Privacy Policy

KASSR ("we", "us", or "our") operates the KASSR marketplace platform, including our website, mobile applications, and all related services (collectively, the "Platform"). This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal data when you access or use our Platform. This Privacy Policy is issued in compliance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), effective September 14, 2024, and its implementing regulations as issued by the Saudi Data & Artificial Intelligence Authority (SDAIA). By accessing or using KASSR, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Platform immediately.

We collect the following categories of personal data: • Account Information: Full name, email address, phone number, and encrypted password when you register an account. • Identity Verification: Government-issued ID information when required for merchant or captain registration. • Transaction Data: Purchase history, negotiation records, accepted/rejected offers, payment confirmations, and order details. • Payment Information: Payment method details are processed securely by our PCI DSS-compliant payment processor (Stripe). KASSR does not store your full card numbers. • Location Data: Delivery addresses provided by you, and with your explicit consent, real-time GPS location for live delivery tracking. • Device & Technical Data: IP address, browser type and version, operating system, device identifiers, and access timestamps for security monitoring and fraud prevention. • Usage & Analytics Data: Pages visited, features used, search queries, interaction patterns, and session duration to improve our services. • Communications: Messages exchanged through our platform between buyers, merchants, and delivery captains, retained for dispute resolution and quality assurance.

Under the PDPL, we process your personal data on the following legal bases: • Consent: Where you have given explicit consent for specific processing activities, such as location tracking and marketing communications. • Contract Performance: Processing necessary to fulfill our contractual obligations to you, including order processing, payment facilitation, and delivery coordination. • Legal Obligation: Processing required to comply with applicable laws and regulations in the Kingdom of Saudi Arabia, including tax reporting, fraud prevention, and responding to lawful government requests. • Legitimate Interest: Processing necessary for our legitimate business interests, such as platform security, fraud detection, service improvement, and analytics, provided these interests do not override your fundamental rights and freedoms. You may withdraw your consent at any time by contacting us at privacy@kassr.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

We use your personal data strictly for the following purposes: • Service Delivery: To operate, maintain, and provide you with the full functionality of our marketplace, including account management, product browsing, negotiation facilitation, order processing, and delivery tracking. • Transaction Processing: To facilitate negotiations between buyers and merchants, process payments through Stripe, coordinate deliveries with captains, and generate order confirmations and receipts. • Identity & Security: To verify your identity, detect and prevent fraud, abuse, and unauthorized access, and to maintain the security and integrity of our Platform. • Communications: To send you essential service communications including order updates, delivery notifications, payment confirmations, and critical account alerts. You cannot opt out of these transactional messages. • Personalization: To provide store recommendations, relevant product suggestions, and localized content based on your browsing history, location, and preferences. • Customer Support: To respond to your inquiries, process complaints, and provide technical assistance. • Legal Compliance: To comply with applicable laws, regulations, and legal processes in the Kingdom of Saudi Arabia, including the E-Commerce Law and PDPL. • Platform Improvement: To conduct analytics, research, and testing to improve our services, develop new features, and optimize user experience.

KASSR does not sell, rent, or trade your personal information to third parties. We share your data only in the following circumstances: • Merchants: Your name, delivery address, and order details are shared with merchants solely to fulfill your orders. • Delivery Captains: Your name, phone number, and delivery address are shared with assigned captains exclusively for delivery purposes. • Payment Processor (Stripe): Your payment information is transmitted directly to Stripe for secure processing. Stripe is PCI DSS Level 1 certified. We never access or store your full card details. • Infrastructure Providers: Trusted service providers who assist in operating our platform, including cloud hosting (Vercel, Supabase), email delivery, and analytics services, all bound by data processing agreements. • Legal Authorities: When required by law, court order, regulatory request, or governmental directive in the Kingdom of Saudi Arabia, or to protect the rights, property, or safety of KASSR, our users, or the public. • Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity. You will be notified of any such transfer and given the opportunity to delete your account.

