1. Introduction and scope
ON OFF Limited Company (“ON OFF”, the “Company”, “we”, or “us”) respects the privacy of users of its websites, applications, and digital services. This policy explains how we collect, use, protect, share, and retain your personal data, and the rights you may exercise in relation to it.
This policy applies to the Company’s digital services that link to this page, including the website, the ordering application and customer services, and operational systems used by employees and authorized users, depending on the nature of each service.
2. Data controller and contact details
The personal data controller is ON OFF Limited Company, a limited liability company registered in the Kingdom of Saudi Arabia.
- Unified National Number: 7009082376 (according to the commercial registration certificate issued on 9 November 2020).
- National address stated in the supplied document: Kingdom of Saudi Arabia, Riyadh, Al Manar District, Al Shafii Street, Building 7565, Additional Number 2140, Postal Code 14221, Short Address RQMA7565.
- Website: https://onoffcoffee.com.
- Privacy contact email: [email protected].
- Website contact form: https://onoffcoffee.com/en/contact/.
You may contact us at the email address above to request access to, correction of, or deletion of your data, or to submit a privacy inquiry or complaint.
3. Personal data we may collect
Account and contact data: such as your name, mobile number, email address, account identifier, and login details required for the service.
Order and service data: such as selected products, branch, order and collection times, delivery address when needed, order notes, purchase history, and customer service details.
Location data: your location or address to identify nearby branches or facilitate delivery, if you request the service and grant the necessary permissions where required. You may disable location permissions in your device settings.
Transaction data: such as the order amount, payment method and status, and the transaction number or reference supplied by the payment provider. When electronic payment is used, bank card details are processed in accordance with the approved payment provider’s procedures and requirements, without assuming that the Company stores full card details.
Technical data: such as Internet Protocol (IP) address, device and browser type, session data, error and login logs, and cookies when used.
Optional data: such as order preferences, marketing communication preferences, and loyalty program or promotional offer data, if these services are enabled.
Internal system user data: such as staff name or work identity, branch, role and permissions, login logs, and actions performed by the user, including creating and approving operational requests, inventory movements, and tracking batches and waste, where these functions are available.
4. How we collect data
We collect data you provide directly when creating an account, placing an order, contacting us, or using website and application forms. Some information may be collected automatically when you browse or use the application.
Where necessary and lawful, we may also receive data from login, payment, delivery, or other contracted service providers, to the extent required to provide the service or verify a transaction.
5. Purposes and legal bases for processing
We use data to manage accounts and verify user identity, fulfill orders and deliver them or prepare them for collection, process payments and refunds, provide customer service, and manage enabled loyalty programs and offers.
We also use data to secure systems and prevent misuse, improve performance and resolve faults, prepare statistics and operational reports, manage employee permissions, and track actions and approvals within the Company’s systems.
Depending on the circumstances, processing is based on performing the contractual relationship or providing the requested service, meeting legal obligations, your consent where required, or another lawful basis permitted under the Personal Data Protection Law. We do not use your data for marketing purposes that require consent until we have obtained that consent in accordance with the law.
6. Mandatory and optional data
Data needed to create an account, complete an order, secure an account, or comply with legal requirements is mandatory for the relevant service. Failure to provide it may prevent account activation, order completion, or the provision of certain services.
You may choose not to provide marketing preferences, non-essential location permissions, and other optional data; related personalization features may then be unavailable.
7. Sharing data with other parties
We may share the minimum necessary data with payment providers, delivery companies, hosting, technical support, messaging, and analytics providers, or with authorized branches and teams within the Company, according to each party’s role and the needs of the service.
We may disclose data to a competent public or judicial authority where required or permitted by law. We do not sell your personal data to other parties. Service providers are subject to appropriate protection and confidentiality obligations under their contracts and applicable legal requirements.
8. Data storage and transfers outside Saudi Arabia
Data is stored in systems and databases approved by the Company or its contracted service providers, with access restricted according to permissions and work-related needs.
