Privacy Policy

KARTSEEK operates a multi-service platform in Saudi Arabia covering marketplace, grocery, food delivery, pharmacy, and related services. For personal data collected from users in Saudi Arabia, KARTSEEK acts as the data controller.

This notice is issued under Personal Data Protection Law, Royal Decree M/19 of 2021. Our processing in Saudi Arabia is supervised by the Saudi Data & AI Authority (SDAIA).

We collect only what a given service needs to work, and we tell you at the point of collection why we need it.

• •Account details — name, mobile number, email address, and password credentials.
• •Delivery details — the addresses you save, and the location you share when you ask us to find nearby stores.
• •Order and payment records — what you bought, when, and the payment method used. Card numbers are handled by our payment providers and are never stored on KARTSEEK systems.
• •Device and usage data — the pages you visit and the device you use, for security and for the analytics you have consented to.
• •Support correspondence — messages you send us and our replies.

Under PDPL, we process your personal data on the basis of your consent, except where processing is necessary to perform a contract with you (delivering an order you placed), to comply with a legal obligation, or to protect a vital interest.

Consent is requested affirmatively — nothing beyond what the service strictly needs is switched on before you agree. You can withdraw consent at any time from Privacy Settings in your account, and withdrawal does not affect processing already carried out.

PDPL gives you the following rights over your personal data. You can exercise any of them from Privacy Settings in your account, or by contacting our Data Protection Officer at [email protected]. We respond within 30 days.

• •Be informed
• •Access
• •Request a copy
• •Rectification
• •Destruction
• •Withdraw consent

We share personal data only with parties who need it to deliver the service you asked for:

• •The seller or restaurant fulfilling your order — your name, contact number and delivery address.
• •The delivery partner assigned to your order — the same details, for the duration of the delivery.
• •Payment providers licensed in Saudi Arabia, to take and settle your payment.
• •Service providers who host and secure our systems, bound by written processing agreements.
• •Public authorities, where we are legally required to disclose.
• •We do not sell personal data.

Personal data collected from users in Saudi Arabia is stored and processed in-region by default.

Where a transfer outside Saudi Arabia is unavoidable — for example a global service provider — we transfer only under the conditions PDPL permits, with contractual safeguards that carry the same level of protection, and we do not transfer at all where doing so would prejudice those protections.

We keep your account while it is open. Order, payment and invoice records are retained for 5 years to meet commercial and tax record-keeping obligations in Saudi Arabia, after which they are deleted or irreversibly anonymised.

When you delete your account we remove your profile and contact details immediately, and retain only the transaction records we are required to keep.

Data is encrypted in transit and at rest, access is restricted to staff who need it for their role and is logged, and payment card data never touches our systems.

If a breach affects your personal data we notify the Saudi Data & AI Authority (SDAIA) and the individuals concerned within 72 hours of becoming aware of it, as PDPL requires.

KARTSEEK is not intended for anyone under 18. We do not knowingly collect personal data from children below that age; where we learn that we have, we delete it.

Alongside PDPL, our operations in Saudi Arabia are subject to:

• •ZATCA e-invoicing (Fatoora)
• •SAMA payment services rules

Data Protection Officer — [email protected].

If you are not satisfied with our response you can complain to the Saudi Data & AI Authority (SDAIA).