Shoppingate is a developer and owner of an electronic marketplace platform through its mobile application and website bearing the trademark “Shoppingate” or any other trademark that Shoppingate may adopt from time to time (the “App”).
This Privacy Policy (“Privacy Policy”) constitutes an integral part of your Agreement (as applicable) with Qtoon Raqamya Trading Company (One Partner) (referred to in this Privacy Policy as “Shoppingate”, “we”, “us” and “our”). This Privacy Policy applies to you whether you access or use Shoppingate’s electronic marketplace platform as a consumer or a merchant. It governs your and our rights and obligations in connection with the setup, access, operation, and use of the marketplace through the App (the “Platform”). Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the applicable Agreement, unless the context requires otherwise.
We take your privacy seriously and want you to feel comfortable whenever you use or access the Platform. We process your personal data (“Personal Data”) in accordance with Royal Decree No. M148 of 5/9/1443H and its respective implementing regulations, as amended from time to time (“Applicable Laws”).
Table of Content
1. What Personal Data we collect and for what purposes | 7. Storing your Personal Data |
2. Legal basis for the processing of Personal Data | 8. Retaining and destroying your Personal Data |
3. Mandatory and optional provision of Personal Data | 9. Your Rights |
4. Collecting and processing your Personal Data | 10. Updates to this Privacy Policy |
5. Protecting your Personal Data | 11. Contact Us |
6. Sharing your Personal Data | 12. Acknowledgment and Acceptance |
1. What Personal Data we collect and for what purposes
1.1. Personal Data Collected Directly from You
We collect Personal Data that you intentionally provide to us when downloading the App, creating an account, submitting forms, entering information into fields, uploading documents, or communicating with us. This includes information required for onboarding, AML/KYC/CTF, identity verification, accessing or using our services offered via the App, and for advertising and marketing purposes. Depending on whether you are an individual user or a Merchant (or its authorized representative), the following data may be collected directly from you or from regulated entities acting on your behalf:
1.1.1. Individual Users
We may collect your Personal Data directly from you, which includes but is not limited to:
a) Basic identification such as full name, email address, national ID, residency card, passport number, mobile number, national address, date of birth and current location.
b) Biometric data such as fingerprint and facial recognition for verification and secure access.
c) Transaction and account-related such as in-App account details and information you enter or provide when using the App.
1.1.2. Merchants and Authorized Representatives
We may collect the following categories of Personal Data directly when you set up an account with us or access the Platform:
a) Identification and regulatory data such as commercial registration, unified ID, tax numbers, and basic identification details of the Merchant’s authorized representative.
b) Financial information such as credit card details or bank account details.
c) Biometric data such as fingerprint and facial recognition for verification and secure access.
d) Transaction and account-related data such as in-App account details and information you enter.
1.2. Personal Data Collected Automatically (Indirect Collection)
Certain Personal Data are collected indirectly when you interact with the App or our digital channels. Such data may be collected through technical, operational, regulatory, or third-party sources to enable the provision of the Services, ensure security, and comply with applicable laws and regulatory requirements. Such indirectly collected Personal Data may include:
a) Device and technical information such as IP addresses, device type, operating system, and localization data used for fraud prevention, session management and service functionality.
b) Usage and behavioral information generated through analytics tools to enhance customer experience.
c) Cookies and similar technologies that help recognize your device and remember preferences.
d) System-generated logs that record actions within the App for security, monitoring and troubleshooting.
e) Data received through secure integrations with approved government platforms (e.g., NIC, ELM) to verify identity and maintain accurate records.
f) Mini-App interaction data, such as records of the Mini-Apps you access through the App and your activity within them.
1.3. Accuracy of Personal Data
You agree and undertake pursuant to your Agreement with us to provide us only with Personal Data that are accurate, complete, up-to-date, and relevant for the purpose for which they are collected. We will take reasonable steps to ensure that your Personal Data are accurate, complete, up-to-date and relevant for the purpose for which they are collected but we will not be responsible for any inaccuracy, incompleteness, outdate or irrelevance of the Personal Data including whether the foregoing is a consequence of your error or omission, unless such inaccuracy or incompleteness is a result of our own error or omission.
