Privacy policy

The Association is the controller of your data in this programme. Its licence number and contact details are at the bottom of every page.

[For review: the data protection officer’s name and e-mail, if one is appointed.]

• Identity and contact: your name in Arabic, and in English if you wrote it; your e-mail address or mobile number.
• Membership: the tier you chose, your applications and their status, what you wrote in them (city, occupation, organisation, note), and the establishment’s name and commercial registration for establishment memberships.
• Payments: the amount, the method and the transaction reference. Your bank card details never reach us; you type them on the payment gateway’s page.
• Coupons and orders: the coupons you bought and their status, the branch and time you collected them, and your market orders.
• Technical: for each device you signed in from: the browser, the network address and when it was last used, so we can show you your devices and let you sign them out; and necessary cookies (see “Cookies”). On the public forms the network address is never stored as it is, only a keyed fingerprint of it, to prevent abuse.
• Messages: a copy of every message we sent you and its status.

• To provide the membership you asked for: reviewing the application, issuing the card, renewing it (performing the contract).
• To hand over the coupons you bought at the establishment’s branch.
• To collect and record the fees.
• To send service messages: application received, payment, approval, renewal reminders.
• To prevent fraud and misuse and to protect accounts (legitimate interest).
• Marketing messages only if you agreed to them — you can withdraw that at any time.
• To meet what the law requires.

• The Association’s team, each only as their role needs.
• An establishment (a café, restaurant, club or other) when you collect a coupon: it sees the coupon, its product and its state — not your e-mail or mobile.
• The payment provider to complete a payment, and the e-mail and SMS providers to deliver messages.
• The hosting provider that runs the system. [For review: the provider’s name and the servers’ location inside the Kingdom.]
• Official authorities when the law requires it.

We never sell or rent your data to anyone.

• Account and membership data: while your membership is live, then [for review: a period, e.g. two years] after it last ended, unless you ask for deletion sooner.
• Financial records (payments, invoices): as long as the law requires [for review: ten years], even after deletion, without anything that identifies you.
• The event log: a security record that is never edited or deleted; it keeps what happened and who did it, and after deletion nothing in it names you.
• We answer a deletion request within 30 days of receiving it.

• To be informed: this policy.
• To get a copy of your data: “Download my data” on the “Privacy and my data” page of your account.
• To correct it: from your account, or by writing to us.
• To ask for its deletion: “Request account deletion”. Once the Association approves, your personal data is erased and only what the law requires is kept, with nothing that names you.
• To withdraw your consent to marketing messages whenever you like.
• To complain to the Saudi Data & AI Authority (SDAIA) if you believe your data was processed against the law.

We use only the cookies the site needs to work: your sign-in session, the interface language, and table display preferences for the Association’s team. We use no analytics, advertising or tracking tools from any third party, so we do not ask your consent for them. If any is ever added, we will ask for your consent first.

The connection to the site is encrypted, passwords are stored hashed and cannot be recovered, two-step verification is available to every account, access follows roles, and every act in the system is written to an event log that cannot be edited.

We may update this policy. The date of the last update is at the top of the page, and with your consent we keep the version of the text you agreed to. If a change is material we will tell you and ask for your consent again where needed.

For any question about your data or to exercise your rights, write to us through the contact details at the bottom of the page, or from the “Privacy and my data” page of your account.