, those regulations apply accordingly.
The data controller responsible for the personal data processed under this notice is:
Gulf Cryo L.L.C
First Floor, Arabian Industrial Gases Building
Dubai Investment Park 1, PO Box 473531
Dubai, United Arab Emirates
Email: infoUAE@gulfcryo.com
Tel: +971 4 809 0000
Where a specific subsidiary of Gulf Cryo is the primary operator of your contract or relationship (for example, Kuwait Industrial Gases Company, Gulf Cryo Saudi Arabia, or Gulf Cryo Med Gas), that entity may act as a co-controller or independent controller for the personal data processed in the context of that relationship. Where Gulf Cryo entities act as co-controllers, they have agreed respective responsibilities for compliance with data protection obligations, and the essence of that arrangement is available on request. Regardless of which entity acts as controller, you may exercise your rights by contacting Gulf Cryo using the details in Section 17, and your request will be directed to the relevant entity.
The Contact Us form at gulfcryo.com/contact allows individuals and organizations to submit gas supply enquiries, technical support requests, and partnership discussions to the relevant Gulf Cryo country team. The following table describes what data the form collects and why.
| Field | Purpose | Required |
|---|---|---|
| Full name | For addressing correspondence and identifying the enquiring individual | Yes |
| Email address | Primary channel for responding to the enquiry | Yes |
| Phone number | Secondary contact channel where required for follow-up | Yes |
| Country | Routes the enquiry to the relevant Gulf Cryo country team | Yes |
| Enquiry type | Categorizes the request (Industrial Gas, Medical Gas, Specialty Gas, Equipment, Other) | Yes |
| Message | Captures the substance of the enquiry or request | Yes |
When you submit the contact form, your enquiry is routed directly to the Gulf Cryo team responsible for the country you select. Enquiry data is used solely to respond to your request, assess your supply requirements, and initiate any follow-on commercial or technical discussion. It is not used for unsolicited marketing without your separate consent. Please do not submit special category or sensitive personal data through the contact form; Gulf Cryo does not knowingly collect such data through the website.
The legal basis for processing contact form submissions is legitimate interests: Gulf Cryo has a legitimate operational interest in receiving, assessing, and responding to gas supply and technical enquiries from businesses and individuals across the region. Gulf Cryo has assessed that this processing does not override the rights and freedoms of enquiring individuals, given the business-to-business nature of the enquiry and the limited scope of data collected.
Where an enquiry progresses to a contractual relationship, the legal basis shifts to contract performance.
Gulf Cryo collects personal data across several categories, depending on the nature of the interaction.
In the context of customer accounts, supply contracts, and ongoing commercial relationships: contact name, job title, business email address, phone number, billing and delivery addresses, and communication history relevant to supply, delivery, and account management. The associated organization name is also recorded for account management purposes.
Collected automatically when you access gulfcryo.com: IP address, browser type and version, device identifiers, pages visited, session duration, and referral source. This data supports website security, performance monitoring, and analytics, and is processed on the basis of Gulf Cryo’s legitimate interests in maintaining a secure and functional website (see Section 6).
Gulf Cryo operates production facilities, storage sites, distribution infrastructure, and industrial plants across the region. Where individuals visit, access, or work at a Gulf Cryo site, we may collect: name and identification details for access control, emergency contact information, health and safety induction records, vehicle registration details, and incident or near-miss report data. Where any such data constitutes sensitive or special category personal data, it is processed on the basis of legal obligation or the protection of vital interests.
This data is collected and processed to meet our safety obligations and regulatory requirements under applicable health and safety legislation in each operating country.
Gulf Cryo Med Gas (GCMG) supplies medical gases to hospitals, healthcare facilities, and pre-hospital services. In the context of medical gas supply, GCMG may process data relating to clinical contacts, hospital procurement and pharmacy personnel, and equipment installation and maintenance records. Where any such data constitutes sensitive or special category personal data under applicable law, it is processed on the basis of legal obligation or the provision of healthcare services and is handled under stricter controls appropriate to the healthcare sector.
Personal data relating to supplier and contractor representatives is collected through the supplier registration process and in the course of procurement activity. This includes: business contact details, professional role, and records relating to supplier qualification, compliance, and contractual performance.
