Jahez Group Privacy Policy

This Privacy Policy (“Policy”) explains how Jahez International Company for Information Systems Technology and its affiliated companies (“we”, “us”, “our”, and first-person pronouns as applicable) collect and use personal data of individuals who visit our websites and/or receive services through any of our mobile applications, including, without limitation, PIK, BLU, and Jahez (collectively, the “Platform”). Protecting your personal data is extremely important to us. We recognize our responsibility to handle your personal data with due care, maintain its security, and comply with legal requirements. Please read this Policy carefully. It contains important information about how we use personal data and explains your legal rights.

This Policy applies only to the Platform and does not extend to the websites of other companies or organizations (including restaurants or stores) that we may link to and that are operated by third parties (including their use of cookies). If you use these links, it is your responsibility to understand how those third parties will use your data. Once you leave our Platform, we have no control over information provided to or collected by third-party links. We are not responsible for those third-party websites.

By visiting and/or requesting services through the Platform, you agree and, where required, provide your consent to the collection, use, and transfer of your information as described in this Policy.

Who We Are

Company Name: Jahez International Company for Information Systems Technology.
Commercial Registration No.: 1010895874
Registered Address: Kingdom of Saudi Arabia – Riyadh 12444 – King Salman District, King Abdullah Road, P.O. Box 2065.

Company Overview: Jahez is a technology company operating in application development. Together with its subsidiaries, Jahez owns multiple applications for delivering products and services, including the “Jahez” application, which enables users to order various products and includes delivery services based on customer requests. This includes the delivery of food and beverages and products from partner restaurants and stores through Jahez applications and website, connecting users with partner establishments and managing the ordering and delivery experience.

What information do we collect from you, and how do we collect it?

We ensure that the collection and processing of personal data is limited to the minimum necessary to provide services and achieve legitimate purposes associated with them. Data is collected directly from the data subject or through lawful and disclosed technical means and is used only within the scope of the purpose for which it was collected, including, for example:

• When you place an order through the Platform, we collect necessary data to fulfill the order: name, mobile number, and address. We may optionally request additional information such as date of birth or gender.
• We may collect information about your use of the Platform, in addition to information you provide in messages you post on the Platform or send to us by email.
• Records of any correspondence we keep with you, including when you contact our delivery drivers via phone calls or WhatsApp, or if you call us by phone or we contact you by phone. We may also monitor and record communications between you and us, including phone calls and emails when you contact customer service, to help us maintain service levels and meet regulatory and legal obligations.
• We may collect technical information from your mobile device or through your use of our services via a mobile device, for example: location data and certain device characteristics/performance, operating system information and service provider details, including device type, connection type, IP address, unique device identifier, and mobile payment methods, where permitted for order fulfillment purposes or required by law. Unless you choose to remain anonymous via your device/platform settings, this information may be collected and used automatically when you use any of our services through our mobile applications, your mobile browser, or otherwise.
• Information you provide by completing forms on our Platform (including “Contact Us” and “News”), including information you provide when subscribing to any of our services or mailing lists (e.g., the financial calendar) or requesting additional services. We may also request contact information when you report a problem with our Platform.
• Details of your visits to our Platform, including (without limitation) traffic data, location data, weblogs, other communication data, and resources you access.
• We may collect information about your computer, including (where available) your IP address, operating system, and browser type for system administration purposes. This is statistical data about browsing actions and patterns of our users and does not identify any individual.
• Your responses to any marketing surveys, restaurant ratings, competitions, or promotional offers we may ask you to complete (noting that you are not obliged to respond).

Minors

We do not knowingly collect personal data about children or individuals under the age of 18, and we do not intend to collect personal data of visitors under 18. However, we cannot verify the age of individuals when they visit the Platform. Therefore, we advise parents to monitor their children’s online activities to prevent their personal data from being collected without parental consent. If you believe that we have collected a minor’s personal data without valid consent and in accordance with applicable laws in the Kingdom of Saudi Arabia, please contact us at [email protected] and we will delete such data.

Cookies

Our Platform uses cookies to distinguish you from other users. This helps us provide you with a good browsing experience and allows us to improve our Platform. For more detailed information about the cookies we use, the purposes for which we use them, and how to remove them, please refer to our Cookies Policy on our Platform.

How do we use your information?

In this section, we explain in more detail:

• The main purposes for which we use your personal information.
• The legal bases we rely on to use your personal information.

Purposes and Legal Bases

To register you as a new customer, process and deliver your order, and manage our relationship with you:

• Collect identity and contact information to register you as a new customer on our Platform.
• Provide access to relevant parts of the Platform and deliver the services you request.
• Perform our obligations under any contracts concluded between you and us.
• Enable us to issue accurate invoices when you pay.
• Manage payment, fees, and amounts payable by you or to you.
• Respond to your requests and inquiries.
• Notify you of changes to our terms and this Privacy Policy.
• Ask you to leave a rating or participate in a survey.
• Contact you for the purpose of delivering requested services (e.g., order delivery or related services).

