This policy explains what data the Jomla Aljomla platform collects, why, who we share it with, and what rights you have over it. It covers the website, the mobile app and every service we provide. It is governed by the Saudi Personal Data Protection Law and its regulations.
1. What we collect
a. What you give us directly
- Account details: full name, mobile number, email if you provide one, and a profile photo if you upload one.
- Addresses: your delivery address and its label, including map coordinates if you choose to pin the location.
- Business details: whatever you enter about your shop or business.
b. What your use generates
- Orders and their contents, invoices, and the order status history.
- Your cart, your favourites, and the products you browse.
- Loyalty point balance and transaction history, your referral code and who signed up through it.
- Notifications sent to you and whether they were read.
c. Technical data
- The device push token issued by Firebase, which is what lets an order notification reach your phone.
- Device type, operating system, app version, and technical error logs.
- IP address and sign-in logs, used for security and to prevent abuse.
2. What we do not collect
We never store your bank card details on our servers. Payment happens entirely at the licensed payment gateway; all we receive back is the outcome (success or failure) and the last four digits, so the payment method can be identified on the invoice.
3. Why we use your data
- To fulfil, deliver and invoice your order — the primary purpose.
- To contact you about a live order: confirmation, status change, failed delivery, an item running out.
- Support, complaints and returns.
- Security: detecting fraud and preventing abuse of the loyalty and referral programmes.
- Improving the service and understanding which products are most in demand, in aggregate rather than individually.
- Legal obligations, including retaining invoices as ZATCA requires.
4. Legal basis
We process your data on the basis of performing our contract with you when you buy, legal obligation for invoicing and tax, legitimate interest in keeping the platform secure, and your consent for marketing notifications and location access — the last two you can withdraw at any time.
5. Who we share it with
We do not sell your data to anyone. We share it only as far as necessary with:
- Our payment provider (Moyasar) — to complete electronic payment. Card details are entered with them directly and never reach our servers.
- Delivery companies — the driver receives only your name, mobile number and address, without which delivery cannot happen.
- Firebase, by Google — to deliver notifications to your device.
- Authentica, our SMS provider (a Saudi company) — your mobile number and the verification code only, to text the code when you sign up or reset your password.
- Microsoft Azure Maps, with Google Maps as a fallback — only when you use the location picker, to show the map and the place name.
- Competent authorities — where there is a binding legal request.
Where your data is kept: the platform's data is stored with our cloud provider, Microsoft Azure, in a data centre outside the Kingdom, and some of the providers above (Google and Microsoft) also process data outside it. Only what the service needs is transferred, protected by encryption in transit and access controls, and the transfer is subject to the cross-border provisions of the Personal Data Protection Law and its regulations.
6. Location
We only ask for your location when you choose to pin a delivery address on the map or find your nearest branch. You can refuse or withdraw the permission in your phone settings and still enter your address manually. We do not track your location in the background.
7. How long we keep it
- Account details: for as long as your account is active.
- Orders and invoices: at least ten years, as Saudi invoicing and tax regulations require, even after an account is deleted.
- Push tokens: deleted automatically when you sign out or when the token stops working.
- Security logs: a limited period, enough to investigate incidents.
8. Your rights
- Access the data we hold about you and receive a copy.
- Correction — and most of your details you can edit directly in the app.
- Deletion, subject to the invoices we are legally required to retain.
- Withdraw consent for marketing notifications or location access at any time.
- Object to a particular processing, and complain to the competent supervisory authority: the Saudi Data and AI Authority (SDAIA).
To exercise any of these, contact us using the support details at the foot of this page; we respond within a reasonable period.
9. How we protect your data
- Passwords are stored one-way hashed and cannot be read by anyone here.
- All communication with the platform is encrypted over HTTPS.
- Fine-grained permissions in the admin panel: each staff member sees only what their job requires, and some permissions are confined to a single branch.
- Payment and delivery provider credentials are stored encrypted, not in plain text.
- No system is perfectly secure, but we review our practices continuously and will notify you if a breach affects your data.
10. Cookies
We use cookies necessary to run the site: keeping you signed in, remembering your language, and saving your cart. We do not use advertising cookies to track you across other sites.
11. Children's privacy
The platform is aimed at businesses and adults. We do not knowingly collect data from anyone under eighteen, and we delete it if we learn we have.
12. Updates to this policy
We may update this policy; the last-updated date appears at the top of the page. If a change is material we will tell you through the app or directly.
13. Contact
For any question or request about your data, contact us using the support details at the foot of this page.