Where individuals have consented to receive communications, or where Gulf Cryo has a legitimate interest in communicating with existing business contacts about closely related products and services (soft opt-in), we may retain email address and communication preference data for the purpose of distributing sector updates, product information, and relevant company developments. Recipients may withdraw consent or opt out at any time.
Gulf Cryo processes personal data for the following operational and commercial purposes:
Gulf Cryo processes personal data on the following legal bases, depending on the context:
The Gulf Cryo website uses cookies and similar tracking technologies to support site functionality, security, and performance analysis. The cookies we use fall into the following categories:
Non-essential cookies are only placed with your consent, recorded through the cookie preferences tool. You may change your preferences at any time through your browser settings. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
Gulf Cryo does not sell personal data to third parties. Personal data may be shared in the following circumstances:
Enquiries and customer data may be shared with relevant Gulf Cryo subsidiaries in the country or region to which the enquiry or supply relationship relates. All subsidiaries are required to operate under data handling standards consistent with those set out in this notice.
Gulf Cryo engages third-party service providers who process data on our behalf, including IT infrastructure and hosting providers, CRM and customer management platforms, logistics and delivery service providers, and analytics and communication tools. These providers are contractually required to process data only on Gulf Cryo's instructions, to maintain appropriate security standards, and to comply with the international transfer safeguards described in Section 9 where applicable.
Gulf Cryo may disclose personal data to regulatory authorities, licensing bodies, or law enforcement agencies where required by applicable law or in response to a valid legal request. Disclosure is made to the extent required and no further.
In the context of gas supply operations and industrial safety obligations, Gulf Cryo may share relevant personal data (including site access records and emergency contact details) with emergency services, civil defense authorities, or regulatory bodies where this is necessary to protect safety or meet legal reporting requirements. Such disclosure is required by applicable safety reporting obligations in the gas manufacturing sector and individuals cannot opt out of this processing.
In the event of a merger, acquisition, restructuring, or sale of all or part of Gulf Cryo's business, personal data held by the company may be transferred as part of that transaction. Affected individuals will be notified where reasonably practicable and where required by applicable law.
Gulf Cryo operates across 10 countries: the UAE, Kuwait, Saudi Arabia, Bahrain, Oman, Qatar, Egypt, Iraq, Jordan, and Türkiye. Personal data may be transferred and processed across these countries in the ordinary course of our operations, including for the purposes of routing enquiries to the correct country team, managing cross-border supply contracts, and maintaining group-wide operational systems.
Where personal data is transferred to a country that does not have an adequacy decision or equivalent data protection framework, Gulf Cryo implements appropriate safeguards, including standard contractual clauses, binding corporate rules, or equivalent transfer mechanisms recognized under applicable law, to ensure that the data receives a standard of protection consistent with applicable law.
In particular, the Gulf Cryo website is hosted on servers located in the United States. When you submit an enquiry or otherwise provide personal data through the website, that data is transferred to and processed in the United States, which may not provide the same level of data protection as your home country. Where your data originates in a country that restricts international transfers, Gulf Cryo applies the safeguard required by that country’s law before transferring it, which may include competent-authority-approved standard contractual clauses (for example, SDAIA-approved clauses for Saudi Arabia and KVKK-approved clauses for Türkiye), other appropriate safeguards, or your consent. You may contact Gulf Cryo for information about the safeguard applied to your data.
Gulf Cryo retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The table below sets out the standard retention periods applied to each data category. Where a data category is not listed below, it is retained in accordance with the applicable legal obligation or for the duration of the relevant relationship plus a reasonable post-termination period.
| Category | Data Types | Retention Period | Legal Basis |
|---|---|---|---|
| Contact form enquiry data | Name, email, phone, country, enquiry type, message | 24 months from last contact | Legitimate interests / contract performance |
| Customer account data | Company name, contacts, purchase history, delivery records | Duration of contract plus 5 years | Contract performance / legal obligation |
| Website usage data | IP address, cookies, browser type, device identifiers | 24 months from collection | Legitimate interests (security and analytics) |
| Marketing communications | Email address, communication preferences | Until opt-out or withdrawal of consent | Consent |
| Health, safety and emergency data | Emergency contact details, site access records, incident reports | 7 years from incident date | Legal obligation / legitimate interests |
| Supplier and contractor data | Company details, contact persons, procurement records | Duration of relationship plus 5 years | Contract performance / legal obligation |
| Legal and compliance records | Correspondence, regulatory filings, dispute records | As required by applicable law (typically 7–10 years) | Legal obligation |
At the end of a retention period, personal data is securely deleted or irreversibly anonymized. Where data exists in encrypted backup systems, it is subject to routine deletion schedules and is not accessed for any active processing purpose.
