Privacy Policy

6.1 Controller

Fajur Business Solutions Company operates ClickShoppy and acts as controller for personal data processed for platform purposes, subject to the specific roles of sellers and service providers under applicable law. Privacy contact: [INSERT PRIVACY EMAIL].

6.2 Data Categories

ClickShoppy may process account/contact data; delivery addresses and location data when enabled; orders, returns, refunds, invoices and payment references; business CR/VAT/National Address and authorized-user data; device, IP and usage data; search and recommendation activity; AI prompts, RFQ text and uploaded product images; support messages and attachments; seller/driver verification data; and dispute evidence such as packing/unboxing media where enabled.

6.3 Purposes

Purposes may include account creation, order/payment processing, seller/business verification, delivery, customer support, returns, fraud prevention, security, personalization, AI-assisted features, analytics, legal compliance, accounting and dispute handling.

6.4 Legal Basis

Processing must rely on an appropriate legal basis under the Saudi PDPL and implementing regulations, such as contract necessity, legal obligation, consent or another lawful basis applicable to the specific activity.

6.5 Collection Methods

Data may be collected directly from users, automatically from platform use/cookies, from sellers/logistics/payment providers involved in a transaction, and from authorized verification sources where permitted.

6.6 Sharing

Data may be disclosed as necessary to sellers, payment providers, logistics providers, cloud/IT providers, fraud/security providers, identity/compliance providers, customer-support providers and government/regulatory authorities where required.

6.7 Hosting and Geography

ClickShoppy intends to host its primary production infrastructure in Google Cloud Dammam, Saudi Arabia (me-central2), subject to final service configuration. Some processors or technical services may process data elsewhere; any international transfer must follow applicable Saudi requirements.

6.8 Retention

Data should be retained only as long as necessary for the stated purpose, legal/accounting requirements, fraud prevention, contractual administration and dispute resolution. A formal retention schedule should define category-specific periods.

6.9 Destruction

When retention is no longer justified, personal data should be securely deleted, destroyed or anonymized in accordance with applicable requirements.

6.10 Data Subject Rights

Subject to applicable law, individuals may have rights to be informed, access their data, obtain a copy, correct inaccurate data, request destruction where applicable and withdraw consent where consent is the basis. ClickShoppy should provide a dedicated Data Rights Request channel.

6.11 Security

ClickShoppy should implement proportionate controls including encryption, access control, MFA where appropriate, audit logs, secure development, monitoring, backup controls, incident handling and vendor management.

6.12 Children

Where services are not intended for children, ClickShoppy should state the applicable eligibility requirements and implement appropriate controls. Any child-data processing must follow applicable Saudi requirements.

6.13 Updates

Material privacy-policy updates should be dated and communicated appropriately. The policy must be available before or at the point of collection as required by the PDPL.