Privacy Policy

We, Nama Foods for Meals Provision LLC, a limited liability company registered with commercial registration number (1010751899) and headquartered in building 7018 King Abdulaziz Road, Al-Rabea District, Riyadh, Saudi Arabia (“we”, “our”) respect the privacy of all our users and are committed to protecting the personal data collected through the website palova.com.sa and its associated mobile application (“the Platform”).

This Privacy Policy (“Privacy Policy”) sets out the basis on which we collect and use any of your personal data, whether collected directly from you or through other sources, in relation to your access to the Platform or any services provided by us and your use of them, including promotional messages and any social media functions on the Platform (collectively referred to as “Services”). We understand the importance you place on your personal data and are committed to protecting your privacy and respecting it.

References to “user” or “you” (or similar) are references to you as an individual or legal entity as applicable.

The Platform may include links to third-party websites, plugins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices/statements. When you leave our Platform, we encourage you to read the privacy notice of every website you visit.

We do not collect data about children. This Platform is not intended for anyone who has not reached the age of majority according to the applicable regulations governing such individuals. However, we cannot prevent specific users, including children, from fraudulently stating their ages to gain access to the Platform. If you are a parent or guardian and believe we have collected information about your child, please contact us immediately as outlined in Section 12 of this Privacy Policy.

What personal data do we collect from you and/or about you?

We collect your data in order to continuously provide and improve the Platform and Services. Personal data refers to any information that can identify you as an individual based on identification tools. Personal data does not include anonymized data, meaning data sets from which individual identifiers have been removed. We collect, use, store, and transfer many types of personal data about you, which are classified as follows:

a. Identity data includes details such as: your first name, middle name, last name, username or similar identifiers, gender, title, nationality, and date of birth.

b. Contact data includes your address, email address, and phone number.

c. Transaction data includes information about payments made to and by you, including but not limited to your payment methods, as well as details of products and services you have purchased from us.

d. Technical data includes your IP address, login data, browser type and version, operating system and version, mobile application version, time zone settings and location, browser plug-in types and versions, device type, and advertising identifiers (for iOS users) and information about your general internet usage (e.g., through technology that stores information on your device or accesses it such as: cookies, pixel-based tracking, web beacons, etc., and other technologies used to access our website.

e. Profile data includes your username and password, your interests and preferences, comments, preferred language, and survey responses.

f. Purchase data includes all previous orders and purchases made from the same user account, refund information, fulfillment information, page view information from service providers that enable commercial differentiation, fulfillment, and other operations on the Platform.

g. Browser data relates to how you interact with our website, our products, and our services.

h. Marketing and communications data covers your preferences in receiving marketing materials from us and third parties and your communication preferences.

i. In addition, we collect, use, and share statistical or demographic information (“Aggregate Data”). Aggregate Data is derived from your personal data but has been modified to remove identifiers and does not directly or indirectly reveal your identity. For example, we may aggregate personal data from the browser to determine the percentage of users who access a specific feature on the website.

How do we collect personal data about you?

We use the following methods to obtain personal data about you:

a. Directly: We collect your personal data directly from you through the Platform when you:

• Register on the Platform and other joint registrations (for example: social media logins, etc.) to subscribe to our services and post content on the Platform.
• Make payments, request refunds, and payment methods.
• Participate in competitions, promotions, and subscribe to special schemes.
• Provide opinions, testimonials, or comments.
• Submit support requests/file any complaint with the Platform for refund requests, fraud transactions, replacements, among other things.
• Correspondence record if you contact us via phone, email, or otherwise.
• Browse and perform other activities on the Platform.

b. Indirectly: We also receive personal data about you from your friends/relatives when they make purchases for your benefit or on your behalf, and our vendors/third-party service providers who enable you to seamlessly access our services. Our vendors include:

• Logistics service providers, fulfillment and/or partners.
• Marketing service providers.
• Your interactions with us on other platforms such as: Facebook, Google, etc.
• Payment service providers.
• And if you share any personal data of others i.e.: friends, relatives, colleagues (any individual) with us while using our services, you guarantee that you have obtained the consent of the concerned individual to share their personal data with us according to this Privacy Policy.

c. Automatically: Certain personal data about you is collected automatically when you use our services through logs, cookies, and other unique identifiers. We use logs to collect specific personal data about you. Log information represents data about your use of the services such as: IP address, browser type, referral/exit pages, operating system, timestamps, and related data stored in logs.

