BAQQALATI 🍒 MARKETPLACE — PRIVACY POLICY

Effective Date: June 2026

1. INTRODUCTION

Baqqalati Marketplace ("Baqqalati", "we", "our", or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, process, store, share, protect, and retain your personal information when you use:

www.baqqalati.com
Mobile applications
Cherry Picker AI Assistant
Loyalty programs
Customer support services
Click & Collect services
Future delivery services
Promotional campaigns and marketing communications

This Privacy Policy is intended to comply with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and other applicable regulations.

2. WHO WE ARE

Baqqalati operates an online marketplace platform that connects customers with independent retailers.

For the purposes of applicable data protection laws, Baqqalati acts as a Data Controller for personal information processed through the Platform.

3. PERSONAL DATA WE COLLECT

We may collect the following categories of personal data:

Identity Information:

Full name
Username
Customer ID
Loyalty ID
Date of birth
Gender (if voluntarily provided)

Contact Information:

Mobile number
Email address
Delivery address
Collection location

Account Information:

Login credentials
Passwords (encrypted)
Account preferences
Saved favorites

Order Information:

Order history
Purchased products
Retailers visited
Refund history
Shopping preferences

Payment Information:

Payment method
Transaction details
Payment status

Baqqalati does not store full payment card details unless customer accepts the online risks and confirms that not keeping Baqqalati under any responsibility if adds and saves his card information to quick use for later. Saving card for future quick shopping is optional, under customer's own risk. Payment processing is performed by authorized payment service providers.

Technical Information:

IP address
Browser type
Device type
Operating system
App version
Device identifiers
Log files

Location Information:

GPS location
Collection location
Device location information

Location services are used only when enabled by the customer.

Customer Service Information:

Customer support communications
Complaints
Reviews
Feedback
Survey responses

AI Interaction Information:

Cherry Picker conversations
Shopping requests
Product searches
Voice interactions
AI assistant usage history

Loyalty Information:

Membership information
Reward activity
Points history
Promotional participation

Marketing Information:

Communication preferences
Campaign engagement
Email opens
Click-through information

4. HOW WE COLLECT INFORMATION

We collect information:

Directly from you
When creating an account
When placing orders
When contacting support
Through cookies and analytics technologies
Through loyalty programs
Through Cherry Picker interactions
Through retailer transactions
Through promotional campaigns
Through website and app usage

We may also receive information from:

Retailers
Payment providers
Loyalty partners
Marketing partners
Identity verification providers
Fraud prevention providers

5. WHY WE PROCESS YOUR DATA

We process personal data to:

Create and manage accounts
Process orders
Facilitate Click & Collect services
Process payments
Prevent fraud
Verify identity
Provide customer support
Improve platform functionality
Personalize shopping experiences
Provide Cherry Picker AI services
Recommend products
Analyze customer behavior
Conduct analytics and reporting
Send service notifications
Send marketing communications (where permitted)
Meet legal and regulatory obligations
Resolve disputes
Enforce our Terms & Conditions

We process data only where there is a lawful basis including consent, contractual necessity, legal obligations, legitimate business interests, or other lawful grounds under applicable laws.

6. CHERRY PICKER AI ASSISTANT

Cherry Picker may use:

Order history
Purchase history
Favorite products
Loyalty information
Search history
Browsing activity
Saved preferences
Previous AI conversations

to provide:

Personalized recommendations
Shopping assistance
Product suggestions
Repeat order functionality
Promotional offers
Customer support

Customers understand that Cherry Picker uses automated technologies to generate responses and recommendations. AI-generated responses may not always be accurate and should not be considered professional advice.

7. COOKIES & TRACKING TECHNOLOGIES

Baqqalati uses:

Essential cookies
Functional cookies
Analytics cookies
Performance cookies
Security cookies
Advertising cookies
Personalization cookies

Cookies help us:

Remember preferences
Improve performance
Analyze usage
Detect fraud
Personalize content
Measure marketing effectiveness

Customers may manage cookie preferences through browser settings, although some Platform features may not function properly if cookies are disabled.

8. MARKETING COMMUNICATIONS

With your consent, we may send:

Promotions
Offers
Discounts
Loyalty rewards
Product recommendations
Service announcements

through:

Email
SMS
WhatsApp
Push notifications
In-app notifications

You may unsubscribe from marketing communications at any time. Operational communications relating to orders, security, payments, or account management cannot be disabled.

9. DATA SHARING

We may share personal data only where necessary with:

Retailers — To process and fulfill orders.
Payment Providers — To process payments securely.
Logistics Providers — To facilitate future delivery services.
Technology Providers — Hosting, analytics, customer support, and platform management providers.
Government Authorities — Where required by law, court order, regulatory request, or law enforcement action.
Professional Advisors — Lawyers, auditors, insurers, and compliance advisors.

Baqqalati does not sell personal data to third parties.

10. INTERNATIONAL DATA TRANSFERS

As a general rule, Baqqalati seeks to store and process personal data within the Kingdom of Saudi Arabia. Where operationally necessary, data may be transferred outside Saudi Arabia subject to applicable legal requirements and appropriate safeguards.

11. DATA SECURITY

Baqqalati maintains administrative, technical, physical, and organizational safeguards designed to protect personal data against:

Unauthorized access
Misuse
Disclosure
Alteration
Destruction
Cyberattacks

Security measures may include:

Encryption
Access controls
Monitoring systems
Authentication controls
Security testing
Incident response procedures

No internet-based system can guarantee absolute security.

12. DATA RETENTION

We retain personal data only for as long as necessary to:

Provide services
Fulfill contracts
Meet legal obligations
Resolve disputes
Enforce agreements
Protect business interests

When retention is no longer required, personal data will be deleted, anonymized, or securely destroyed.