Legal Basis

Legitimate Interest (for all information): We rely on legitimate interest to provide you with goods and services you request and to process and deliver orders. We also rely on legitimate interest to respond to your inquiries, ensure we can communicate effectively to resolve requests, keep you informed of changes, and maintain relevant records.

Aggregated Data: We may process your data and convert it into aggregated and anonymized data (through which you cannot be identified) for statistical purposes, service development, and research, and we may share such aggregated statistics with third parties without disclosing or identifying you or your personal data.

Consent: Where we cannot rely on legitimate interest to process your personal information for any of these purposes, we will do so only based on your consent.

To ensure the quality of our services and the effectiveness of our Platform:

• When we record customer service calls, we do so to ensure compliance with our terms and conditions, maintain customer service standards, and for training and service improvement purposes.
• Use data analytics to improve our Platform, products, services, marketing, customer relationships, and customer experiences.
• Request your participation in surveys, feedback, restaurant ratings, or other initiatives that help collect information used to develop and improve our products and services.
• Allow you to participate in interactive features of our services when you choose to do so.
• Ensure content is delivered in the most effective manner for you and for computers and mobile devices.
• Notify you of changes to our services.

Legal Basis

Legitimate Interest: We have a legitimate interest in providing the services you request and understanding how our Platform is used and the popularity of displayed content. It is necessary for our legitimate interests to keep our Platform updated and relevant to develop our business.

Consent: Where we cannot rely on legitimate interest for any of these purposes, we will do so only based on your consent.

Marketing and Direct Marketing:

• Provide you with information by phone, SMS, or email about our products or services that you request or that we believe may be of interest to you, where you have consented to be contacted for these purposes.
• If you choose at the device level to start or continue receiving push notifications from us, we may send push notifications related to services you requested, and information about our services and offers. You can stop receiving push notifications at any time by changing your device preferences or contacting us at [email protected].
• Please note that if you use the “Contact Us” tool or the newsroom on our Platform, we may contact you from time to time regarding your initial inquiry. You may request that we stop contacting you at any time by contacting [email protected].
• If you do not wish for us to use your data or you change your mind about being contacted in the future, please inform us by emailing the contact details above and/or updating your profile accordingly.
• We may use your personal data to send direct marketing communications about our promotional offers, experiences, or related services via email, SMS, or targeted online advertising, where you have consented for these purposes.

Legal Basis

Legitimate Interest: We have a legitimate interest in understanding our relationship with you and prospective customers. We rely on legitimate interest to study how you use our products and services in order to develop them, understand market trends and customer purchasing behavior, grow our business, and guide our marketing strategy.

Consent: Where we cannot rely on legitimate interest for any of these purposes, we will do so only based on your consent.

Internal business purposes:

• Internal reviews, Platform and system administration, and internal audit.
• Managing and protecting our business and Platform, including troubleshooting, data analysis, testing, system maintenance, support, reporting, and data hosting.
• Data analytics to predict future purchasing trends and customer behaviors.

Legal Basis

Legitimate Interest: It is necessary for our legitimate interests to ensure appropriate management and to secure IT services and network security to prevent fraud and cybercrime and to operate our business.

Legal Obligation: Where we do not rely on legitimate interest, we will process data to comply with a legal obligation.

To comply with our legal and regulatory obligations:

• Help prevent and detect fraud and losses.
• Where necessary, comply with applicable laws in the Kingdom of Saudi Arabia.
• Manage, support, enhance, and develop our business for any other purpose (statistical or analytical) and help us prevent fraud.
• As required to meet legal obligations, resolve disputes, or comply with requirements of the Saudi Data and AI Authority (“Competent Authority”).

Legal Basis

For all information – legal obligation and/or legitimate interest. As a company, we have a legitimate interest in ensuring our business undertakes appropriate risk management processes. We also have legal obligations to report and comply with applicable laws and regulatory obligations.

On what legal basis are we entitled to process your data?

As described above, we process your information in accordance with the PDPL in the Kingdom of Saudi Arabia and its Implementing Regulations (“Regulations”) based on one of the following legal bases:

• Article 5 of the PDPL and Article 11 of the Regulations – you have provided clear consent to process your personal data.
• Article 6(2) of the PDPL – compliance with a legal obligation.
• Article 6(4) – our legitimate interests as a company, including (without limitation) providing services, processing and delivering orders, marketing our products and services, and conducting data analytics to predict future market trends and behaviors.

How long will we retain your data?

Your personal data will be stored for as long as necessary to achieve the purpose for which it was collected, unless a longer retention period is required to comply with another law or a legal purpose (e.g., a court order) or under rules and regulations we must comply with.

