Theoutlet values the confidentiality and privacy of personal data and processes it lawfully and transparently in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. This Privacy Policy applies to our website, mobile application, and official communication channels (such as WhatsApp and email) whenever we provide services or communicate with you. Under the PDPL, controllers must publish a privacy policy before collecting personal data and clearly explain the key elements of the processing.
1) What Data We Collect
Contact Details: Name, phone number, email address, and physical address.
Order and Payment Information: Orders, payment method details (processed by authorized payment service providers), and invoices.
Shipping and Delivery Information: Shipping carrier, tracking numbers, and delivery status.
Technical and Usage Data: IP address, device/browser type, pages viewed, and cookies.
Support Communications: Messages sent via WhatsApp, email, and contact forms.
We do not request sensitive personal data unless it is necessary and lawful to do so. Where required, we will explain the purpose and obtain your consent where applicable. See Articles 4–6 of the PDPL regarding information, consent requirements, and applicable exceptions.
2) Why We Use Your Data (Legal Bases)
We process personal data only for specific, legitimate purposes and use only the minimum amount of data necessary. Depending on the context, our legal bases may include: your consent, performance of a contract, compliance with a legal obligation, legitimate interests (balanced against your rights and never relied upon for sensitive personal data), and protection of vital interests.
Main Purposes
Providing Services and Fulfilling Orders: Processing orders, payments, shipping, confirmations, and after-sales support.
Customer Care: Responding to inquiries, handling complaints, and verifying identity.
Improving Our Services: Analytics to enhance performance and user experience (using aggregated or minimally identifiable data whenever possible).
Communications and Marketing: Service-related communications, promotional offers, and marketing messages (you may unsubscribe at any time).
Compliance and Fraud Prevention: Accounting and tax records, dispute resolution, and security monitoring.
3) Marketing and Unsubscribing
We may send promotional offers, discounts, and notifications. You may unsubscribe at any time using the unsubscribe link (where available) or by contacting Customer Support. The PDPL recognizes consent as a primary legal basis for processing, with specific marketing requirements established by its regulations.
4) Cookies
We use only essential cookies that are necessary for the basic operation of our website and services. These cookies enable core functionality such as maintaining your session, preserving items in your shopping cart, and supporting secure payment processing.
We do not use cookies for advertising, analytics, personalization, or any form of in-app or cross-site tracking.
You can manage essential cookies through your browser settings; however, disabling them may affect the core functionality of the website.
5) Sharing Your Data
We do not sell personal data. We share personal data only to the extent necessary with:
Service Providers: Shipping companies, payment processors, hosting and IT providers, and analytics vendors.
Professional Advisors: Legal and accounting advisors (where necessary).
Public Authorities: Where required by applicable law or a valid legal request.
All data sharing is subject to agreements and safeguards that comply with PDPL requirements.
6) Cross-Border Data Transfers
If we transfer personal data outside the Kingdom of Saudi Arabia, we will do so in accordance with the Regulations on Transferring Personal Data Outside the Kingdom and related guidance (including adequacy decisions, appropriate safeguards such as SCCs/BCRs, risk assessments, and data minimization). Such transfers are limited to the minimum amount of data necessary.
As of September 14, 2024, the updated Cross-Border Data Transfer Regulations came into effect, allowing transfers to jurisdictions deemed to provide an adequate level of protection and establishing mechanisms for other destinations (such as SCCs/BCRs together with appropriate safeguards).
7) Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described above, including legal obligations and dispute resolution. When the data is no longer required, it will be securely deleted or anonymized in accordance with PDPL requirements for retention and destruction.
8) Security
We implement appropriate technical and organizational measures (including encryption, access controls, and monitoring) to protect personal data, including during transmission, and continuously improve our security controls.
9) Your Rights Under the PDPL
Under the PDPL and its regulations, you have the right to:
Be informed of the legal basis and purpose of data collection.
Access the personal data we hold about you.
Obtain a readable copy of your personal data.
Correct, complete, or update your personal data.
Request destruction of your personal data in specific cases (such as when it is no longer required for the stated purpose).
We will respond within the timeframes and in the manner prescribed by the applicable regulations.
To exercise your rights, please contact us using the details below.
10) Personal Data Breaches
If we become aware of any personal data breach, damage, or unlawful access, we will notify the competent authority (SDAIA). Where the incident is likely to affect your personal data or harm your rights or interests, we will also notify you in accordance with the applicable regulations and SDAIA guidance.
11) Registration / Data Protection Officer (Where Applicable)
Where required under the PDPL and the rules governing the National Register of Controllers, we will register as a data controller. If required by applicable regulations (such as in cases of large-scale monitoring or core processing of sensitive personal data), we will appoint a Data Protection Officer (DPO).
12) Children’s Data
Our services are not directed to individuals below the legal age. If we discover that we have collected personal data from a minor without the required consent, we will delete such data as appropriate.
13) Changes to This Policy
We may update this Privacy Policy from time to time. The “Last Updated” date reflects the most recent version. Your continued use of our services after any updates constitutes acceptance of the revised policy.
14) Contact
For privacy-related inquiries or requests (including access, correction, deletion, or marketing opt-out):
Email: info@theoutlet.kiloegy.com
Support: 8001240636