A. From Customers:

• Personal Information: Names, email addresses, phone numbers, physical addresses, gender, nationality and customer identification numbers
• Transaction Details: Purchase history, order details, payment information, and billing records.
• Location Data: Geographic locations for order fulfillment and delivery services
• Loyalty Program Data: Membership details, rewards points, and usage history.
• Customer Behavioral and Preference Data: Shopping preferences and behaviors such as items added to and abandoned in shopping carts.
• Online Interaction Data: Browsing history, preferences, and interactions with our digital platforms.
• Device Information: Types and specifications of devices used to access our services
• Feedback and Survey Data: Responses and insights from customer surveys and feedback mechanisms.
• Security Information: CCTV footage for ensuring the safety and security of our premises and customers.
• Customer Service Interaction Records: Details from interactions with our customer service, including communications via emails and calls.
• Social Media Interactions: Data from your interactions with our social media channels.

B. From our Suppliers, Contractors, and Third-Party Vendors:

• Professional Information: Job titles, roles within the organization, and professional qualifications.
• Financial Information: Details related to financial transactions and banking data.
• Legal Data: Contracts, compliance documentation, and other related legal information.

• Direct Collection: Through customer interactions on our websites, mobile apps, at physical stores, during promotional events, and through customer service conversations.
• Automated Collection: Using cookies and similar tracking technologies that collect information about your interactions with our website and applications.
• Third-Party Sources: We may receive your personal data from business partners, external agencies and public sources to facilitate and enhance the services we offer. This includes information received from marketing initiatives, social media comments, and delivery providers.

• Business Operations and Order Fulfillment: To process and deliver orders efficiently, ensuring customer satisfaction and timely service.
• Customer Support: To provide responsive and effective assistance, resolving queries and enhancing customer service experiences.
• Business Development: To analyze customer behaviors and preferences, supporting our marketing and strategic business initiatives.
• Operational Excellence and Compliance: To improve operational efficiencies, ensure service quality, and adhere to legal standards, particularly the KSA PDPL.
• Security and Safety: To ensure the safety of our premises, we utilize CCTV surveillance systems which provide a secure shopping environment and enhance the safety of all our customers, suppliers, and third-party vendors.
• Marketing, Loyalty Program, and Communications: To manage our loyalty program, conduct marketing campaigns, and communicate with customers regarding offers and news.

• Consent: We obtain explicit consent for certain processing activities, especially those not directly related to the fulfillment of contracts or legal obligations.
• Contractual Necessity: Data is processed as necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.
• Legal Obligation: Processing necessary to comply with our legal obligations, including but not limited to tax, labor, and corporate laws.
• Vital Interests: Occasionally, we process data necessary to protect the vital interests of individuals, such as emergency situations.
• Legitimate Interests: We process data based on legitimate business interests, such as preventing fraud, ensuring network and information security, and conducting business management activities, provided such processing does not outweigh your rights and freedoms.

• Data Storage Encryption: All sensitive personal data transmitted to and stored on our systems is encrypted using advanced encryption technologies.
• Access Controls: We strictly limit access to personal data to authorized personnel only, based on their role and necessity to engage with the data.
• Secure Infrastructure: Our network and data storage solutions are protected with industry-standard firewall and antivirus software, alongside intrusion detection systems to prevent unauthorized access.
• Regular Security Assessments: We conduct periodic security assessments and penetration testing to identify and address potential security vulnerabilities.

• Data Privacy Policies and Training: We enforce comprehensive data privacy policies and ensure that all employees are trained regularly on the importance of personal data protection and security best practices.
• Confidentiality Agreements: All our employees, contractors, and third-party service providers are required to sign confidentiality agreements that bind them to maintain the secrecy and security of all personal data.
• Physical Security: Our facilities are secured with ID cards, biometrics, and constant surveillance to ensure that only authorized personnel can access data-sensitive areas.
• Vendor Management: Third-party vendors are rigorously screened and bound by contracts that enforce our data protection standards.
• Incident Response Management: A structured incident response protocol is in place, detailing procedures for addressing any data security incidents. This includes immediate actions to manage and contain potential breaches and ensuring proper escalation and response without undue delay.

• Service Providers and Professional Partners: This includes IT and logistics providers like cloud services and delivery partners, as well as professional firms such as law firms and financial auditors who support our business operations.
• Government and Regulatory Authorities: To comply with legal obligations or in response to legal requests.
• Financial Institutions and Payment Processors: For processing transactions and managing financial operations.
• Marketing and Advertising Partners: To conduct marketing and promotional campaigns.

• All third parties are carefully vetted and bound by contractual safeguards such as Data Processing Agreements (DPAs) to ensure data protection.
• Data transfers are limited to what is necessary for the services they provide.

• Operational Necessity: We retain your data for as long as needed to provide you with services and to conduct our business operations efficiently.
• Legal Compliance: Certain types of data are retained for specific periods as required by law or other regulatory guidelines.
• Marketing and Communications: Data used for marketing purposes is kept until you request that we stop contacting you.

• Essential Cookies: These cookies include those necessary for managing compliance with data protection regulations. They store your consent preferences and ensure that the website adheres to legal requirements.
• Performance Cookies: Used for tracking site usage and performance, these cookies help us gather insights into how visitors use the corporate website. This data is used to optimize site functionality and improve the user experience.
• Advertising Cookies: These cookies are employed to support our marketing efforts, allowing us to deliver relevant advertisements based on your browsing behavior and interests.

• Browser Settings: Most browsers allow you to refuse cookies or delete cookies through their settings preferences. However, disabling cookies may affect the functionality and service offered on our websites.
• Consent Management: On your first visit to our website, you will be prompted to accept or reject non-essential cookies. You can change your preferences at any time by accessing the cookie settings available on our website.

• Right to be Informed: You have the right to be informed about how we collect your personal data, the legal basis for collection and processing, how such data is processed, stored, destroyed, and to whom it will be disclosed. You can access all these details through our Privacy Policy or contact us for further information.
• Right to Access to Your Personal Data: You have the right to access your personal data that we hold through means provided by us that allow for automatic access without needing to make a formal request.
• Right to Request Access to Your Personal Data: You can request to obtain your personal data held by Tamimi Markets at any time and obtain a copy of this data in a clear and readable format.
• Right to Correct Personal Data: If you find that any of the personal data that we hold about you is inaccurate, incomplete, or outdated, you have the right to request its correction or update.
• Right to Request Destruction of Personal Data: You may request the destruction of your personal data when it is no longer needed for the purposes for which it was collected. We will review such requests and take appropriate action, adhering to legal and regulatory requirements.
• Right to Withdraw Consent: You may withdraw your consent for the processing of your personal data at any time, unless there is a legal basis that requires otherwise. This withdrawal will not affect the lawfulness of processing based on your consent before its withdrawal.
• Right to File a Complaint: If you believe that Tamimi Markets has not complied with the Personal Data Protection Law, you have the right to file a complaint with us. If you are not satisfied with the outcome, you may escalate your complaint to the Saudi Data & Artificial Intelligence Authority (SDAIA).
• Right to Claim Compensation: You are entitled to claim compensation for any material or moral damage resulting from a violation of the Personal Data Protection Law and its implementing regulations.