The Company may use hosting systems, cloud services, technical support, and data processing providers, including tools related to application and order operations. Actual processing locations depend on the systems and suppliers used by the Company. The Company must identify hosting locations and relevant countries and disclose them to users where legally required.
If the service requires data to be transferred or made accessible outside the Kingdom, this will take place only after verifying the lawful basis and necessary safeguards under the applicable Saudi laws and regulations.
9. Data retention and destruction
We retain personal data only as long as necessary to fulfill the purpose for which it was collected, meet a legal or contractual obligation, or protect legitimate rights in accordance with the law. Retention periods vary by data category, including account, order, and invoice records, access logs, and operational records.
Account data is retained in line with the continuing need to operate the account and service and meet the Company’s obligations. Invoices and financial transactions are retained for the periods required by tax and accounting laws. Login and security logs are retained under the approved information security policy for as long as needed for their security purpose. Consent-based marketing data is reviewed or its processing stopped when consent is withdrawn, subject to legal obligations.
Once the purpose and required retention period have ended, data is appropriately deleted, destroyed, or anonymized, unless a lawful basis exists for retaining it.
10. Data protection and security incidents
We take appropriate organizational and technical measures to protect data against unauthorized access, loss, alteration, or unlawful disclosure. As needed, these include access controls, permission management, security monitoring, and protection of communications and backups.
Although no digital service can be guaranteed entirely risk-free, we handle security incidents and breach reports in accordance with applicable procedures and legal requirements, including required notifications to competent authorities and data subjects where the relevant conditions apply.
11. Your personal data rights
Under the Personal Data Protection Law and its regulations, and subject to legal exceptions, you have the right to know the reasons and purposes for processing your data, access it and request a copy, request correction, completion, or updating, request destruction of data that is no longer needed, and withdraw consent to processing based on consent.
To exercise these rights, email the privacy contact listed in section 2 and specify your request and the data concerned. We may request appropriate information to verify the requester’s identity before disclosing any information. We handle requests within statutory timeframes and procedures; some data may continue to be retained where required by law.
12. Marketing messages and offers
We may send you marketing offers and updates if you consent in accordance with legal requirements. You may withdraw consent or unsubscribe using the option provided in the message, your account settings, or by contacting us.
Non-marketing messages needed to confirm orders, verify an account, or notify you of essential service updates may continue.
13. Cookies and analytics
The website may use cookies or similar technologies to operate sessions, remember preferences, measure service performance, and improve the user experience. The types of cookies and analytics parties used depend on the website’s actual configuration.
You can manage some cookies through browser settings or a preference panel, if available. Disabling essential operational cookies may prevent some functions from working. Optional analytics and tracking tools are enabled in accordance with the actual configuration and necessary legal controls and consents.
14. Use of operational systems by employees and authorized users
If you use one of the Company’s operational systems, access, modification, approval, tracking, requests, and inventory movements may be logged, together with the time of the action, work identity, and associated branch, to preserve operational integrity and accountability and prevent unauthorized use.
Access to these logs is restricted to authorized personnel for operational, oversight, security, and compliance purposes. Applicable statutory retention, protection, and personal data rights requirements apply to these records.
15. Children and external links
Our services are not deliberately intended to collect children’s data without a lawful basis or guardian consent where required. If we discover that data has been collected in breach of legal requirements, we will take appropriate action.
The website or application may contain links to third-party services, which are governed by their own privacy policies. We recommend reviewing those policies before providing any data.
16. Updates to this privacy policy
We may update this policy if our services, data processing practices, or legal requirements change. We will publish the updated version with its last updated date, and provide additional notice or request fresh consent where legally required.
17. Inquiries and complaints
For any privacy inquiry or request, you may email [email protected] or use the Contact Us page on the Company’s website. If you are dissatisfied with the handling of your complaint, you may approach the competent regulatory authority through the channels and procedures applicable in the Kingdom of Saudi Arabia.