Privacy Policy

1. Introduction

Walima ("Company," "we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) issued by Royal Decree No. M/19 dated 9/2/1443H and its implementing regulations.

This Privacy Policy applies to all users of our Platform, including Corporate Users, Partner Restaurants, Delivery Partners, and website visitors.

تلتزم متروسبيدي بحماية خصوصيتك وبياناتك الشخصية وفقًا لنظام حماية البيانات الشخصية في المملكة العربية السعودية.

2. Data Controller Information

Walima is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Company Name: Walima Saudi Arabia
• Data Protection Officer: privacy@getwalima.com
• Address: King Fahd Road, Riyadh, Kingdom of Saudi Arabia
• Phone: +966 11 XXX XXXX

3. Personal Data We Collect

3.1 Information You Provide

• Account Information: Name, email address, phone number, company name, job title, and password.
• Business Information: Commercial registration number, VAT registration number, business address, and authorized representatives.
• Payment Information: Bank account details, billing address, and transaction history (processed through secure payment gateways).
• Order Information: Delivery addresses, order history, dietary preferences, and special instructions.
• Identity Documents: National ID (for Delivery Partners), commercial licenses (for Partner Restaurants), and corporate authorization letters (for Corporate Users).

3.2 Information Collected Automatically

• Device Information: IP address, device type, operating system, browser type, and unique device identifiers.
• Location Data: GPS coordinates (with your consent) for delivery tracking and service area verification.
• Usage Data: Pages visited, features used, click patterns, and time spent on the Platform.
• Cookies and Similar Technologies: As described in our Cookie Policy.

3.3 Information from Third Parties

• Business verification information from the Ministry of Commerce
• Payment verification from financial institutions
• Background check information for Delivery Partners (where legally permitted)

4. Legal Basis for Processing (PDPL Compliance)

Under the Saudi Personal Data Protection Law, we process your personal data based on the following legal grounds:

• Consent: Where you have given explicit consent for processing, particularly for marketing communications and location tracking.
• Contract Performance: Processing necessary to fulfill our contractual obligations to you, including order processing, delivery, and payment.
• Legal Obligation: Processing required to comply with Saudi laws, including tax regulations (ZATCA), anti-money laundering requirements, and food safety regulations (SFDA).
• Legitimate Interest: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, provided these interests do not override your fundamental rights.
• Public Interest: Processing necessary for public health and safety purposes, including food safety compliance.

5. How We Use Your Personal Data

• Service Delivery: Processing orders, coordinating deliveries, facilitating payments, and providing customer support.
• Account Management: Creating and maintaining your account, verifying your identity, and managing your preferences.
• Communication: Sending order confirmations, delivery updates, invoices, and important service announcements.
• Platform Improvement: Analyzing usage patterns to improve our services, develop new features, and enhance user experience.
• Safety and Security: Detecting and preventing fraud, unauthorized access, and other illegal activities.
• Legal Compliance: Fulfilling our obligations under Saudi law, including tax reporting, regulatory compliance, and responding to lawful requests from authorities.
• Marketing (with consent): Sending promotional offers, newsletters, and personalized recommendations where you have opted in.

6. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Partner Restaurants: Order details necessary for food preparation and coordination.
• Delivery Partners: Delivery address and contact information required for order fulfillment.
• Payment Processors: Payment information processed through PCI-DSS compliant gateways.
• Service Providers: Cloud hosting, analytics, customer support, and other operational services (bound by data processing agreements).
• Government Authorities: When required by Saudi law, including ZATCA, SFDA, Ministry of Commerce, and law enforcement agencies.
• Professional Advisors: Legal, accounting, and auditing services as necessary.

We do not sell your personal data to third parties. Any data sharing is conducted in compliance with PDPL requirements and appropriate safeguards.

7. Cross-Border Data Transfers

Your personal data is primarily stored and processed within the Kingdom of Saudi Arabia. Where cross-border transfers are necessary, we ensure compliance with PDPL requirements, including:

• Obtaining necessary approvals from the Saudi Data and Artificial Intelligence Authority (SDAIA) where required
• Ensuring the receiving country provides adequate data protection or implementing appropriate safeguards
• Using standard contractual clauses approved by SDAIA
• Obtaining your explicit consent where other legal bases are not available

8. Data Security

We implement comprehensive technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication for sensitive operations
• Regular security assessments and penetration testing
• Access controls based on role and necessity
• Employee training on data protection and security
• Incident response procedures and breach notification protocols
• Physical security measures for data centers located in Saudi Arabia

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Active Accounts: For the duration of your account relationship plus applicable retention periods
• Transaction Records: 10 years as required by ZATCA tax regulations
• Financial Records: 10 years as required by Saudi Commercial Law
• Legal Claims: Duration of the limitation period for potential legal claims
• Marketing Preferences: Until you withdraw consent

After the retention period expires, data is securely deleted or anonymized in accordance with our data disposal procedures.

10. Your Rights Under PDPL

Under the Saudi Personal Data Protection Law, you have the following rights:

• Right to Know: You have the right to know about our policies regarding the collection and processing of your personal data.
• Right of Access: You can request access to your personal data and obtain a copy of it.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure: You can request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: You can request limitation of processing in certain circumstances.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.
• Right to Complain: You can lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

To exercise your rights, please contact our Data Protection Officer at privacy@getwalima.com. We will respond to your request within 30 days.

11. Children's Privacy

Our Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.

12. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our Platform with a new effective date
• Sending an email notification to registered users
• Displaying a prominent notice on our Platform

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes indicates your acceptance of the updated policy.