We also use a limited number of cookies. Cookies are small data files transferred to your computer (or other device) when used to access our services. Cookies are used for many purposes including enabling specific features of our services, remembering your preferences, equipment, and browsing actions and patterns to better understand how you interact with our services, to provide you with advertisements within and outside the services, and to monitor visitor usage and direct internet traffic. To the extent permitted by your preferred web browser, you can instruct your browser by changing its options or stopping acceptance of cookies or prompting you before accepting any cookies from the services you visit online. We use cookie services to enrich your experience by remembering your online behavior while using the Platform and improving the efficiency of advertisements and services. If you do not agree to our use of cookies, we ask you to stop using the Platform immediately. It is up to you to provide certain personal data, but it may then affect your ability to benefit from many of our services.

For what purpose do we collect your personal data?

We collect and use your personal data for the following purposes:

a. To provide you with information, products, or services that you request from us or which we feel may interest you, when you have consented to be contacted for such purposes.

b. To provide you with location-based services, such as: advertisements, search results, and other personalized content.

c. To perform our obligations arising from any contracts entered into between you and another entity using our Platform or between you and us.

d. To improve our services and deliver better and more customized services to you, including contacting you regarding the services through different channels (for example: by phone, messages, email, instant messaging applications).

e. To ensure that content from our Platform is presented in the most effective manner for you and for the device you use to access our Platform.

f. To provide you with services and offers without interruption on special occasions such as: your birthday and anniversary.

g. To notify you about changes to our services.

h. For any other reason we deem necessary to enhance your user experience on the Platform.

i. To manage and organize our incentive programs and fulfill your requests for incentives and/or allow you to participate in prize draws and notify you if you win in prize draws.

j. To provide functionality and analyze performance, fix errors, and improve usability and effectiveness of the services.

k. To comply with local regulations (for example: your nationality for completing your cross-border shipments, vendor information regarding place of origin, bank account information for identity verification and other purposes).

l. To avoid fraudulent operations and abuse and detect them to protect the security of our customers, ourselves, and others.

How do we use your personal data?

We will only use your personal data in the following circumstances:

a. Contract execution We need to use your personal data to fulfill any contract with you or to take preliminary steps before entering into any contract. This includes accepting applicable terms and conditions or specific terms related to our services. If you do not provide personal data for these purposes, we may not be able to provide our services or enter into any contract with you, which may result in cancellation of the service. We will tell you if this happens.

b. Legal or regulatory obligation We may collect your personal data to comply with any applicable laws and/or regulations.

c. Legitimate interests We may process your personal data based on our legitimate business interests and the interests of our customers when we improve our services and when we detect and prevent fraud and abuse to protect the security of our customers, ourselves, or others, and when we provide you with interest-based advertising.

d. Marketing and communications data We may also use your personal data to provide you with information about goods and services that may interest you, and to enhance your experience of using the Platform through service messages, new features and improvements, special offers, events, and topics of interest to you. We may contact you through various channels, including but not limited to emails, instant notifications, web notifications, posting, phone, in-app messages, and WhatsApp messages, and news feed cards. We also offer you the option to receive these advertisements based on your interests. You can choose not to receive these advertisements by contacting us at the details mentioned in Section 12 of this Privacy Policy and/or by clicking the “Unsubscribe” button in your email or in any marketing communications we send you.

With whom do we share your personal data?

Your personal data is important to us to provide you with our services, and we are not in the business of sharing your personal data with others. We only share your information with third parties as described below, and with companies that follow protective practices at least like those outlined in this Privacy Policy:

a. Other companies. We provide you with our services, and we may deal with other affiliated companies and/or non-affiliated service providers (such as: logistics companies used to deliver products to you, marketing companies, payment processing companies to process online transactions, data analysis, and otherwise), and share your personal data with these companies. We may employ other companies in your transactions, which may store your information in a digital wallet to make your use of our services more efficient.

You understand that it is important for these companies to be able to access relevant personal data to perform their functions and tasks. We will ensure that these companies do not use your personal data for other purposes. We may also receive personal data from these companies (such as delivery and updated address information), which we may use (for example, to correct our records and deliver your next purchases). These companies will be contractually obligated to respect the confidentiality of your personal data and not use it for any other purposes.

b. Third parties. We may share your personal data with any third party for the purposes set forth in Section 5 above. However, we ensure that all companies follow protective practices at least like those outlined in this Privacy Policy. We also do not allow our third-party service providers to use your personal data for their own purposes and only allow them to process your personal data for specific purposes in accordance with our instructions. You can request us or third parties to stop sending marketing communications to you at any time by setting your marketing preferences on the Platform or by following the unsubscribe links in any marketing message sent to you or by contacting us via legal@palova.com at any time.

