Privacy Policy

This policy explains how FoodraChoice processes personal data under the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulation.

The platform operator is the controller of that data — the party deciding the purpose and means of processing. Its statutory details are published in the platform identity card below this document.

This policy covers the data of individuals: the establishment's owner, the managers and buyers who act on the account, and anyone who contacts us. The establishment's own details — legal name, commercial registration, VAT number and national address — are not personal data. They are governed by other laws and by retention obligations that the right of destruction below does not override.

Identity and contact: full name, email address, mobile number, preferred language, and role within the establishment.

Account data: a password digest (never the password itself), last sign-in, active sessions and their devices, and failed sign-in attempts.

Establishment documents: the commercial registration, the VAT certificate and the national address, along with the document images you upload.

Transaction data: orders and their lines and prices, invoices and credit notes, payments and their references, quotations, and delivery addresses.

Usage and technical data: IP address, browser and device type, pages visited and when, and a visitor identifier stored in a cookie.

What we do not collect: we do not store your card details on our systems — they are entered with a licensed payment provider and never pass through our servers. We do not collect sensitive personal data such as health, ethnic or religious information, and we have no use for it.

To perform our contract with you: opening the account, fulfilling orders, delivery, payment and customer service. The service cannot be provided without this data.

To meet a legal obligation: issuing and retaining tax invoices as the Zakat, Tax and Customs Authority requires, verifying the identity of an establishment before trading with it, and responding to requests from the competent authorities.

For a legitimate interest: protecting the platform from fraud and misuse, securing accounts, and improving the service and diagnosing faults — where that interest does not override your rights and freedoms.

With your consent: marketing messages and promotional offers. That is the only thing we ask consent for. You may withdraw it at any time without affecting your service, and withdrawing it does not affect the lawfulness of processing before it.

We do not use your data for a purpose other than the one it was collected for, unless the new purpose is compatible with it or the law requires it.

We do not make any decision affecting you based solely on automated processing.

Our systems do raise automated flags — a duplicated document, a repeated commercial registration, a fraud signal — but they refer the matter to a member of staff who decides. They do not refuse an account by themselves.

If your account or a document is refused, you are told why, and you may object and supply clarification.

Licensed payment service providers, to process payments and refunds.

Delivery partners, to the extent needed to deliver: the receiving party, the address, the contact number and the shipment contents.

Hosting and infrastructure providers, under processing agreements that bind them to the same level of protection and prohibit use for their own purposes.

Competent government authorities, when verifying establishment documents or on a lawful request.

ERP systems that an establishment chooses to connect to its account, on its instruction.

We do not sell your personal data, we do not rent it, and we do not trade in it. Any sharing beyond the above happens with your consent or under a legal obligation.

As a rule, your data is processed and stored inside the Kingdom of Saudi Arabia.

Where a technical service requires processing outside it, that happens only within the limits the Personal Data Protection Law and the regulation on transfers outside the Kingdom permit, and with adequate safeguards for the level of protection.

In every case, transfers do not extend to the establishment documents except under an express legal provision.

Encryption in transit on every connection to the platform.

Passwords are stored as digests using an algorithm intended for the purpose. The password cannot be recovered from them — not by anyone, including us.

Establishment documents are held in a private store that is not publicly reachable and is opened only through short-lived signed links. Every viewing of a document is logged: who looked, and when.

Internal access is limited to operational need, integration keys are encrypted, and no key is shown in full on any screen or in any response.

Commercial registration numbers, VAT numbers and tokens are redacted in operational logs, so they cannot leak through an error report.

If personal data is leaked, damaged or accessed without authorisation, we notify the competent authority within the period the law prescribes.

We notify you without undue delay where the incident could cause serious harm to your data or conflict with your rights and interests, setting out what happened, what we did, and what we advise you to do.

Account data: for as long as the account is active. On closure it is destroyed or anonymised within a reasonable period, except for what must be retained below.

Invoices and tax and accounting records: for the period the tax and commercial laws require — at least six years from the end of the tax period the invoice belongs to. That period is not ours to shorten, even at your request.

Compliance documents: for the duration of the contractual relationship, then for as long as needed to show that we verified the establishment before trading with it.

Consent records for the terms and policies: kept while the account exists and for as long as needed to prove the agreement afterwards. A consent record is evidence, and erasing it makes the agreement as though it never happened.

Operational and security logs: a limited period sufficient to diagnose faults and detect misuse, then destroyed.

The Personal Data Protection Law gives you the following rights:

The right to be informed of the legal basis for collecting your data and the purpose of it — this document is how we meet it.

The right of access to the personal data we hold about you.

The right to obtain a copy of it in a clear, readable form.

The right to correct data that is inaccurate, incomplete or out of date. Most of your data can be edited directly from your account page.

The right to have data destroyed once it is no longer needed — within the limits of what the law requires us to keep, which is set out plainly above so that we do not promise you something we cannot deliver.

The right to withdraw consent wherever consent is the basis, such as marketing messages.

Requests go through the contact channels published on the platform, and we respond within the statutory period. We may ask you to prove your identity first — a protection for you, since acting on an access request from somebody impersonating you would itself be a breach.

If you believe we have not handled your data properly, contact us first — most of what can be resolved is resolved there.

You may in any case complain to the Saudi Data and Artificial Intelligence Authority (SDAIA), the authority supervising the application of the Personal Data Protection Law.

The platform is aimed at commercial establishments. Its services are not offered to individuals under eighteen, and we do not knowingly collect children’s data.

If we learn that we have collected a minor’s data without a lawful basis, we destroy it.

We use essential cookies to run the session, the cart and the language preference, and optional ones for measurement and improvement.

Each cookie, its purpose, its lifetime and how to control it are set out in the cookie policy.

We may amend this policy. Every version carries a number and an effective date shown at the top of the page, and earlier versions are retained.

A material change — a new processing purpose or a new recipient — does not take effect until you have been notified, and we ask for your agreement where the law requires it.