Privacy Policy

Al Khalejiah Catering Company's Privacy Policy

1. General

1.1. Welcome to Al Khalejiah Catering Company's ("AKCC") Privacy Policy ("Privacy Policy") page.

1.2. In this Privacy Policy, the terms "you", "your" and "User(s)" refer to the person(s) in whose name the Hayyak Membership is registered. The terms "we", "our", "us", "Hayyak" and "AKCC" refer to Al Khalejiah Catering Company and its affiliates, successors and assigns.

1.3. If you have successfully registered a Hayyak Membership with us, you will be known as the "Hayyak Member" and you will have an account with us called the "Hayyak Membership".

1.4. AKCC is committed to protecting and respecting your privacy. This Privacy Policy, together with our Terms and Conditions and any other documents referred to in it and herein, sets out the Personal Data Protection Agreement, where AKCC may control and process your personal data.

1.5. Once registered at Hayyak App, the Hayyak Member is deemed to have read the following carefully and understood our practices regarding the Hayyak Member's personal data and how we will treat it.

1.6. Users must be at least sixteen (16) years of age to create or maintain a Hayyak Membership. Personal Data relating to individuals under sixteen (16) may be provided only by a parent, legal guardian, or an authorized adult account holder for the purpose of adding them as accompanying travelers and providing the requested Services. The person providing such Personal Data confirms that they are authorized to do so and that the information provided is accurate. AKCC may take reasonable steps to verify the User's age or the authority of the person providing the information.

1.7. Personal Data will be processed in accordance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom. Where applicable, AKCC will also comply with the UK General Data Protection Regulation ("UK GDPR") and any other data protection laws falling within the territorial scope of its processing activities. AKCC acts as the Data Controller in relation to Personal Data processed for the provision of its Services.

2. Definitions

Unless the context requires otherwise, the following terms shall have the specified definitions given to each of which:

• 2.1. "Data Controller" is a person or entity which determines the manner of which any personal data is, or is to be, processed;
• 2.2. "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), an identifiable natural person being one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• 2.3. "Applicable Laws" is the laws of the Kingdom of Saudi Arabia and its implementing regulations, as amended from time to time.

3. What Information Do We Collect from You?

3.1. In order to provide a better service to you, we may collect and process the following data about you:

• 3.1.1. Information that you provide by filling in forms on our main/official website or associated mobile application(s), or other relevant platforms through which we provide our services, products and/or information (collectively and severally, "AKCC Sites"). The foregoing includes information provided at the time of registering to use any of AKCC Sites, subscribing to any of our Services, procurement of any of our products or services, posting material or requesting further services. AKCC may also ask you for information at other times, for example in connection with a promotion or if you report a problem with any of AKCC Sites or any of our other services or products;
• 3.1.2. If you contact us, we may keep a record of that correspondence;
• 3.1.3. We may also ask you to complete surveys from time to time that we use for research purposes, although you do not have to respond to them;
• 3.1.4. Details of transactions you carry out through any of AKCC Sites;
• 3.1.5. Details (including your Personal Data) required for the fulfilment of your orders and the provision of the Services; and
• 3.1.6. Details of your visits to any of AKCC Sites or our Outlets' sites (including their physical locations), and the resources that you access.

3.2. Depending on the Services or features used, AKCC may collect and process the following Personal Data:

• 3.2.1. Mandatory account information: the User's name, email address, date of birth, and gender. A telephone number is mandatory when using the Saudi country code (+966).
• 3.2.2. Additional or service-dependent information: depending on the Services or features requested, AKCC may also collect a telephone number where it is not mandatory under Clause 3.2.1, passport number, account login information, profile information, uploaded photos, files or documents, and approximate or precise device location where the User has granted the relevant permission.

4. Why Do We Collect This Information?

4.1. AKCC may process Personal Data where reasonably necessary for the following purposes:

• 4.1.1. To create, verify, and manage the User's Hayyak Membership and account;
• 4.1.2. To authenticate the User and enable access to the Hayyak App;
• 4.1.3. To provide the Services or products purchased, requested, or agreed to by the User;
• 4.1.4. To personalize and improve the User experience;
• 4.1.5. To process photos, files, documents, or other information uploaded by the User where required by the relevant App feature;
• 4.1.6. To provide location-based features where permission has been granted;
• 4.1.7. To respond to inquiries, complaints, requests, and technical support matters;
• 4.1.8. To communicate information relating to the User's account or the Services;
• 4.1.9. To maintain the security, availability, performance, and reliability of the App;
• 4.1.10. To detect, prevent, and investigate fraud, misuse, unauthorized access, technical failures, security incidents, or unlawful activity;
• 4.1.11. To comply with applicable laws and regulations inside or outside the Kingdom of Saudi Arabia, including applicable legal, regulatory, accounting, audit, and recordkeeping requirements; and
• 4.1.12. To establish, exercise, or defend legal claims, including collecting overdue amounts and seeking professional advice.

