Privacy & Data Protection Policy

1. Introduction

Tohfa ("we," "us," or "our") is committed to protecting the privacy and personal data of our customers in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at tohfa-app.yawerhameedi.com.

2. Data We Collect

We collect the following types of personal data:

• Account Information: Full name, Saudi mobile phone number, and email address (optional).
• Delivery Information: Delivery address, GPS location coordinates (when you use the GPS feature), delivery zone, and delivery notes.
• Order History: Products ordered, order numbers, payment methods used, and transaction amounts.
• Loyalty Data: Loyalty points balance, redemption history, and expiry dates.
• Payment Data: Payment method type (Mada, Apple Pay, Credit Card). We do NOT store your full card numbers, CVV codes, or payment credentials — these are processed securely by our ZATCA-compliant payment gateway partners.
• Usage Data: Device type, browser type, and interaction data with our platform (e.g., products viewed, cart activity).

3. How We Use Your Data

We use your personal data for the following purposes:

• To process and deliver your flower and gift orders.
• To create and manage your customer account.
• To track and manage your loyalty points and rewards.
• To communicate with you about your orders (delivery updates, confirmations).
• To send promotional offers and discount codes (only if you have opted in via notification preferences).
• To improve our products, services, and user experience.
• To comply with Saudi legal and regulatory requirements, including ZATCA e-invoicing and VAT reporting.

4. Legal Basis for Processing

In accordance with the Saudi PDPL, we process your personal data based on the following legal grounds:

• Consent: When you create an account and place an order, you consent to us processing your data for the purposes described above.
• Contractual Necessity: We need your data to fulfill our contractual obligations — processing your order and delivering it to you.
• Legal Obligation: We are required by Saudi law to retain transaction records, including VAT-compliant invoices, for a period of 6 years.
• Legitimate Interest: We may process certain data to prevent fraud, improve our services, and ensure platform security.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties. We share your data only with the following service providers who help us operate our business:

• Payment Processors: ZATCA-compliant payment gateways (e.g., PayTabs) to process your payments securely.
• Delivery Partners: Local couriers who deliver your orders — we share only your delivery address and contact number.
• Cloud Infrastructure: Vercel (hosting) and Turso (database) for secure data storage and processing.
• Government Authorities: When required by Saudi law, including ZATCA for VAT compliance and e-invoicing.

All third-party service providers are contractually bound to protect your data in accordance with applicable Saudi data protection laws.

6. Data Retention

We retain your personal data for as long as your account is active. If you stop using our services, we will retain your transaction data (orders, payments, invoices) for a minimum of 6 years as required by Saudi tax law. Loyalty points expire 6 months after your last purchase. After the retention period expires, your data will be permanently deleted or anonymized.

7. Your Rights Under PDPL

As a data subject under the Saudi PDPL, you have the following rights:

• Right to Access: You can request a copy of all personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete data.
• Right to Erasure: You can request deletion of your personal data (subject to legal retention requirements).
• Right to Withdraw Consent: You can withdraw consent for marketing communications at any time via your profile settings.
• Right to Data Portability: You can request your data in a structured, machine-readable format.
• Right to Object: You can object to the processing of your data for direct marketing purposes.

To exercise any of these rights, please contact us at iam@yawerhameedi.com or WhatsApp 0537254822.

8. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including:

• SSL/TLS encryption for all data transmitted between your device and our servers.
• Secure cloud hosting on Vercel's global edge network with built-in DDoS protection.
• Encrypted database storage via Turso (libSQL cloud database).
• Access controls limiting data access to authorized personnel only.
• Regular security audits and vulnerability assessments.
• Payment data processed through ZATCA-compliant PCI-DSS certified payment gateways.

9. Cookies & Local Storage

Our platform uses local storage (not cookies) to remember your cart items, favorites, loyalty points, and login session. This data is stored on your device and is not transmitted to third parties. You can clear this data at any time by clearing your browser's local storage.

10. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

11. Cross-Border Data Transfer

Your data may be processed on servers located outside the Kingdom of Saudi Arabia (e.g., Vercel's global edge network and Turso's cloud infrastructure). We ensure that all cross-border transfers comply with the Saudi PDPL and that adequate protection measures are in place.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact

For any questions, concerns, or requests regarding your personal data, please contact our Data Protection Officer:

• WhatsApp: 0537254822
• Phone: 0537254822
• Email: iam@yawerhameedi.com