1. Who is the data controller?

2. What we collect

3. How we use it

• To deliver your order — including sharing your name, address, and phone with our shipping partner
• To process payments — through Salla's PCI-compliant payment infrastructure
• To provide customer support — answer questions, resolve issues, process returns
• To send transactional emails — order confirmations, shipping updates, delivery confirmations (you cannot opt out while you have an active order)
• To send marketing emails — only if you've subscribed; opt out anytime via the link in every marketing email
• To prevent fraud and abuse — review unusual activity, block bots
• To comply with Saudi law — including tax reporting (ZATCA), consumer protection requests, and lawful court orders
• To improve our products and service — aggregated, anonymised analytics

4. Who we share it with

We share the minimum data needed with these categories of partners:

• Salla — our e-commerce platform; processes orders, accounts, and payments under their own PDPL-compliant infrastructure
• Shipping carriers — to deliver your order (name, address, phone, parcel contents)
• Payment processors — to authorise and settle payments
• Email service providers — to send transactional and marketing emails
• Analytics & advertising platforms — Google Analytics, Meta, Snapchat, TikTok (only if you have not opted out of marketing cookies)
• Saudi government and law enforcement — when legally required, including ZATCA tax reporting and Ministry of Commerce consumer complaints

We do not sell your personal data to third parties.

5. International transfers

Some of our service providers process data outside the Kingdom of Saudi Arabia. Where this happens, transfers are made under the safeguards required by Article 29 of the PDPL — either to a country recognised as providing adequate protection, or under contractual safeguards that protect your data to the standard required by Saudi law.

6. How long we keep it

7. Your rights under the PDPL

You have the right to:

• Be informed of how we use your data (this policy)
• Access a copy of the personal data we hold on you
• Correct any inaccurate personal data
• Delete your personal data, subject to our legal retention obligations
• Restrict or object to certain processing, including direct marketing
• Withdraw consent at any time where we rely on consent
• Lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) at sdaia.gov.sa

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Cookies

We use cookies and similar technologies to keep you logged in and remember your cart, process payments securely, measure how the Store performs (analytics), and show relevant ads on Meta, Snapchat, TikTok, Google (only with your consent).

You can control cookies through your browser settings. Blocking essential cookies may prevent the Store from working correctly.

9. Children

byremer.com is not directed at children under 18. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

10. Security

We use industry-standard technical and organisational measures to protect your data — encrypted connections (HTTPS), access controls, and partnerships with PCI-DSS-compliant payment processors. No system is 100% secure; if a breach affecting your personal data occurs, we will notify you and SDAIA in line with PDPL Article 20.

11. Changes to this Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be notified via email if you have an active account.

12. Contact

Privacy questions, requests, or complaints: [email protected].