• When storing data, we take all reasonable steps to protect personal data from misuse, loss, unauthorized access, modification, or disclosure.
• Personal data is archived in a secure environment and subject to best practices and internal restrictions to protect it.
• If destruction is required, personal data is destroyed using secure methods that ensure anonymization to prevent re-identification.

Who do we disclose your information to?

Our service providers

We disclose information to service providers who provide services on our behalf. During the lifecycle of your account, the identity and categories of third parties may change. Your data will only be used by third-party providers to deliver services to us, and each provider is subject to terms consistent with this Policy. We have a legitimate interest in engaging with service providers to deliver our services.

We use the following types of external service providers:

• Website management and hosting providers.
• Database software providers, sales management, and market engagement tools.
• Payment solution providers.
• Fraud prevention agencies (creditworthiness decisions, identity verification, fraud/AML prevention, account management).
• Survey and market research providers.
• Email communication tools and webinar platforms.
• Partner restaurants and stores you order from, and logistics companies delivering purchased goods.
• External printing providers.
• External auditors where required for legal and regulatory compliance.

Other third parties

We may disclose your personal data to any member of our group, including our subsidiaries, our parent holding company, and its subsidiaries.

We may also disclose your personal data to third parties:

• If we sell or buy any business or assets, we may disclose personal data to the prospective seller or buyer.
• If you request or permit disclosure of information to a third party.
• If Jahez International Company for Information Systems Technology, or substantially all its assets, is acquired by a third party, personal data held about customers may be transferred as part of the assets.
• If we are under a duty to disclose or share your personal data to comply with any legal or regulatory obligation.

How do we protect your data?

We are committed to protecting your personal data by implementing strong security and privacy measures to safeguard personal data and information from unauthorized access, use, or loss, including:

• Protection against data breaches and hacking incidents.
• Implementing relevant controls, standards, and rules issued by the National Cybersecurity Authority (NCA), including best practices and cybersecurity standards.
• Any requirements imposed by competent authorities.

Where do we store your information and do we transfer your data outside Saudi Arabia?

As we are located in the Kingdom of Saudi Arabia, the information we collect from you will be transferred to, and stored/processed within, the Kingdom. A limited number of our service providers are located outside the Kingdom. As of the date of this Policy, one of our service providers is located in Germany. This may change if we decide to use different service providers.

Accordingly, data we collect from you may be transferred to, stored, and processed in a destination outside the Kingdom of Saudi Arabia. We will always take necessary measures to ensure that any international transfer of personal data is carefully managed to protect your rights and interests. In particular, we will either:

• Transfer your personal data only to countries that provide an adequate level of legal protection and are approved by the competent authority; or
• Ensure that transfers outside the Kingdom are subject to appropriate legal safeguards, such as standard contractual clauses or binding corporate rules.

Your Rights

You have the right to ask us not to process your personal data for marketing purposes.

You may exercise this right at any time by contacting us at [email protected].

You have the right to request more information about safeguards we have put in place regarding data transfers.

We will not process any sensitive personal data without obtaining your explicit consent in accordance with the PDPL and applicable regulations in the Kingdom of Saudi Arabia.

As a data subject, you have the following rights:

• The right to be informed about the use of your personal data.
• The right to access your personal data.
• The right to request correction of your personal data, including data that requires updating.
• The right to request destruction or deletion of your personal data.
• The right to request your personal data in a clear and readable format.
• The right to withdraw consent at any time.
• If you have a complaint relating to processing under this Policy, you have the right to file a complaint with the competent authority.

You may seek to exercise any of these rights by updating your information online (where possible) or by sending a written request to [email protected].

Complaints and Response Time

If you have any complaint, objection, or request relating to the processing of your personal data under this Policy, you have the right to submit such a request or complaint to us.

You may submit your request or complaint by email to [email protected].

We shall review and respond to data subject requests and complaints within a period not exceeding thirty (30) days from the date of receipt, in accordance with the Personal Data Protection Law (PDPL) and its Implementing Regulations.

If you are not satisfied with our response, you have the right to submit a complaint to the competent authority.

Changes to Our Privacy Policy

We may make changes to this Policy from time to time, for example, to keep it updated, to comply with legal requirements, or due to changes in how we operate our business. We will endeavor to notify you of any material changes by sending a message to the email address you have most recently provided, or by posting a notice on the Platform so you are aware of the impact of changes on data processing activities before you continue interacting with us. We encourage you to review this Policy regularly so you remain aware of what information we collect, how we use it, and with whom we share it.

Contact

If you have any complaints or issues relating to this Policy, including data subject rights requests, or if you have any questions, comments, or requests regarding this Policy, please contact us at: [email protected].

VAT Registration Certificate