Additionally, you may be asked to provide additional personal data to participate in some of our market research activities, including competitions and promotions (such as additional personal data to determine your eligibility to win a prize). This personal data may be collected by us or by participating sponsors or vendors for the promotion. If you choose not to provide certain personal data, you may not be able to take advantage of competitions and promotions. If you decide to participate, please note that you should review third-party privacy policies to understand how they use any personal data collected.

c. Company ownership transfer. As our business evolves, we may participate in buying or selling other companies or services. In these transactions, customer personal data is typically included among the transferred assets but will remain protected under any existing privacy policy (unless the customer of course agrees otherwise). If we acquire or if a substantial portion of our assets is acquired, customer personal data will be included as part of the assets being transferred.

d. Protecting the Platform and others. We issue personal data of users when we believe that this issuance is appropriate to comply with the law and law enforcement investigations, to protect our rights or the rights of our users or others, their property, or their safety. This includes exchanging personal data with other companies and institutions for various reasons, such as: protection against fraud and reducing credit risk.

Is my personal data transferred outside the Kingdom of Saudi Arabia?

To facilitate the provision of our services to you, it may be necessary for us at times to share your personal data with other members of the Noon group of companies and service providers located outside the Kingdom of Saudi Arabia. Such transfers are necessary for reasons including but not limited to, IT infrastructure, data storage, and Platform management including payment processing. When we transfer personal data outside the Kingdom of Saudi Arabia, we ensure that personal data is transferred in accordance with this Privacy Policy and as provided for in the applicable laws within the Kingdom of Saudi Arabia.

How do we store your personal data and for how long?

The personal data we collect from you may be transferred to, stored, and processed by employees working for us or one of our service providers. These employees may be engaged, among other things, in fulfilling your order, processing your payment details, and providing support services. We will store your information as long as necessary to fulfill the purposes specified in this Privacy Policy or as permitted by law or required by it. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

In some cases, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

What security measures do we implement?

We have designed our systems with your security and privacy in mind. We maintain reasonable technical, administrative, and physical precautions to ensure that your personal data is treated securely and in accordance with this Privacy Policy and applicable laws, and to prevent unauthorized access, alteration, disclosure, or destruction of your personal data. We may, for example, use encryption technology to secure your personal data during transmission to our Platform, in addition to the external firewall and host firewall technology to prevent any network-level attacks. Access to this personal data is only allowed to authorized employees, contractors, and agents who need to know your personal data in connection with the performance of their services. We also follow the Payment Card Industry Data Security Standard when dealing with credit card data.

It is important for you to protect yourself from unauthorized access to your password and to your devices used to access our services. You are also responsible for maintaining the confidentiality of your password. (For example: make sure you log out when you finish using a shared device). Although we will do our best to protect your personal data, unfortunately, transmission of information over the internet is not completely secure.

What are your data rights?

a. In certain cases, you have the following data rights:

a. The right to obtain information about personal data collected from you: If you have any inquiries about how your personal data is collected and used, please contact us via: legal@palova.com.sa. Many of our services also include settings that provide you with options about how your personal data is used.

b. The right to access your personal data: You can access a wide range of information about your account and interactions with the Platform for the purpose of viewing and updating your personal data in most cases. Examples of personal data that you can easily access on the Platform include the following: 1- Updated information regarding recent orders; 2- Personally identifiable information (including name, email, password, date of birth, contacts, and customized advertising preferences); 3- Payment settings (including credit card information); 4- Email notification settings. For more information, please contact us via: legal@palova.com.sa

c. The right to request access to your personal data: In certain cases, you have the right to request access to your personal data that we hold in a clear and readable format if technically possible. To make such a request, please contact us via: legal@palova.com.sa

d. The right to request destruction of your personal data: You have the right to request the destruction and erasure of your personal data to the extent permitted by applicable law. To make such a request, please contact customer service. However, please note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you.

e. Withdrawal of consent / right to object: You can withdraw consent to marketing data that you confirm at any time. You can unsubscribe from receiving future marketing communications from us at any time by adjusting your customer communication preferences, through the unsubscribe link in emails. You may also disable cookies by changing the settings on your browser. If you disable cookies, this will affect our Platform and you may not be able to access certain areas on our Platform or use or access all functions on the Platform.

f. The right to request correction of personal data: You can at any time request to modify and correct your personal data by contacting us via: legal@palova.com

b. You will not be required to pay any fees for exercising your rights, unless otherwise provided by law. If you submit a request to exercise your rights, you will receive a response within the timeframes stipulated in the applicable law.

How do we change our Privacy Policy?

Since our business is constantly changing, our Privacy Policy may also need to change. However, we will notify you of any such changes by posting the updated version of the Privacy Policy on the Platform, and each change will become effective when posted on the Platform or on the date we specify as the “Effective Date”.

We may send you periodic reminders via email about our notices and terms, but you should regularly review our Platform to learn about recent changes. You are obligated to review the Privacy Policy regularly. Your continued use of the Platform after any such change constitutes your agreement to this Privacy Policy as amended.

Contact us

If you have any concerns or inquiries regarding your personal data on the Platform, please contact us via Info@palova.com.sa with a detailed statement.