RIYADH → GROUP GOVERNANCE / DUBAI
The waybillsstopped.The questions did not.
Two shipments. One admitted contact-data error. One matching return minute. A tracking trail later described as unavailable. This is no longer only a local customer-service question.
15:57
00 / TO ARAMEX INTERNATIONAL — DUBAI
A local ticket can close. A group record cannot simply disappear.
This article asks Aramex International LLC, the Group Data Protection Officer, and the company’s Risk and Compliance function to examine a documented Saudi shipment record involving two Riyad Bank cards. It does not ask Dubai to prejudge the Saudi operation. It asks the group to use the governance mechanisms it publicly says already exist.
Aramex’s published privacy policy identifies Aramex International LLC in Dubai and the relevant local Aramex station as joint controllers for personal data relating to local customers and consignees. It says they are jointly responsible for respecting the rules governing that data. The same policy identifies a Group Data Protection Officer and includes contact details and shipment history among the data handled through Aramex services.
This article relies on the policy published and available at the date of publication. It does not assume that identical wording governed every event in May or July 2025.
That published framework matters here. The disputed mobile number was not peripheral data: according to Aramex’s own support message, it was attached to a shipment and was incorrect. The waybill histories were not abstract records: they described the custody and return status of sensitive bank-card shipments.
Saudi Arabia
Shipment handling, delivery contact data, scans, support replies, and return events.
Dubai
Joint-controller duties, Group DPO, risk and compliance, internal audit, and record governance.
01 / THE IDENTIFIERS
Two distinct waybills. One institutional trail.
49715021705
RENEWAL CREDIT CARD
Aramex support later stated in writing that the mobile number attached to this shipment was incorrect.
49715146165
CREDIT CARD
The published tracking record shows a separate shipment associated with the same issuer and delivery sequence.
02 / WHAT THE PUBLISHED RECORD SHOWS
Evidence first. Interpretation second.
03 / THE SHARED MINUTE
A timestamp is a lead—not a verdict.
The same minute could reflect a physical scan sequence, a bulk status process, a system rule, data migration, or another legitimate operational mechanism. The image alone cannot choose between those explanations. Event-level logs can.
A credible answer should identify the event source, operator or service account, timestamp precision, status code, device or interface, and any upstream or downstream system that wrote or replicated the event.
THE RECORD SUPPORTS
Specific, answerable discrepancies
- Two identifiable shipment records existed.
- Aramex acknowledged incorrect contact data on one shipment.
- The published tracking capture records both returns in the same minute.
- A later inquiry was reportedly told that a previously acknowledged waybill was unavailable.
THE RECORD DOES NOT YET PROVE
Who caused the card-data events—or why
- It does not prove that Aramex exposed payment-card data.
- It does not prove deliberate deletion or alteration of a record.
- It does not identify who supplied the incorrect mobile number.
- It does not establish that the two return entries were improper.
04 / WHEN “NOT FOUND” IS NOT AN EXPLANATION
Unavailable where—and at which layer?
According to the published account, a waybill that had appeared in the tracking record and had been acknowledged in correspondence was later described as not found or unavailable in the queried system. That does not automatically mean the underlying record was deleted. It may have been archived, migrated, restricted, detached from the public interface, or searched in the wrong operational scope.
The correct response is not speculation. It is a documented description of the record’s lifecycle, retention status, and current system of record.
05 / REQUEST TO DUBAI
Preserve. Examine. Explain.
HD.39 invites Aramex International LLC to address the following points through the appropriate privacy, risk, compliance, audit, or legal channel.
- 01
Preserve and review the event-level history for both waybills, including creation, receipt, contact attempts, return, archive, and any later migration or suppression events.
- 02
Identify the system and submitting party that supplied the incorrect mobile number, together with the history of any edits made to that field.
- 03
Explain what the shared 15:57 return timestamp represents: a physical scan, a workflow event, a batch operation, or another system-generated status.
- 04
Clarify whether either tracking record was deleted, archived, migrated, access-restricted, or merely unavailable through the public and support interfaces.
- 05
Confirm whether Group Privacy, Risk and Compliance, or Internal Audit has reviewed—or will review—the documented discrepancy.
- 06
Provide a channel through which the underlying evidence can be submitted and a documented response can be received.
06 / ARAMEX’S PUBLISHED FRAMEWORK
The company has already named the functions that can answer.
Joint-controller framework
Aramex International LLC, the local station, data-subject rights, retention, and the Group DPO.
RISK + COMPLIANCEGroup oversight
The published group function covering risk, corporate compliance, security, and insurance.
CORPORATE RULESAudit and corrective action
Aramex’s published cross-group privacy rules describe audits, cooperation, and remediation mechanisms.
GOVERNANCESpeak-up mechanism
Aramex publishes a whistleblowing route for stakeholders reporting possible misconduct, irregularities, or Code concerns.
FINAL DISPATCH
The brand crosses borders. Accountability must cross them too.
Aramex Saudi Arabia may have handled the local shipment events, but the customer saw one global brand, one tracking environment, and one chain of custody. Aramex’s own policies describe group-level responsibility for data governance. Dubai therefore has a legitimate institutional interest in establishing what happened to these records and why the available answers remain incomplete.
This publication welcomes a documented response from Aramex, Riyad Bank, or any institution named in the record. Any verifiable correction will be published prominently. Until then, the waybill numbers, the written admission, the shared return minute, and the unanswered record-status question remain part of the public file.