2. Legal basis for the processing of Personal Data
In accordance with the Applicable Laws, the legal basis on which we rely in processing your Personal Data is as follows:
a) Legal Obligation: Personal Data may be processed where processing is required to comply with a legal obligation imposed by applicable laws or regulations.
b) Public / Security Interest: Personal Data may be processed where such processing is required to achieve public interest or for security purposes, in accordance with applicable laws and competent authority requirements.
c) Contractual Necessity: Personal Data may be processed where such processing is necessary for the performance of a contract to which the Data Subject is a party.
d) Vital Interest: Personal Data may be processed where processing is necessary to protect the life or vital interests of the Data Subject, in situations where obtaining consent is impossible or difficult.
e) Legitimate Interest: Personal Data may be processed where processing is required for the purpose of legitimate interest of Shoppingate, without prejudice to the rights and interests of the Data Subject, and provided that no sensitive data (as defined by Applicable Laws) is to be processed.
f) Consent: Personal Data may be processed based on the consent of the Data Subject, unless processing is permitted under another lawful basis stipulated by Applicable Laws.
3. Mandatory and optional provision of Personal Data
Your provision of Personal Data that we request from you under section 1 above is mandatory to enable Shoppingate to provide its Services to you. Therefore, failure to provide such Personal Data for the purposes referred to in section 1 will make it impossible for us to provide you the relevant services or may impact the quality and accuracy of the service for which we may refrain from carrying out a request or instruction or offering such service.
The provision of Personal Data under section 1.2 (e) relies on government-approved resources and thus your limited involvement in providing such Personal Information. However, the verification of Personal Data that you provide to us pursuant the aforementioned section, relies on the accuracy and completeness of the Personal Data that you provide to us pursuant to section 1 above.
4. Collecting and processing your Personal Data
We collect and process Personal Data only when you specifically give it to us by registering on and/or using the Platform or by the third parties mentioned in section 1 above at the start and throughout the duration of your relationship with us and beyond, strictly in accordance with the Applicable Laws and solely for the purposes set out in section 1 above. Personal Data will be processed on paper and/or via telematic means, also with the help of electronic and information means.
If you are a Merchant, it is your obligation to obtain the consent of your personnel, customers, contracts and suppliers to provide us with their corresponding Personal Data as may be required for the relevant Services, pursuant to the Applicable Laws and any other laws, regulations and policies that may apply.
5. Protecting your Personal Data
The Personal Data you provide will be processed in compliance with the Applicable Laws and, in any case, in such a way as to guarantee the security and confidentiality of the same. We will do our best to protect your Personal Data by implementing strong security controls and industry’s best practices, including but not limited to encryption, regular security assessments, and ongoing employee training. We continuously monitor and update our security measures to reduce risks and prevent any unauthorized access, disclosure, alteration, or loss of information.
6. Sharing your Personal Data
Shoppingate may share your Personal Data, as applicable, on a one-time basis or ongoing basis for the purposes specified in this Privacy Policy and to the categories of recipients listed below, while requiring recipients to keep your data secure and use it in line with this Privacy Policy. However, we shall not be liable for any unauthorized use of your Personal Data by any of third-party provider.
Where Personal Data is shared with third parties acting on behalf of Shoppingate, such parties are contractually bound by a data processing agreement to process the data only in accordance with Shoppingate’s instructions, implement appropriate security measures, and comply with applicable data protection laws.
6.1. With third parties within KSA
We may share Personal Data with third party providers so they can provide you with certain services through the Platform. Personal Data may be shared with recipients located inside the Kingdom of Saudi Arabia, who may act either as data processors on behalf of Shoppingate or as independent data controllers (as defined by Applicable Laws), as applicable, in the following circumstances:
a) Legal and Regulatory disclosures: Personal Data may be disclosed where required to comply with applicable laws, court orders, requests from regulatory or enforcement authorities, or for the purposes of fraud prevention and regulatory compliance.
b) Professional service providers: Personal Data may be disclosed to entities that provide professional consultancy services to Shoppingate, including but not limited to accounting, administrative, legal, tax, and financial advisory services.
c) Platform-related service providers: Personal Data may be disclosed to companies that provide services on behalf of Shoppingate in connection with the operation of the App, including but not limited to, data analysis, payment service management, shipment and delivery of purchased products, marketing activities, Platform management, and service customization.
d) Companies within Shoppingate’s corporate group: Personal Data may be disclosed to affiliates companies of Shoppingate, for purposes such as aggregated or anonymized data analysis, identity management, profiling and marketing (subject to consent), or in connection with any actual or potential sale, merger, liquidation, receivership or transfer of assets involving Shoppingate or any of its affiliates.
e) Business partners: Personal Data may be disclosed to third-party companies collaborating with Shoppingate in the provision of services, including promotional partners, IT support, professional services, and functions performed on Shoppingate’s behalf.
f) Mini-App operators: Personal Data may be shared with third-party operators of Mini-Apps that you choose to access or use within the App, strictly to enable the relevant Mini-App to provide you with its products, services, or content.
