Privacy Policy

By using the Site or placing an order, you agree to this Policy.

2. Personal Data We Collect

a. Contact & Delivery Data

Full name, phone number, email address, and delivery/billing address provided during checkout.

b. Order & Payment Data

Products purchased, order value, delivery preferences, and payment method used (such as Mada, Visa, Mastercard, Apple Pay, STC Pay, Tabby, Tamara, or Cash on Delivery). We do not collect or store full payment card details; payments are securely processed by licensed third-party payment gateways.

c. Technical Data

IP address, device type, browser type, operating system, pages viewed, time spent on pages, and referral URLs collected automatically via standard cookies and site analytics.

d. Marketing Data (Optional)

Email or SMS marketing opt-in preferences, where you have explicitly opted in to receive promotional communications.

e. Customer Inquiries

Information and message contents you provide when you contact our customer support via email or messaging channels.

3. How We Collect Your Data

- Directly from you when you register, order, contact support, or subscribe.
- Automatically through cookies and similar technologies when you use the Site.
- From third parties such as payment providers, delivery companies (SMSA, Aramex, SPL), and marketing platforms (Meta, TikTok, Snapchat, Google), only within the limits of PDPL.

4. Why We Use Your Data (Purposes)

We use your personal data to:
1. Process and deliver your orders.
2. Verify identity and prevent fraud.
3. Manage returns, exchanges, and refunds.
4. Provide customer support.
5. Send transactional messages (order confirmations, shipping updates).
6. Send marketing communications where you have consented.
7. Improve the Site, products, and customer experience.
8. Comply with legal, tax, and regulatory obligations in KSA.

5. Legal Basis for Processing

We process personal data based on:
- Your explicit consent (marketing, cookies beyond necessary).
- Performance of a contract (fulfilling your order).
- Legal obligation (tax, e-commerce law, consumer protection).
- Legitimate interests where permitted under PDPL (fraud prevention, service improvement).

6. Sharing Your Data

We share personal data only with:
- Delivery partners (e.g., SMSA, Aramex, SPL) for name, address, phone, and order details.
- Payment providers (e.g., HyperPay, Moyasar, Tabby, Tamara) for transaction data.
- IT and cloud service providers hosting the Site and CRM.
- Marketing platforms (Meta, TikTok, Snapchat, Google) using hashed identifiers where you have consented.
- Government or regulatory bodies when legally required (e.g., ZATCA, SDAIA, courts, law enforcement).

We do not sell your personal data.

7. Cross-Border Data Transfers

Where personal data is transferred outside the Kingdom, we do so only in compliance with Article 29 of PDPL and its Regulations, using SDAIA-approved safeguards, and only to the extent necessary to deliver our services.

8. Data Retention

We retain personal data only for as long as necessary:
- Order records: 10 years (ZATCA / tax law).
- Account data: while your account is active, plus 2 years after last activity.
- Marketing data: until you withdraw consent.
- Support communications: 3 years.
- Technical logs: 12 months.

9. Your Rights Under PDPL

You have the right to:
1. Be informed about how we process your data.
2. Access your personal data.
3. Request correction of inaccurate data.
4. Request deletion of your data where legally permitted.
5. Withdraw consent at any time.
6. Object to certain processing, including direct marketing.
7. Lodge a complaint with SDAIA (sdaia.gov.sa).

To exercise any right, contact econohq@gmail.com. We will respond within 30 days.

10. Cookies

We use cookies for essential Site functionality, analytics, and marketing. You can manage preferences through the cookie banner or your browser settings. Blocking essential cookies may affect checkout functionality.

11. Security

We apply administrative, technical, and physical safeguards including encryption in transit (TLS), encrypted storage of sensitive fields, access controls, and regular security reviews. No system is 100% secure; you are responsible for keeping your account credentials confidential.

12. Children's Data

The Site is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided data, contact us for deletion.

13. Third-Party Links

The Site may link to third-party websites (payment gateways, social media). We are not responsible for their privacy practices. Review their policies before sharing data.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via the Site or email. The "Last updated" date reflects the latest version.