Privacy and Data Protection Policy

Preamble: This document stipulates the general policy, controls and provisions adopted by the "Concept" platform and application in collecting, processing, operating, technical, and data processing, and its use, protection, sharing, and retention, and the handling thereof. This shall be applied to all users and customers, and all persons interacts with the platform in any form, whether through browsing, registration, purchasing, communicating, submitting requests, or using any of its features, services, technical integrations, payment methods, or support channels. This policy shall be deemed an integral part of the General Terms and Conditions for the use of the "Concept" platform and application and shall be read with them as a single, complementary, and explanatory unit. Using the platform, registering on it, entering data, completing orders, or communicating through it, or continuing to use it after the publication of this policy or any amendment thereto, shall be deemed express, final, and binding consent by the user to all the provisions, controls, processing, disclosures, limits, rights, and obligations contained herein. The user acknowledges expressly that they have reviewed this policy and read it thoroughly, and understand the nature of the data that the platform may collect or receive or that results from it, and understand the purposes for which that data is processed, the parties with which it may be shared, the period for which it may be retained, and the rights they may have regarding it, as well as their agreement to the provisions stipulated in this document within the limits of the laws and instructions applicable in the Kingdom of Saudi Arabia. The platform reserves its right to amend, update, rewrite or replace this policy or add annexes, controls, templates, or instructions related thereto at any time. The amended or updated version shall be effective from the date of its publication, making it available, or referring to it or the continuation of the user in using the platform after whichever is earlier. It is the user's responsibility alone to review it periodically. First: Scope of application and protection: This policy shall be applied to all personal, operational, technical, behavioral, financial, logistical, or communicative data collected, received, established, or generated, or processed or stored or shared or disclosed through the "Concept" platform and application, or because of using them or interacting with them or with any of their functions, services, features, channels, or integrations, or their partners or associated parties. This policy shall be applied to the data provided directly by the user upon registration, browsing, order completion, account update, communication with support, submission of a complaint or request for refund, or sending verification requests or documents, or responding to surveys or interacting with offers, marketing campaigns, or any other function within the platform. This policy also includes the data collected automatically or indirectly through the use of the platform, or through the device or browser or application, or analysis tools or cookies or activity logs or protection tools, or through integrations with payment providers or logistical parties or product providers or technical service providers or regulatory, judicial, or official authorities, whenever that is legitimate and necessary to provide the service or execute the order or protect rights or comply or improve or secure or operate. This policy shall not be limited to data classified as identifying data only, but extends to include data that may be associated with the user directly or indirectly, or that may be related to their account, orders, behavior, device, communication method, or activity within the platform. Second: The Potential types of data collected by the platform: The platform may, according to the nature of the service, product, order, or interaction, or the used tool or the operational stage, collect, receive, or process various types of data, including but not limited to the following: The full name or the name used in the account, or the name appearing in the payment method or in the invoice or in the delivery address or in the correspondences. The mobile number or other communication numbers provided by the user to the platform or associated with their operations or requests or verification procedures or delivery or support. The email address, whether for registration, receiving notifications, communicating, or associated with the payment method or the user's account or their request. The national address or delivery address or any spatial descriptions or directions or landmarks or locations or geographical data associated with executing orders or verification or delivery or re-shipping or refund or delivery failure. Account data, including registration log, date of creation, login and logout operations, verification means, settings, preferences, update logs, and any operational elements associated with account management. Order and purchase data, including those products that were viewed, added to the basket, saved, purchased, canceled, returned, or a refund was requested for them, as well as dates of orders, their values, payment methods, status, and stages of execution. Billing, invoice, and receipt data, and logs of payment and refund, and payment or rejection results, and references associated with operations, disputes, or related claims. Payment method data within the limits allowed by the nature of technical and operational integrations, noting that some sensitive information associated with bank cards or financing entities may be processed or stored by payment providers or financial or financing entities, without the platform retaining all their full details. Technical data, including