Privacy Policy

This Privacy Policy explains how Malek ("we", "us", or "our") collects, uses, stores, and protects personal data when you use the Malek mobile application, website, and related services.

Malek is a supermarket offering food and non-food products.

We are committed to protecting your privacy and handling your personal data responsibly and in accordance with applicable laws and regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL).

1. Information We Collect

Depending on how you use Malek, we may collect the following information:

Account information

When you create a Malek account, we require:

• First name
• Last name
• Mobile phone number
• Email address

Your mobile number is verified using SMS verification.

You may also choose to sign in using Google. When you use Google Sign-In, we receive the information made available to us through that authentication process, such as your name and email address.

You may browse the Malek application without creating an account. However, you must be logged in to place an order.

Delivery and location information

To provide delivery services, we may collect:

• Delivery address
• Location selected by you
• GPS/device location, when you grant the application permission to access it
• Geographic coordinates associated with your selected delivery location

We use Google Maps and related mapping services to help you select and identify delivery locations. For how location access works, see "App Permissions".

Order information

When you place an order, we may collect and store information such as:

• Order details
• Products purchased
• Quantities
• Order value
• Delivery address
• Order status
• Payment status

Payment is made by cash on delivery only.

Shopping information

We may store information relating to your shopping activity, including your shopping cart and products associated with your orders.

Malek currently does not provide a wishlist/favorites feature.

Photos

If you choose to upload a photo, for example with a refund request for a damaged or incorrect product or when reordering items, we only receive the photo you choose to upload.

Communications

We may collect and use your contact information to communicate with you regarding:

• Account verification
• Orders
• Order status
• Delivery
• Customer support
• Service-related notifications

We may communicate with you, including for promotional purposes, through push notifications, SMS, and email.

We may also keep records of your correspondence with our customer support team.

2. App Permissions

Depending on the features you use, Malek may request the following permissions. You can manage these permissions through your device settings. Disabling certain permissions may affect the availability of related features.

Location

Malek may request access to your device location to:

• Help you select your delivery location
• Determine whether delivery is available to your location
• Calculate or determine applicable delivery information
• Support order delivery
• Improve the accuracy of location-related services

You may choose to enter or select your delivery location manually instead. If you deny location permission, some location-based features may not work as intended, but you may still be able to use other parts of the application.

Notifications

Used to provide order updates, delivery information, service messages, and promotional communications.

Photos/Storage

Requested only when you choose to upload a photo.

3. Why We Use Your Personal Data

We use personal data only for purposes related to operating and improving Malek, including:

• Creating and managing your account
• Verifying your mobile number
• Authenticating your account
• Providing access to the Malek application
• Processing and fulfilling orders
• Delivering orders to your selected location
• Measuring and improving delivery, including delivery time and accuracy
• Processing payments and confirming payment status
• Providing customer support
• Communicating with you about your orders and account
• Sending service notifications
• Sending promotional offers and marketing communications
• Improving the performance and reliability of the application
• Detecting and preventing fraud, misuse, and security threats
• Maintaining and improving our services
• Complying with applicable legal and regulatory obligations

We may also use aggregated or statistical information, such as the number of active users, selected addresses, order patterns, and service performance, to improve our services.

We do not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.

4. Legal Basis for Processing

Depending on the purpose and circumstances, Malek may process personal data on an appropriate legal basis under applicable Saudi law, including:

• Processing necessary to provide the requested service or perform an agreement with you
• Compliance with legal or regulatory obligations
• Your consent, where consent is required
• Legitimate interests where permitted by applicable law and where the rights and interests of the data subject are appropriately considered

Where consent is used as the legal basis, you may withdraw that consent where permitted by applicable law. Withdrawal of consent does not affect processing that was lawfully carried out before withdrawal.

5. How We Share Personal Data

We do not sell your personal data.

We may disclose the minimum personal data necessary to service providers and other parties that help us operate Malek, including:

Sign-in

We use Google Sign-In to let you sign in with your Google account.

SMS service provider

We use Taqniyat to provide SMS services, including account and verification messages.

Maps and location services

We use Google Maps and related Google services to provide mapping and location functionality.

Cloud and storage providers

Malek uses DigitalOcean for cloud infrastructure and DigitalOcean S3-compatible storage for certain files and images.

