Privacy Policy

1. Regulatory Compliance
This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the Saudi Personal Data Protection Law — PDPL (Royal Decree No. M/19) and its Implementing Regulations issued by the Saudi Data & Artificial Intelligence Authority (SDAIA).

2. Information We Collect
- Contact Information: name, phone number, email address, and delivery address (city, district, street, national address).
- Transaction Details: order history, payment confirmation codes, and electronic invoices.
- Technical Data: device/browser information and cookies used to operate the storefront (e.g., cart, language preference).

3. Financial and Payment Security
Payment details (Mada, Visa/Mastercard, Apple Pay) are handled through Moyasar, our PCI-DSS-compliant, SAMA-licensed payment gateway. We do not store raw card numbers on our servers — they are tokenized and processed directly by Moyasar.

4. Purpose of Collection & Data Retention
We collect your data solely to process and fulfil your orders, issue invoices, provide customer support, and comply with legal/tax obligations. We do not retain your personal data for longer than necessary for these purposes, and we do not use it for marketing without your prior consent.

5. Data Storage
Customer records and transaction logs are encrypted in transit and at rest (TLS/AES) and stored on secure servers. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Your Rights Under the PDPL
You have the right to:
- Be informed of the purpose of data collection.
- Access, correct, or request deletion of your personal data (subject to legal/tax retention requirements).
- Withdraw consent at any time.

Requests can be submitted to Latte24.com@gmail.com and will be addressed within 30 days, extendable by a further 30 days where necessary under the PDPL Implementing Regulations.

7. Breach Notification
In the event of a data breach affecting your personal information, we will notify the relevant authority and affected customers as required by law.