- About the Store
This policy explains how SunnyTan, operated by ALDRJAH ALQSWA EST, handles your personal data when you use or purchase from the store. The establishment is the controller of the personal data it collects to operate the store and fulfil orders. - Data We Collect
We collect data necessary to provide our services. This may include your name, email address, mobile number, delivery address, order details, payment status, and correspondence. Technical data, such as IP address, device and browser information, and cookies, may also be collected depending on the tools used by the store.
Data necessary to fulfil and deliver your order is required to provide the service. Data provided for optional purposes, such as subscribing to marketing offers, is optional. We may be unable to fulfil an order without its essential information.
- How We Collect Data
We collect data directly when you create an account, place an order, or contact us, and through Zid and service providers involved in fulfilling your order. Some technical data may be collected automatically while you browse. - Purposes and Legal Bases
We use data to manage accounts, fulfil orders, process payments, arrange delivery and returns, respond to inquiries and complaints, prevent fraud, and meet legal obligations.
Processing is based on performing our agreement with you, legal obligations, consent where required, or legitimate interests subject to applicable legal conditions. Using the website alone does not constitute consent to purposes requiring separate consent.
- Marketing Communications
We use contact details for marketing only after obtaining any legally required consent. You may unsubscribe or withdraw consent using the method provided in the message or by emailing us. This does not affect communications necessary to service your order. - Cookies
The store may use cookies to operate the shopping cart and remember preferences, and analytics or marketing tools depending on enabled services and required consent. You may manage cookies through your browser settings and any consent tools available on the website. Disabling essential cookies may affect certain functions. - Data Sharing
We do not sell your personal data. We may share necessary data with Zid, payment providers, shipping companies, and technical service providers involved in operating the store, for the purposes described in this policy and subject to applicable safeguards.
We may disclose data to competent authorities where legally justified. Any transfer or processing of personal data outside Saudi Arabia is subject to applicable legal requirements and safeguards.
- Storage and Security
Data is stored electronically within the store’s operating systems and connected services. We take appropriate organizational, administrative, and technical measures to protect it and restrict access according to operational needs and permissions. Payments are processed by authorized payment service providers. - Retention and Deletion
We retain data only to the extent and for the period necessary to fulfil its purposes, complete orders, meet statutory retention requirements, or resolve disputes. When no longer needed, data is securely destroyed or identifying elements are removed in accordance with applicable rules. - Your Rights
Subject to applicable law, you may learn how your data is processed, access it, obtain a readable and clear copy, request correction, completion or updating, request destruction, and withdraw consent where consent is the basis for processing.
To submit a request, email [email protected]. We may request limited information necessary to verify your identity. We fulfil rights requests without undue delay within 30 days. Where legally permitted, this period may be extended by up to an additional 30 days, with advance notice explaining the extension.
Withdrawing consent does not affect the lawfulness of earlier processing or processing based on another legal ground. You may also submit a complaint to the competent personal data protection authority.
- Personal Data Breaches
We respond to personal data breaches and take measures to limit their effects. Where notification requirements apply, we notify the competent authority within 72 hours of becoming aware of the incident and notify affected individuals without undue delay, in accordance with applicable requirements. - External Links, Updates and Contact
The store may contain links to external websites with their own privacy policies. Please review those policies before providing personal data.
We may update this policy to reflect service changes or legal requirements, indicate the latest revision date, and notify you of material changes where appropriate. If a new purpose requires your consent, we will request it separately.
For privacy inquiries, complaints and requests:
[email protected]
If the Arabic and English versions differ in interpretation, the Arabic version prevails without limiting statutory rights.