IP address, device type, operating system, browser type, application version, language, approximate geographical area, session logs, performance data, crash logs, usage patterns, network data, cookies, tracking, analysis, and measurement tools, and any other technical information arising from using the platform. Behavioral or analytical data, including browsing behavior, movement between pages, duration of stay, nature of interaction with products, sections, or offers or notifications or messages or payment methods or order steps, and interest data or preferences or purchasing patterns or indicators derived by operational or analytical systems. Communication and support data, including the content of messages, inquiries, complaints, requests, or reports or attachments or documents or photos or clips or responses or results of processing or escalation or closure. Verification or compliance data, including those documents or photos or proofs or symbols or results or risk indicators or any data required for purposes of identity verification or legitimacy of activity or ownership of payment method or operational safety or anti-fraud. Any other data that the user decides to provide to the platform voluntarily, or that arises from the operational, contractual, financial, or logistical relationship with it, or required by the systems or the interest of operation or protection of rights or compliance. Third: Data sources and how to obtain them: The platform obtains data from multiple sources, and it is not limited to the data written by the user hand in the application or the website, but extends to a broader range of sources and regulatory, operational, and technical entries. The platform may obtain data directly from the user upon their registration in the platform or creation of an account or updating their data or entering delivery address or invoice data or choosing products or completing the order or choosing the payment method or requesting support or filing a complaint or requesting a refund or attaching documents or photos or proofs or when interacting with forms or surveys or messages or offers or loyalty programs or discounts or coupons or other functions or services. The platform may obtain some data automatically through the use of the application or the website or browsing or the device or the network or cookies or analysis tools or measurement or protection tools through system logs, servers, database, and cyber security tools and tools for performance tracking and behavior monitoring. The platform may also receive data from payment providers or bank or financing entities or from Tamara service or from logistical parties or from product providers or from cloud service providers or technical or from support service providers or protection or measurement or parties associated with order execution or verification or refund or settlement or resolution of disputes. The platform may also obtain some data from official, regulatory, judicial, or security authorities or from third parties with a relationship, whenever that is necessary to comply with the systems or for protection or for the protection of rights or for the execution of orders or for the resolution of disputes or for responding to claims or for preventing fraud or misuse of use. The user acknowledges and agrees that the platform may link data received from more than one source or compare them or analyze them or derive indicators or results or operational, security, or commercial classifications from them in the limits allowed by the system and required by the nature of the service or protection or compliance or operation. Fourth: Data processing purposes: The platform processes the data it collects or receives or generates for a number of legitimate and necessary purposes to provide its services, operate its systems, and manage its relationship with users and comply with systems and protect rights and interests. This includes, for example but not limited to: creating accounts and managing them and maintaining their security and effectiveness, and enabling the user to enter the platform and registration in it and benefit from its features, functions, and following up their orders and managing their preferences. These purposes also include executing orders and processing them and transforming them and following them up and updating their status and coordination regarding them with product providers and logistical parties, and verifying identity and address and contacts, and issuing invoices and notifications and order updates and delivery and refund or replacement or return. This also includes management of payment operations, and verification of payments, and reviewing cases of rejection or failure or dispute or refund, and dealing with bank parties or payment providers or financing entities, and reviewing fraud indicators or suspicion or misuse of use. The data is also used to provide technical support and customer service, and responding to inquiries, complaints, and reports and observations, and reviewing conversations, requests, and attachments, and managing follow-up, escalation, settlement, or closure operations. Data is also used to develop the platform and improve its performance and the user experience in it, and analysis of patterns, trends, and behaviors, and measuring operational, marketing, or technical performance, and monitoring work and shortfalls, and understanding more requested products or sections or offers or paths or more or less effective ones. Data may also be used for purposes of security, protection, and detection of illegal, fraudulent, or suspicious or harmful activities, and verification of identity or health of requests or ownership or safety of behavior or patterns and taking appropriate decisions regarding suspending orders or accounts or restricting some functions or