4.2. Location information may be processed only where required to provide location-based features, including identifying nearby branches or lounges, sorting locations by proximity, displaying selected locations on a map, or assisting the User in navigating to a selected location.

5. Who Might We Share Your Data With?

5.1. We will keep the Personal Data we hold confidential but may provide information to:

• 5.1.1. Personnel, agents, advisers, auditors, contractors, financial institutions, and/or service providers in connection with our operations or Services (pursuant to legitimate business or legal purposes, whether located in the KSA or overseas) and under a duty of confidentiality/data protection to us;
• 5.1.2. Our overseas offices, affiliates, business partners and counterparts (if any), where relevant to our provision of products or Services to you or to service your requests (including without limitation administrative or operational aspects thereto such as hosting services and audits); and/or
• 5.1.3. Persons to whom we are required to make disclosure under applicable laws and regulations in or outside of the KSA.

5.2. Access to Personal Data is restricted to authorized personnel, contractors, and service providers who require access for legitimate operational purposes. Any service provider processing Personal Data on behalf of AKCC must use it only for the relevant service and must comply with applicable confidentiality, security, contractual, and data protection requirements.

5.3. AKCC does not sell, rent, or trade Personal Data and does not disclose Personal Data to third parties for their own advertising, marketing, or commercial profiling purposes. Personal Data may only be disclosed as set out in this Section 5, where required by applicable law or a valid request from a competent authority, or where reasonably necessary to protect the rights, safety, security, or legitimate interests of AKCC, its Users, or the public.

6. How Do We Protect Your Data?

6.1. AKCC applies reasonable administrative, technical, and organizational safeguards designed to protect Personal Data against unauthorized access, disclosure, loss, misuse, alteration, or destruction. While AKCC takes reasonable measures to protect Personal Data, no electronic transmission or storage system is entirely risk-free.

7. How Long Do We Keep Your Information?

7.1. AKCC retains Personal Data only for as long as necessary for the purposes for which it was collected and for legitimate business or legal purposes. Unless a different period is required or permitted by applicable law, Personal Data relating to a Hayyak Membership, booking, or transaction may be retained for up to 5 (five) years after its expiry or completion for purposes including accounting, audit, reconciliation, follow-up, and potential claims. Hayyak Members may request deletion of their Personal Data by contacting AKCC using the details set out in Section 10, subject to any applicable legal or regulatory retention requirements.

8. What Rights Do You Have with Regards to the Information AKCC Holds about You?

8.1. The rights available to you are governed by the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Where the UK GDPR applies to the relevant processing activities, you may also exercise the applicable rights available under the UK GDPR, including the following:

• 8.1.1. To check whether we hold Personal Data about you and to access such data;
• 8.1.2. To require us to correct, as soon as reasonably practicable, any data relating to you that is inaccurate;
• 8.1.3. To ascertain our policies and practices in relation to Personal Data and the kind of Personal Data held by us;
• 8.1.4. To object to the use of your Personal Data for marketing purposes (if you had previously consented thereto). We shall not use your Personal Data for marketing purposes after you communicate your objection (or revoke your prior consent) to us; and
• 8.1.5. To request the deletion of any Personal Data which we are holding (subject however to inevitable consequences as further described in Clause 8.3 below).

8.2. Please send requests for any objections, access to your Personal Data, correction of your Personal Data, information regarding policies, practices and your Personal Data held by us, questions and/or complaints to the contact details set out hereinbelow in Section 10.

8.3. Subject to the Account Deletion Policy, you can at any time choose to delete your account on the Hayyak App, AKCC or Hayyak Website (as applicable), however, thereafter deletion, you will no longer be able to access any of our Services and products, we may not be able to fulfil any transactions that you have already requested from us (even if payment has already been made), and all refunds or other compensation of any kind will be processed according to our Refund Policy.

8.4. In accordance with the terms of the UK GDPR, we have the right to and may charge a reasonable fee for processing any data access request that is manifestly unfounded or excessive, and where such a fee is chargeable, we will inform you beforehand for your agreement thereto. Otherwise, for most other requests no fee will be chargeable.

8.5. We reserve the right to amend and update the terms of this Privacy Policy at any time in our sole discretion without notice. We will however communicate any material amendments/updates to you as soon as reasonably possible.

9. Payment Information

9.1. Electronic payments are completed through a secure payment page hosted by Moyasar Financial Company or another licensed payment service provider approved by AKCC. Users are redirected to the relevant invoice link to complete payment directly with the payment service provider.

9.2. AKCC does not collect, receive, access, store, or process sensitive payment instrument data, including card numbers, security codes, or authentication credentials. Such data is processed directly by the payment service provider in accordance with its terms, privacy policy, and applicable laws.

9.3. AKCC may retain limited, non-sensitive transaction information, such as the invoice number, amount, payment status, and transaction reference, for payment confirmation, accounting reconciliation, refunds, dispute handling, and compliance with applicable legal requirements.

10. How to Contact Us

10.1. If you have any queries or concerns regarding our Privacy Policy or your Personal Data held with us, please contact us using the below stated contact information: