Privacy policy

We respect your privacy and protect your personal data under the Saudi Personal Data Protection Law and its regulations. This policy explains what data we collect when you use our store, why, who we share it with, and your rights.

Who we are

Cotton foundation, CR: 1009088391, address: Riyadh.
For anything about your data: (email) or 0543124263.

Data we collect

• Contact details: name, mobile number and email.
• Delivery details: city, district and address, or the branch you choose for pickup.
• Order details: products, amounts, payment method, order status and invoices.
• Limited technical data to protect the store, such as IP address and browser type.
• We never store your card details. Cards are entered directly with the licensed payment gateway.

Why we collect it

• To fulfil and deliver your order or prepare it for pickup, and to contact you about it.
• To issue electronic invoices and meet legal obligations, including ZATCA requirements.
• To protect the store and customers from fraud and misuse.
• To send offers and marketing messages only if you agree; you can stop them at any time.

Who we share it with

We never sell or rent your data. We share only what is needed with:

• The online payment gateway, to complete payment.
• Tabby or Tamara if you choose installments: we send your name, mobile, email, address, order details and a summary of your previous orders with us so they can assess the purchase. Their own privacy policies also apply.
• Shipping companies, to deliver your order.
• Our hosting provider, which runs the store's systems.
• Competent government authorities when required by law.

Transfers outside Saudi Arabia

Some data may be stored or processed by service providers with servers outside the Kingdom, such as hosting and payment services. This happens only as needed for the service and under the regulatory controls for data transfer.

Cookies

• We use only essential cookies to run the store, such as your cart, session and language choice.
• We don't use advertising cookies or track you across other websites.
• The store loads fonts from Google Fonts, which may receive your device's IP address.

Data retention

• We keep order and invoice data for the period required by accounting and tax regulations.
• Unpaid orders are deleted automatically after a short time.
• After the purpose and legal period end, data is destroyed or made non-identifying.

Your rights

• To know how and why your data is collected, as explained here.
• To access your data and get a copy.
• To correct, update or complete your data.
• To request destruction of your data when it is no longer needed, unless a law requires us to keep it.
• To withdraw consent for consent-based processing, such as marketing messages.
• To file a complaint with the Saudi Data & AI Authority (SDAIA) if you believe your rights weren't respected.

To exercise any right, contact us at (email); we reply within 30 days.

Data protection

• Connections to the store are encrypted (HTTPS).
• Access to order data is limited to authorised staff, and passwords are stored encrypted.
• If a breach affects your data, we notify you and the competent authority as required by law.

Updates

We may update this policy when our services or regulations change, and we publish the new date at the top of the page.