preventing some means or reporting relevant parties. Data is also processed for purposes of compliance with systems, instructions, and regulations and orders issued by competent authorities, and protection of rights or defense thereof or preparation of logs or reports or documents necessary for claims or disputes or investigations or internal or regulatory or judicial audits. Some data may be used to send messages or notifications or updates or alerts or disclosures related to the account or request or policy or offers or discounts or marketing or awareness or operational activities, in the limits allowed by systems and elements the user chooses or does not object to within approved means. Fifth: Legal or legitimate basis for processing data: The platform relies, according to the nature of processing, data, and purpose, on one or more of the legitimate or regulatory bases in collecting, processing, using, and disclosing data and retaining it. This includes the user's express or implied consent derived from using the platform or entering data or completing the request or continuing to use services after publication of policies or updates, whenever consent is the most appropriate or necessary basis according to the applied regulations. Processing may also depend on the contractual or operational necessity to execute the order or provide the service or complete delivery or support or refund or payment or verification or account operation or enabling the user from benefiting from the features they requested. Processing may also rely on regulatory or organizational compliance, such as cases required by systems or instructions or judicial orders or regulatory requirements or compliance or accounting or tax or security requirements. The platform may also rely in some processing on its legitimate interests or the interests of the user or others, such as protection of systems, and anti-fraud, and maintaining logs, and improving the service, and analysis of performance, and preventing misuse of use, and defense of rights or resolution of disputes, whenever that is legitimate and does not conflict with the basic rights of the user in the way granted to them by the regulations. Sixth: Limits of using data and non-use of the data for non-legitimate purposes: The platform commits within the limits required by regulations and nature of its activity not to use the data except in the frame of legitimate or expected or announced purposes or necessary to provide the service or its improvement or its protection or compliance or protection of rights or management of the relationship with the user. However, the user acknowledges that some purposes may be intertwined or overlapping in their nature and that data may be used for more than one legitimate purpose at the same time, as the platform may need to re-analyze data or link them or review them or derive indicators from them for purposes other than those it was collected for but still associated with the platform's activity or with protection or with compliance or improvement or operation or defense of rights. This does not mean that the platform is obligated to state every partial processing or analysis or linking or comparison or classification in an independent and detailed manner for every technical or operational case, as long as the general framework for processing is included in the cases allowed by this policy and the relevant laws. Seventh: Sharing data with product providers: The platform may share some data or disclose them to product providers in the amount necessary to execute orders or prepare them or confirm them or review problems or respond to claims or objections or return operations or verification of specifications or implementation of some instructions or obligations associated with the product. This may include user identity data, request data, delivery address, contacts, and some operational information associated with the state of the order or conflict or review, in the necessary limits to deal with the case or execute the product or deal with its effects. The user acknowledges that sharing this data with product providers may be necessary for the nature of the platform's operational model, and that the platform's refrainment from sharing the necessary amount of data may prevent or hinder the execution of the order or its processing or settlement of its problems, as it is acknowledged that some product providers may process this data in the limits of their commercial or regulatory or operational obligations associated with the product or the request. Eighth: Sharing data with logistical parties: The Platform shares some data with logistical parties or entities operating in storage, delivery, re-shipping, return, scheduling, access, or coordination. This is done within the limits necessary to perform their services related to the order, return, or communication with the User, or reaching their address or processing any failure in delivery or any operational communication related to the order. This may include name, mobile number, address, access landmarks, order number, and some delivery notes, coordination data, or delivery verification, and any other elements necessary to perform the logistical task or process the problem associated therewith. The User acknowledges that some of this sharing is necessary and essential to enable delivery or return or re-processing, and that the Platform cannot, in many cases, perform these services without this extent of disclosure or operational exchange. Ninth: Sharing data with payment providers, banks and financing entities: The Platform may share some data with payment providers, banks, or financing entities, or with the Tamara service or any financial or technical party associated with the payment, refund, or credit assessment, dispute, or security review process. This is done