Your personal data may be transferred to and processed in countries outside the Kingdom of Saudi Arabia for the purpose of cloud hosting, payment processing, and service delivery. Specifically: • Cloud infrastructure services may process data in data centers located internationally. • Payment processing through Stripe may involve data transfer to Stripe's secure servers. When transferring data outside the Kingdom, we ensure that: • The receiving country provides an adequate level of data protection as determined by the SDAIA, or • Appropriate safeguards are in place, including binding contractual clauses that require the recipient to protect your data to the same standard as required by the PDPL. You may request further details about our cross-border transfer safeguards by contacting privacy@kassr.com.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specific retention periods include: • Account Data: Retained for the duration of your active account, plus 12 months after account deletion to handle any pending disputes or legal obligations. • Transaction Records: Retained for 7 years from the transaction date, as required by Saudi tax and commercial regulations. • Communication Logs: Retained for 2 years for dispute resolution and quality assurance purposes. • Device & Usage Data: Retained for 24 months for security and analytics purposes. • Payment Records: Retained by Stripe in accordance with their privacy policy and PCI DSS requirements. After the applicable retention period expires, your data is securely deleted or anonymized so that it can no longer identify you.

We implement comprehensive technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, or alteration: • Encryption: All data in transit is encrypted using TLS 1.3 protocols. Sensitive data at rest is encrypted using AES-256. • Password Security: User passwords are hashed using bcrypt algorithms with salting and are never stored in readable form. • Access Controls: Access to personal data is restricted to authorized personnel on a strict need-to-know basis, enforced through role-based access controls (RBAC). • Security Monitoring: We conduct continuous security monitoring, regular vulnerability assessments, and periodic penetration testing. • Payment Security: All payment processing is handled by Stripe, a PCI DSS Level 1 certified processor — the highest level of payment security certification. • Incident Response: We maintain a documented incident response plan. In the event of a data breach that poses a risk to your rights and freedoms, we will notify SDAIA and affected individuals in accordance with PDPL requirements. While we implement industry-leading safeguards, no security system is impenetrable. We cannot guarantee absolute security, but we commit to promptly addressing any security incident.

We use cookies and similar technologies for the following purposes: • Essential Cookies: To maintain your login session, remember your language preference, and ensure the platform functions properly. These cannot be disabled. • Analytics Cookies: To analyze traffic patterns, understand feature usage, and measure platform performance. These help us improve your experience. • Security Cookies: To detect and prevent fraudulent activity and protect your account. We do not use advertising or third-party tracking cookies. You may control non-essential cookie settings through your browser preferences. Please note that disabling essential cookies will impair platform functionality.

In accordance with the Saudi Personal Data Protection Law (PDPL), you have the following rights: • Right to Be Informed: You have the right to know what personal data we hold about you and how it is processed. • Right of Access: You may request a copy of all personal data we hold about you in a structured, commonly used format. • Right to Correction: You may request correction of any inaccurate, incomplete, or outdated personal data. • Right to Deletion: You may request deletion of your personal data, subject to legal retention requirements and legitimate business needs. • Right to Data Portability: You may request your data be provided in a machine-readable format for transfer to another service. • Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances. • Right to Object: You may object to processing based on legitimate interest, including direct marketing. • Right to Withdraw Consent: You may withdraw your consent at any time, without affecting the lawfulness of prior processing. To exercise any of these rights, submit a request to privacy@kassr.com. We will respond within 30 days. You also have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe your data protection rights have been violated.

KASSR is not intended for use by individuals under the age of 18. We do not knowingly collect, process, or store personal data from minors. If you are a parent or guardian and believe that a child under 18 has provided us with personal information, please contact us immediately at privacy@kassr.com. We will take prompt steps to identify and delete such data from our systems.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or platform features. When we make changes: • The "Last Updated" date at the top of this policy will be revised. • For material changes that significantly affect how we process your data, we will notify you via email or through a prominent notice on our Platform at least 30 days before the changes take effect. • Continued use of KASSR after the effective date of any changes constitutes your acceptance of the revised policy. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us through any of the following channels: • Privacy Inquiries: privacy@kassr.com • General Support: support@kassr.com • Headquarters: Riyadh, Kingdom of Saudi Arabia Supervisory Authority: If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the competent regulatory authority for data protection in the Kingdom of Saudi Arabia.