Privacy Policy

• We are the controller for the personal data of our customers (merchants and their account users), website visitors and people who contact us. We decide how and why this data is used.
• We are a processor for the order data of merchants’ customers that reaches Blend from connected sales channels. We process this data on behalf of the merchant and only on its instructions. The merchant is responsible for informing its customers and for collecting that data lawfully.

• Account and business information: name, email, phone number, job role, business name, branch locations, Commercial Registration and VAT details, and login credentials.
• Order data: customer names, phone numbers, delivery addresses, order contents, order values and order status, received from delivery apps, e-commerce platforms, direct ordering, social ordering and pickup channels connected by the merchant.
• Usage and device data: IP address, browser and device type, app version, log data, and how the platform is used.
• Communications: messages, calls and support requests you send us.
• Billing information: billing contacts, invoices and payment status. Card payments are handled by licensed payment providers; we do not store full card numbers.

We do not sell personal data. We share it only with:

• Sales channels and integration partners: delivery apps, cashier systems and e-commerce platforms that the merchant connects, to send and receive orders.
• Service providers: hosting, cloud infrastructure, communications, analytics and support tools that help us run Blend.
• Payment partners: licensed payment providers, such as Tabby and Tamara, where the merchant uses them.
• Finance partners: the licensed finance partner behind Blend Finance, only when the merchant applies for or uses that service.
• AI providers: AI service providers, as described in section 4.
• Advisers and authorities: lawyers, auditors and advisers, and authorities when the law requires it.
• Business transfers: a buyer or investor in a merger, acquisition or financing, under confidentiality obligations.

Every service provider that processes personal data for us is bound by a written agreement to protect it and to use it only for the services they provide to Blend.

Personal data is stored in [AWS]. Some service providers and members of our team. We transfer data outside Saudi Arabia only as permitted by the PDPL and its transfer regulations, with appropriate safeguards in place.

• Account and business information: for as long as the account is active, then for [3] years.
• Order data: as instructed by the merchant, and deleted or returned within [180] days after the merchant’s account ends.
• Billing and financial records: for 10 years, as required by Saudi commercial and tax laws.
• Usage and log data: for up to [48] months.

We use technical and organizational measures to protect personal data, including encryption in transit, role-based access controls, monitoring, regular backups and staff confidentiality obligations. If a personal data breach occurs, we will notify the Saudi Data & AI Authority (SDAIA) and affected individuals where the law requires it.

Under the PDPL you have the right to:

• be informed about how your personal data is used;
• access your personal data and obtain a copy of it;
• correct personal data that is inaccurate or incomplete;
• request deletion of personal data we no longer need;
• withdraw consent at any time, including for marketing.

To use these rights, email [email protected]. We will respond within 30 days. If your request concerns order data held for a merchant, we will refer it to that merchant or help the merchant respond.

We use essential cookies to run our website and platform, and analytics cookies to understand how they are used. You can manage cookies through your browser settings; blocking essential cookies may stop some features from working.

Blend is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

If you have a concern about how we handle your personal data, please contact us first. You also have the right to file a complaint with the Saudi Data & AI Authority (SDAIA).

We may update this policy from time to time. We will post the new version with its date on this page and notify customers of material changes.

This policy is governed by the laws of the Kingdom of Saudi Arabia. If there is any conflict between the Arabic and English versions, the Arabic version prevails.

Al Mumkinah IT Company (Blend) · Al Rimal, Riyadh, Saudi Arabia · [email protected] · tryblend.net