to the extent necessary to complete the operation, review, reject, recover, or document it. This may include basic identity data, order data, amount data, transaction time, results, and some operational, technical, or behavioral data associated therewith that the relevant party requests to ensure the integrity of the transaction, its compliance, or its legitimacy. The User acknowledges that these parties may have their own policies, systems, requirements, or independent practices, and that their processing of some data may be carried out according to their own terms and conditions to which the User is also subject by virtue of their choice of that method or service. Tenth: Sharing data with technical, cloud, analytical or operational service providers: The Platform may utilize external parties or providers to provide technical, cloud, analytical, security, operational, communicative, hosting, developmental, logistical, or supportive services. The nature of this utilization may require enabling these parties to access some data or process it or host it or pass it through their systems to the extent necessary to operate the service, perform the function, protect the systems, analyze performance, manage the technical infrastructure, communicate, support, or prevent fraud. The User acknowledges that some processing may take place via external providers or cloud infrastructures or systems or interfaces or tools not managed exclusively within the Platform's own environment. This does not necessarily mean that the processing deviates from the legitimate purposes or violates this policy as long as it takes place within the framework of the service, protection, operation, compliance, development, support, documentation, or project retention of logs. Eleventh: Disclosure to official, judicial, or regulatory authorities: The Platform may disclose data, hand it over, or make it available to official, judicial, regulatory, or security authorities or any competent party whenever such action is required by law or under a binding order or request, or when the Platform—at its legal or regulatory discretion—deems that disclosure is necessary for compliance or to protect its rights or the rights of others, or to cooperate with investigations, or to prevent crime or fraud or misuse of use, or to respond to claims or lawsuits, or to maintain logs, or to execute judgments, procedures, or orders. The Operator is not obligated in such cases to obtain additional approval from the User as long as the disclosure is based on a regulatory, organizational, judicial, or security basis, or a considered legitimate interest permitted by the regulations. Twelfth: Data retention period: The Platform retains data for the period it deems necessary to achieve the purposes for which it was collected or received or established, or for the period required by the nature of the service or the management of orders, accounts, returns, or disputes or lawsuits, or for verification, security, anti-fraud purposes, or to maintain logs, or to comply with regulations and instructions, or to defend rights, or to execute obligations. The retention period may vary according to the type of data, its nature, sensitivity, and the purpose of its processing. The Platform may retain some data or parts thereof even after account closure or application deletion or cessation of use or termination of the contractual relationship if there is a regulatory, organizational, operational, financial, accounting, defensive, or documentary need to retain it. The User acknowledges that account deletion or cessation of use does not necessarily mean immediate or automatic erasure of all data from all systems, logs, or backup copies, especially those that retention is necessary for the preservation of rights or for litigation or for management of disputes or to prevent fraud or for audit or log requirements. Thirteenth: Data security, protection and reasonable measures: The Platform seeks to take reasonable and appropriate technical, administrative, and organizational measures for the nature of its activity and the type of data it handles and the risks associated therewith. This is to limit unauthorized access, or non-compliant use, or modification, or disclosure, or loss, or damage, or misuse, or hacking, or tampering, or disruption. These measures, as the Platform deems appropriate, may include: technical protocols, internal controls and reviews, data protection solutions, cyber security tools, restriction of authorities, monitoring of logs, verification procedures, policies, internal training, and integrations with specialized parties. Other measures the Platform deems necessary or useful or appropriate with the level of risks and nature of the service are also included. Nevertheless, the User acknowledges that any technical, cloud, network, or digital system cannot be guaranteed to be absolutely free of risks, errors, breaches, leaks, failures, attacks, or misuse or human error. The Platform does not provide an absolute guarantee of the impossibility of any technical or security incident occurring despite taking reasonable and appropriate measures. Fourteenth: Dealing with incidents, breaches, and technical risks: In the event of a technical, security, or operational incident affecting some data or systems or infrastructure, or leading to a leak or loss or unauthorized access or disruption or hacking or any suspicion thereof, the Platform has the right to take all measures it deems appropriate, including preventative, curative, or remedial measures, or suspension, or review, or closure, or escalation, or coordination with the relevant parties or affected parties. This is done with the aim of containing the effect, minimizing it, investigating it, preventing its recurrence, or protecting its rights or the rights of users or others or compliance