Analytics and crash reporting

We use Firebase Analytics and Firebase Crashlytics. These services may collect technical and usage information such as application interaction information, device information, diagnostics, and crash information. We use this information to understand how the application is used, identify technical problems, improve application performance, and maintain application security and reliability.

Delivery personnel

To fulfill your order, we may provide delivery personnel with information necessary to complete the delivery, which may include:

• Your name
• Phone number
• Delivery address/location
• Relevant order information

Delivery may be performed by Malek personnel or third-party delivery providers, depending on our operational arrangements.

We require service providers handling personal data on our behalf to provide appropriate safeguards and to process data only for authorized purposes.

These providers may process information according to their own terms and privacy policies. We encourage users to review the privacy policies of third-party services where appropriate.

6. International Processing and Data Transfers

Some of our service providers or technology infrastructure may process or store personal data outside the Kingdom of Saudi Arabia.

Where personal data is transferred or processed outside the Kingdom, Malek will apply the safeguards and requirements required under applicable Saudi laws and regulations.

7. Marketing Communications

Malek may send promotional communications, including offers, discounts, and other marketing messages.

We do not currently send marketing communications through WhatsApp.

If you no longer wish to receive marketing communications, you may contact us at [email protected] and request that marketing communications be stopped, where applicable.

Service-related communications, such as order confirmations, delivery updates, account verification, and important service notifications, may still be sent when necessary to provide the service.

8. Data Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or misuse.

These measures include the use of secure communications such as HTTPS/TLS when data is transmitted between the application and our services.

Personal data is stored within our backend systems and cloud infrastructure and access is restricted to authorized systems and personnel as appropriate.

No method of transmission or electronic storage can be guaranteed to be completely secure. However, we continuously work to maintain appropriate safeguards for the personal data we process.

9. Data Retention

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, provide our services, maintain appropriate business and transaction records, resolve disputes, prevent fraud and misuse, comply with legal obligations, and protect our legitimate interests where permitted by law.

When personal data is no longer necessary, we will take appropriate steps to delete, destroy, or anonymize it in accordance with applicable requirements.

Certain order, transaction, accounting, or other records may need to be retained for a longer period where required by applicable law or necessary to establish, exercise, or defend legal claims.

10. Account Deletion

You can delete your Malek account through the application.

When you delete your account, we will take appropriate steps to delete or anonymize personal data that is no longer necessary, except for records we need to keep as described in "Data Retention".

Deleting your account may prevent you from accessing your account, order history, and other account-related services.

11. Updating Your Personal Data

You can update certain information directly through your Malek account, including:

• First name
• Last name
• Email address
• Phone number
• Delivery addresses

You should keep your information accurate and up to date.

You may also contact us if you believe that personal data we hold about you is inaccurate or incomplete.

12. Your Privacy Rights

Subject to applicable laws and regulations, you may have rights relating to your personal data, including rights to:

• Be informed about how your personal data is processed
• Access your personal data
• Request correction, completion, or updating of your personal data
• Request deletion or destruction of personal data when it is no longer necessary
• Exercise other rights available to you under applicable law

Some rights may be subject to legal exceptions or conditions.

To exercise a privacy right or make a privacy-related request, contact us using the details in the "Contact Us" section below.

We may need to verify your identity before responding to certain requests.

13. Users Under 18

Malek may be used by individuals under the age of 18.

Malek does not intentionally design its services specifically for children, and we do not knowingly collect personal data for the purpose of targeting children.

Where a user is under the age of legal capacity, applicable requirements concerning consent, legal guardians, and the exercise of data subject rights will be respected.

Parents or legal guardians who believe that personal data relating to a minor has been processed improperly may contact us using the information below.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements, or data processing practices.

When we make significant changes, we will take reasonable steps to notify users through the application, website, or other appropriate communication channels.

15. Contact Us

If you have questions, concerns, complaints, or requests relating to your personal data or this Privacy Policy, please contact us:

Pinnacle Investment Company

Website: www.malekmarkets.com
Email (including privacy requests): [email protected]

We will review and respond to privacy-related requests in accordance with applicable laws and regulations.

16. Governing Law

This Privacy Policy is governed by the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations.