Privacy Policy

Lundria is committed to protecting the privacy of its customers and visitors, and processes personal data in accordance with the Personal Data Protection Law and its Implementing Regulations issued in the Kingdom of Saudi Arabia, together with the controls issued by the Saudi Data & AI Authority (SDAIA).

This Policy explains what data we collect, why we collect it, the legal basis for processing, with whom we share it, how long we retain it, and how you may exercise your rights.

The Company acts as the "Controller" of the personal data covered by this Policy.

We collect the minimum data necessary to deliver the Service, as follows:

• Identity and contact data: name, mobile number, email address.
• Account data: password stored as an irreversible hash, creation date, and account status.
• Service data: address and city, pickup and delivery appointments, and details of the items and services requested.
• Financial data: order value, tax, and payment status. We never retain bank card details.
• Correspondence data: messages sent through the contact form or support channels.
• Technical data: IP address, browser and device type, and access and usage logs.

We do not collect sensitive personal data, nor do we ask you to provide it.

We obtain data directly from you when you register, place an order, or contact us; automatically from your device while browsing the Platform; and from payment service providers as to the outcome of a transaction, without card details.

We process your data only for a specified, explicit and legitimate purpose, as follows:

• Performance of contract: creating your account, fulfilling orders, arranging pickup and delivery, and issuing invoices. Basis: performance of a contract to which you are party.
• Support and communication: responding to enquiries and notifying you of order status. Basis: performance of contract.
• Legal compliance: maintaining accounting and tax records and responding to requests from competent authorities. Basis: compliance with applicable law.
• Service improvement and security: aggregate usage analysis, and prevention of fraud and abuse. Basis: legitimate interest, having regard to your rights.
• Marketing: sending offers and news. Basis: your explicit consent, which you may withdraw at any time.

We do not use your data for any new purpose inconsistent with that for which it was collected without notifying you and, where required, obtaining your consent.

We use essential cookies that are indispensable to operating the Platform, chiefly the session cookie that keeps you signed in, protected by security controls preventing access from outside the site.

We do not use third-party advertising or tracking cookies. You may control cookies through your browser settings, noting that disabling essential cookies prevents signing in and completing orders.

We do not sell, rent or otherwise trade your personal data. We disclose it only in the following cases and only to the extent necessary:

• Contracted service providers: hosting and technical infrastructure, payment providers, and messaging providers. They process data on our behalf and solely on our instructions.
• Pickup and delivery agents: given only the name, address and contact number required to complete the visit.
• Competent authorities: pursuant to a lawful request or judicial order, or to protect our rights or the safety of persons.

We require every party with access to the data to maintain confidentiality and to apply protection controls no less stringent than our own.

Certain data may be processed or stored with technical infrastructure providers whose servers operate outside the Kingdom, to the extent necessary to operate the Platform.

Such transfers are made in accordance with the controls prescribed by the Personal Data Protection Law and its Regulations, after verifying that the recipient applies an adequate level of protection, and are limited to what is indispensable to providing the Service.

We retain personal data for as long as necessary to fulfil the purpose for which it was collected, after which it is deleted or de-identified.

• Account data: for as long as the account remains active, and until you request its deletion.
• Order and invoice records: six (6) years, the minimum required by the VAT regulations for retaining invoices and accounting records.
• Correspondence: two (2) years from closure of the request.
• Technical logs: twelve (12) months, for security and fault investigation.

We apply organisational and technical controls to protect your data, notably:

• Full transport encryption over HTTPS across all pages of the Platform.
• Passwords stored as irreversible hashes.
• Access to data restricted to personnel whose duties require it.
• Security-header policies mitigating content-injection and framing attacks.
• Regular backups and separation of production from development environments.

Nonetheless, no method of electronic transmission or storage can be guaranteed absolutely secure. In the event of a leak, damage or unlawful access affecting your data, we notify the competent authority within no more than seventy-two (72) hours of becoming aware of the incident, and notify you where the incident may harm your data or conflict with your rights.

The Personal Data Protection Law affords you the following rights:

• The right to be informed: of the legal basis and purpose for collecting your data.
• The right of access: to view the data we hold about you.
• The right to obtain: a copy of your data in a clear and readable format.
• The right to rectification: of data that is inaccurate, incomplete or outdated.
• The right to erasure: to request deletion once the data is no longer needed, unless retention is legally required.
• The right to withdraw consent: for processing based on consent, at any time.

You may amend your name, mobile number, email and password directly from the "My Account" page on the Platform.

Requests are submitted to privacy@lundria.com specifying the right to be exercised. Identity verification is carried out to protect your data from disclosure to anyone not entitled to it.

We respond within thirty (30) days of a complete request; where that is not possible, you are notified of the reasons and of any additional time required. The service is free of charge unless the request is repetitive or excessive.

The Service is not directed at persons under eighteen (18), and we do not knowingly collect their data. Where we become aware that we have, the data is deleted immediately.

We send marketing messages only with your explicit consent, and every message includes a clear means of unsubscribing. Unsubscribing does not affect operational messages relating to your orders.

The customer's website account and application account are a single account stored in a unified data layer. On launch of the application, customers sign in with the same credentials and find their orders and history intact.

This Policy applies equally to the application. Any additional data the application requires — such as location permissions — will be requested with your explicit consent at the point of activation, and you may decline.

This Policy may be updated to reflect legal or operational changes; updates are published on this page with their date. Where an amendment is material and affects your rights, you will be notified by appropriate means.

For any enquiry, request or complaint concerning the privacy of your data, contact us at privacy@lundria.com or info@lundria.com.

If your complaint is not resolved satisfactorily, you may refer it to the authority competent for supervising the application of the Personal Data Protection Law in the Kingdom.