with the regulations. The User acknowledges that some of these procedures may include temporary suspension of some services or accounts or means of access or payment or delivery or request for additional verification or communication or delay in execution of operations or non-disclosure of some technical details if disclosure would threaten security or hinder investigation or violate the system or specialized directives. Fifteenth: Cookies and technical measurement and knowledge tools: The Platform may use cookies or technical knowledge or local storage or analytical or measurement tools or tools to track performance or security or similar means. These tools are used for multiple purposes, including: operating some functions; maintaining preferences; facilitating browsing; measuring performance; improving user experience; understanding usage patterns; detecting failures or fraud or unusual behavior; and supporting some marketing, operational, or security purposes of the project. The User acknowledges that some of these tools are necessary for the Platform's services to operate or to improve their efficiency or security, and that disabling them entirely or partially through device or browser settings may affect some functions of the Platform or the accuracy of some services or their continuity or the quality of their experience. The User also acknowledges that technical knowledge or tracking or measurement tools may allow the Platform or some of its approved providers to measure response, analyze interaction, evaluate the campaign, or performance or repeat visits or non-natural use. This is done within the limits required by the service or protection or improvement or optimization. Sixteenth: Data related to payment methods and financial processing: The Platform relies on payment, financial, or banking providers or external integrations in processing payment and refund operations. Some data associated with these processes and some verification or rejection or review operations are established. Consequently, some data related to payment methods or parts of their details or their reference results or notifications or risk indicators associated therewith are processed, stored, or passed through or retained by those parties or through them. The Platform may retain, within the limits it deems necessary and legitimate, data, logs, indicators, or references associated with the payment, refund, or dispute process, or attempt to pay or verify or suspicion. This is to document the process or review it or link between it and the order or prevent fraud or manage disputes or respond to claims or compliance or preservation of rights. The User acknowledges that some aspects related to payment or refund or financing or post-payment or credit review are subject to the policies of the entities providing the service. The Platform's role in those aspects may be technical or coordinating or operational without it being the sole controller of all details of financial processing or its duration or its results. Seventeenth: Data resulting from communication, support, complaints and disputes: If the User communicates with the Platform via email, phone, conversation, templates, tickets, complaints, support requests, requests for refund, or returns, or objections, or any other means, the Platform may record or save or archive or analyze the content of these communications and the elements associated therewith, such as data, attachments, photos, clips, results, or internal observations or recommendations or directives. This is for purposes of follow-up, verification, quality, and preservation of logs, compliance, and defense of rights. The User also acknowledges that the materials they provide, such as information or documents or evidence or observations in the context of support or complaint or dispute may be used in verification or referral or review or disclosure allowed to the parties with a relationship with the order or payment or delivery or implementation, or by the competent authorities, according to the requirements of the nature of the processing, dispute or claim. Eighteenth: Use of data for purposes of improvement, analysis and development: The Platform may use data and collect them and review them and extract indicators or patterns or results from them for purposes of improving the service and developing the technical structure, functions, interfaces, offers, and sections, and measuring the success of requests, efficiency of delivery, quality of support, accuracy of recommendations, effectiveness of campaigns, combating fraud, monitoring failures and shortfalls, and raising operational and commercial efficiency. This includes preparing internal reports or statistical indicators or operational or evaluation models or behavioral or operational or security or commercial classifications, provided that this is within the framework of legitimate purposes allowed by the regulation and that it observes the requirements of the systems of limits or obligations whenever they apply. The User acknowledges that some of these analyses may take place automatically or semi-automatically or with the participation of tools or external providers, and that their results may be used in taking operational or security or marketing or technical decisions or related to the preference of some offers or means or implementation paths or risk levels or review paths. Nineteenth: Rights related to personal data: Taking into account the systems, instructions, and controls applicable in the Kingdom of Saudi Arabia, the User may submit requests related to their data, such as requesting access to some data, or its correction, or its update, or its completion, or objecting to some aspects of its processing, or requesting its deletion in cases permitted by the systems, or withdrawal of some consents in the