13. YOUR PRIVACY RIGHTS

Subject to applicable laws, you may have the right to:

Access your personal data
Receive a copy of your personal data
Correct inaccurate data
Request deletion of personal data
Request restriction of processing
Withdraw consent
Object to processing
Request data portability
File complaints with the relevant supervisory authority

Requests may be submitted through the Contact Us page.

14. CHILDREN'S PRIVACY

Baqqalati is not intended for children under the age of 18 without parental or guardian supervision. We do not knowingly collect personal information from children in violation of applicable laws.

15. FRAUD PREVENTION

We may process personal data to:

Detect fraud
Prevent abuse
Investigate suspicious activity
Protect customers
Protect retailers
Protect Platform integrity

Accounts involved in suspected fraud may be suspended or terminated.

16. SECURITY INCIDENTS & DATA BREACHES

In the event of a suspected or confirmed security incident, unauthorized access, cyberattack, or personal data breach, Baqqalati may:

Restrict account access
Require password resets
Suspend affected services
Conduct investigations
Notify affected individuals
Notify regulatory authorities where required by law

17. THIRD-PARTY LINKS

The Platform may contain links to third-party websites and services. Baqqalati is not responsible for the privacy practices, content, or security of third-party websites.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically. Updated versions will be published on the Platform. Continued use of the Platform after publication constitutes acceptance of the revised Privacy Policy.

19. CONTACT US

For privacy-related inquiries, requests, complaints, or data subject rights requests, please contact us through:

🍒 Send to Our Team
or through the Contact Us section on www.baqqalati.com.

We will make reasonable efforts to respond within the timeframes required by applicable laws.

20. CUSTOMER ACKNOWLEDGEMENT

By creating an account, using the Platform, interacting with Cherry Picker, joining any loyalty program, or placing an order through Baqqalati, you acknowledge that you have read, understood, and accepted this Privacy Policy and consent to the processing of your personal data as described herein.

21. PRIVACY RIGHTS REQUEST PORTAL

Baqqalati provides customers with the ability to exercise their privacy rights through a dedicated Privacy Rights Request Portal.

Customers may submit requests to:

Access their personal data
Obtain a copy of their personal data
Correct inaccurate personal data
Update personal data
Delete personal data where legally permissible
Restrict processing
Withdraw consent
Object to marketing communications
Request data portability
Submit privacy-related complaints

To protect personal information, Baqqalati may require identity verification before processing any request. Baqqalati reserves the right to reject requests where identity cannot be reasonably verified or where disclosure would violate legal, regulatory, security, or contractual obligations.

22. DATA CONTROLLER INFORMATION

Baqqalati Marketplace is the Data Controller responsible for determining the purposes and means of processing personal data collected through the Platform.

For privacy-related inquiries, customers may contact:

Data Protection Officer (DPO)
Email: privacy@baqqalati.com
Website: www.baqqalati.com

The Data Protection Officer is responsible for overseeing compliance with applicable privacy laws and responding to data subject requests.

23. COMPLAINTS AND REGULATORY RIGHTS

Customers who have concerns regarding the processing of their personal data are encouraged to contact Baqqalati first so that we may investigate and resolve the matter.

If a customer is not satisfied with Baqqalati's response, the customer may have the right to submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) or any other competent regulatory authority responsible for personal data protection in the Kingdom of Saudi Arabia.

24. AUTOMATED DECISION-MAKING & PROFILING

Baqqalati may use automated technologies, analytics tools, artificial intelligence systems, machine learning technologies, and profiling mechanisms to improve customer experiences.

These technologies may be used to:

Recommend products
Suggest retailers
Display personalized promotions
Predict shopping preferences
Improve search results
Improve loyalty program experiences
Assist Cherry Picker AI responses
Detect fraud and abuse

Automated recommendations are intended to improve customer experiences and do not produce legally binding decisions without appropriate human oversight where required by law.

25. MARKETPLACE RETAILER DATA SHARING

As a marketplace platform, Baqqalati may share necessary personal information with participating retailers to facilitate order fulfillment and customer service.

Shared information may include:

Customer name
Mobile number
Collection or delivery information
Order details
Product preferences related to the transaction

Retailers receiving customer information are required to process such information only for lawful order fulfillment and customer service purposes and in accordance with applicable privacy laws.

Baqqalati does not permit retailers to use customer data for unrelated purposes without appropriate legal basis or customer consent.

26. DATA MINIMIZATION PRINCIPLE

Baqqalati is committed to collecting only personal data that is reasonably necessary to provide services, comply with legal obligations, protect legitimate business interests, and improve customer experiences. We strive to avoid collecting excessive or unnecessary personal information.

27. DATA BREACH RESPONSE

In the event of a personal data breach, cybersecurity incident, unauthorized access, or data security event affecting personal information, Baqqalati may:

Investigate the incident
Restrict affected accounts
Reset passwords
Implement containment measures
Notify affected individuals where required
Notify regulatory authorities where required by law
Cooperate with law enforcement authorities where appropriate

Baqqalati maintains incident response procedures designed to reduce risks and protect personal data.

28. CONSENT WITHDRAWAL

Where processing is based on customer consent, customers may withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal. Certain services may become unavailable if consent is withdrawn where such consent is necessary to provide those services.

29. PRIVACY ACKNOWLEDGEMENT

By creating an account, joining any loyalty program, placing an order, interacting with Cherry Picker AI, submitting personal information, or otherwise using the Platform, customers acknowledge that they have read, understood, and accepted this Privacy Policy.

Customers further acknowledge that Baqqalati may process personal data as described herein for the purposes of providing marketplace services, customer support, personalization, security, fraud prevention, regulatory compliance, and platform improvement.