6.2. With third parties outside KSA
For the purposes of providing you with our services and other purposes indicated in the Privacy Policy, Personal Data may be shared with recipients outside the Kingdom of Saudi Arabia, provided (i) such transfers comply with Applicable Laws regarding data transfers, and (ii) recipients act as processors or autonomous controllers. In such cases, we ensure that an adequate level of protection is maintained and that all transfers are conducted lawfully. This includes relying on adequacy decisions issued by the competent authority and implementing standard contractual clauses governing the transfer of Personal Data.
7. Storing your Personal Data
Your Personal Data is securely stored at our authorized cloud service providers operating outside the Kingdom of Saudi Arabia within a controlled environment that applies to strict technical and organizational safeguards, including, but not limited to, encryption and access management, with the processing and storing regulated in compliance with Applicable Laws.
Shoppingate will store your Personal Data only for as long as necessary to fulfil the purposes for which it was collected or processed, and as required under applicable laws, regulations, and supervisory instructions. These purposes may include legal obligations, recordkeeping for analysis or audit, responding to inquiries or complaints, monitoring fraud and money-laundering activities, taking legal actions, and responding to regulatory requests.
8. Retaining and destroying your Personal Data
Personal Data collected for the processing purposes indicated in this Privacy Policy shall be retained for the time necessary for the pursuit of such purposes, or until your consent is withdrawn (where applicable), except in case of extraordinary necessity of Shoppingate to keep the Personal Data further in order to defend its rights, or upon indication of public authorities or as otherwise permitted by Applicable Laws. However, in certain circumstances, Shoppingate may be unable to comply with a request for deletion of Personal Data where such deletion would conflict with legal or regulatory obligations to which Shoppingate is subject, ensuring always that the necessary records can be produced as evidence if needed. However, once your Personal Data is no longer required to be retained, Shoppingate will securely delete and destroy such data using appropriate measures to prevent any unauthorized access or recovery, or alternatively, it will be anonymized to ensure irreversible de-identification.
9. Your Rights
Shoppingate is committed to upholding your rights as outlined below in accordance with Applicable Laws and will take appropriate action within a period not exceeding thirty (30) days from the date of receiving your request. Where the nature or complexity of your request requires additional time, we will notify you promptly with the reasons for the delay and may extend the response period by no more than an additional thirty (30) days.
You may exercise your rights below through the App or by contacting us at [email protected].
Rights | Description | ||
Right to Access | You have the right to access the Personal Data Shoppingate holds about you, such as your account details, identity information, and transaction history. When you submit an access request through the App, we will provide you with the Personal Data we process about you. Access may be limited in certain cases to protect security, prevent fraud, or comply with applicable laws and regulatory restrictions. | ||
Right to Obtain a Copy |
| ||
Right to Request Correction, Completion, or Updating | You have the right to request the correction of inaccurate data or the updating/completion of incomplete or outdated Personal Data. We will take reasonable steps to verify the accuracy of the information before making any changes to ensure the data we process remains accurate and up to date. | ||
Right to Deletion or Destruction | You may request deletion of your Personal Data. However, we may retain data where required for legal, regulatory, judicial, or statutory purposes, where technical limitations temporarily prevent deletion, or as stated in this Privacy Policy. | ||
Right to Withdraw Consent | You have the right to withdraw your consent at any time by selecting the appropriate option in the Platform or sending an e-mail to our contacts as set out in this Privacy Policy. | ||
Right to Lodge Complaints |
| ||
Right to claim compensation for material or moral damage | You have the right to file a claim with the competent court to seek compensation for material or moral damage resulting from any violation of the Applicable Laws. | ||
Right to be informed about the lawful basis/purpose for collection of personal data | You have the right to obtain information in relation to the purposes and legal basis for which your Personal Data is processed. |
10. Updates to this Privacy Policy
We may update this Privacy Policy from time to time. Any changes to this Privacy Policy will be published on the Platform with the updated date to ensure that the Data Subject is informed. By continuing to use the Platform, you will be deemed to accept the changes to this Privacy Policy.
11. Contact Us
Your Personal Data processing controller is Shoppingate. You may contact Shoppingate at any time via Shoppingate’s customer service centre on the App or by email at [email protected].
12. Acknowledgment and Acceptance