systems' limits, through the channels designated by the Platform for this purpose if found. The response to these requests is subject to the nature of the request, type of data, its source, and its association with orders or disputes or payments or obligations or rights or logs or systems or investigations or reviews or claims or requirements of compliance or protection or prevention of fraud. It is also subject to the Platform's ability to execute the order without prejudice to its obligations or rights or the rights of others, or actions the system imposes, such as retention or processing or restriction or refusal of disclosure. Merely submitting the request does not mean the Platform's commitment to accept it or execute it in the form or extent requested by the User; rather, it will be considered and dealt with according to cases permitted by the systems and deemed by the Platform consistent with the legitimate interests and interests and rights of the relevant parties. Twentieth: Limits of the platform's liability regarding data and privacy: To the extent permitted by applicable regulations, the User acknowledges and agrees that the Platform shall not be liable for any damage or loss or cost or claim arising from the User's entry of incorrect, incomplete, or misleading data. It is also not liable for their use of insecure devices or networks or browsers, or for their sharing of their data or account or verification codes or passwords with others, or for their failure to update their data or their failure to follow-up on notifications or for their use of insecure passwords. It is also not liable for practices or policies or technical or operational failures of external parties not controlled by the Platform in a direct manner, as long as the Platform's role therein was limited to integration or passing or coordination or reasonable reliance thereon. The Platform is also not liable for any non-direct or consequential or secondary or future or moral damages or for loss of opportunities or profits or loss of data or business disruption or consequences associated with using the Platform or the occurrence of a technical, security, or organizational incident outside the will or cause by reasons that cannot be prevented or warded off by the Platform with reasonable effort, and within the limits permitted by the system. Twenty-First: Transfer of data or its processing via external systems or providers: The Platform may—according to the nature of operation or hosting or analysis or payment or support or protection or other legitimate functions—utilize systems or tools or providers or cloud or technical structures belonging to external parties. Some processing, storage, exchange, or hosting or review or analysis or support or compliance or maintenance of logs or processing of requests or payments or notifications or disputes may take place through them or across their systems or their technical infrastructure. This is in the amount necessary to provide the service or operate it or protect it or improve it or fulfill or maintain logs or process requests or payments or notifications or disputes. The User acknowledges that the nature of modern digital systems may require a multiplicity of technical or cloud parties associated with the service, and that the mere occurrence of that is not considered a violation of this policy as long as it was in the framework of the project and consistent with the purpose and with the relevant regulations. Twenty-Second: Amendments to the privacy policy The Platform reserves its full and absolute right to amend this policy, update it, re-formulate it, merge it, or partition it, or add annexes or templates or disclosures associated therewith at any time, whether due to a change in systems or regulations or the technical or operational structure or nature of the services or methods of payment or delivery or protection requirements or compliance or for operational or commercial or organizational reasons. The amended or updated version shall be effective from the date of its publication or making it available or pointing to it or the User's continuation in using the Platform thereafter. Such action shall be considered express and final acceptance by the User. It is the User's responsibility alone to review this policy periodically by reviewing the latest published version thereof. Twenty-Third: Communication regarding privacy and data: If the User wishes to inquire about this policy, or submit a request related to their data or its correction or update or object to some of its processing or non-compliance therewith in matters associated with privacy, that shall be through the channels or media adopted by the Platform for this purpose or announced within the application or the website or through approved support channels. The Platform does not commit to considering any request sent via unapproved or insecure channels or without providing sufficient information or proofs or evidence if the request contradicts the systems or with the requirements of verification or with the rights of others or with the interests of protection or compliance or logs or investigation or defense of rights. Twenty-Fourth: Final acceptance: The User's continuation in using the Platform or registering in it or entering their data or completing their orders or payment of dues or interaction with notifications or offers or support or any of its services or characteristics, is considered a final and express and renewed acknowledgment from them that they have read this Privacy Policy and understood its contents and effects, and agreed to its full and final commitment and to all that was stated therein of terms, controls, disclosures, rights, and obligations, and that within the limits permitted by the regulations and instructions applicable in the Kingdom of Saudi Arabia. والله ولي التوفيق،،،