Gulf Cryo applies technical and organizational security measures appropriate to the nature and sensitivity of the personal data we process. These include access controls and authentication requirements for internal systems, encryption of data in transit and at rest where applicable, physical security at Gulf Cryo production and office locations, staff awareness and data protection training, and regular review of security practices and third-party supplier security standards.
No method of electronic transmission or storage is without residual risk. Gulf Cryo maintains incident response procedures and will notify affected individuals and relevant authorities of a personal data breach where such breach is likely to result in a risk to the rights and freedoms of individuals, in accordance with the timeframes and requirements of applicable law.
Gulf Cryo operates under licensing, inspection, and safety reporting obligations across all 10 countries in which it manufactures and distributes gas. Certain categories of personal data described in Section 4 are processed and retained specifically to meet these regulatory requirements. This processing is carried out on the basis of legal obligation and individuals cannot opt out of it.
Applicable obligations include pharmacopoeia and healthcare facility standards governing medical gas traceability, hazardous materials transport regulations requiring driver and vehicle records, SHEQ management system requirements for incident reporting and audit documentation, and sector-specific licensing conditions imposed by national regulators in each operating country.
Subject to applicable law, individuals whose personal data is processed by Gulf Cryo have the following rights (which may vary depending on the data protection law applicable to you):
Access: to request confirmation that Gulf Cryo holds personal data about you, to obtain a copy of that data, and to learn the purpose of processing and the recipients or categories of recipients to whom the data has been disclosed.
Correction: to request correction of inaccurate or incomplete personal data.
Deletion: to request deletion or destruction of personal data where it is no longer required for the purpose for which it was collected, and where no legal obligation requires its retention.
Restriction: to request that Gulf Cryo limit the processing of your personal data in certain circumstances.
Objection: to object to processing carried out on the basis of legitimate interests, including direct marketing, and to object to any decision based solely on automated processing of your personal data that produces legal or similarly significant effects.
Portability: where applicable under the law of your jurisdiction, to receive personal data you have provided to Gulf Cryo in a structured, commonly used format, where technically feasible and where the processing is based on consent or contract.
Withdrawal of consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact Gulf Cryo using the details in Section 17. Gulf Cryo may request verification of your identity before acting on any request. Gulf Cryo will respond within the timeframe required by applicable law and will not charge a fee unless the request is manifestly unfounded or excessive.
Gulf Cryo's website and services are directed at business and industrial users. We do not knowingly collect personal data from individuals under the age of 18 (or such lower age as may be specified by applicable data protection law in the relevant jurisdiction). If we become aware that personal data has been submitted by a minor, it will be deleted promptly. If you believe a minor has submitted data through our website, contact us using the details in Section 17.
The Gulf Cryo website may contain links to third-party websites, including partner organizations, regulatory bodies, and industry associations. Gulf Cryo has no control over the content or data practices of those websites and accepts no responsibility or liability for them. Visitors are encouraged to review the privacy policy of any third-party site before submitting personal data.
Gulf Cryo reviews this Privacy Notice periodically and updates it when operational, legal, or regulatory changes require. Where an update materially affects how personal data is processed, Gulf Cryo will provide notice through the website or by direct communication where appropriate. The effective date of this Notice is stated at the top of this page.
Questions regarding this notice or Gulf Cryo's data handling practices should be directed to:
Gulf Cryo — Data Privacy
First Floor, Arabian Industrial Gases Building
Dubai Investment Park 1, PO Box 473531
Dubai, United Arab Emirates
Email: infoUAE@gulfcryo.com
Tel: +971 4 809 0000
If you are located in a country with a designated supervisory or data protection authority, and you believe Gulf Cryo has not addressed your concern adequately, you have the right to lodge a complaint with the relevant authority in your country.
In the UAE, the competent authority is the UAE Data Office established under Federal Decree-Law No. 45 of 2021. In Saudi Arabia, the competent authority is the Saudi Data and Artificial Intelligence Authority (SDAIA). In Türkiye, the competent authority is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) established under Law No. 6698.