Privacy policy
Last updated: 7 October 2026
Wadi Bodega Establishment (مؤسسة وادي بوديقا), Commercial Registration No. 7054677823, operates Wadi Bodega and the website wadibodega.com.
In this Privacy Policy, “Wadi Bodega”, “we”, “us” and “our” refer to Wadi Bodega Establishment.
This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you visit our website, create an account, place an order, communicate with us or otherwise interact with Wadi Bodega.
We process personal data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (“PDPL”) and its Implementing Regulations.
Personal Data We Collect
Depending on how you interact with Wadi Bodega, we may collect or process:
Identity and contact information, including your name, email address, telephone number, billing address, shipping address and country of residence.
Account information, including your account details, preferences, saved addresses and account settings.
Order and transaction information, including products viewed or purchased, order history, returns, refunds, exchanges, store credit and transaction status.
Payment-related information, including payment method, transaction confirmation and payment status. Payment-card and other payment information may be collected and processed directly by third-party payment providers, including Shopify, PayTabs, Tabby, Tamara or other payment providers used by Wadi Bodega. Wadi Bodega does not ordinarily receive or store complete payment-card credentials where those credentials are processed directly by such providers.
Delivery information, including recipient details, shipping address, carrier information, tracking data and delivery confirmation.
Communications, including emails, messages, customer-service enquiries and other correspondence with us.
Technical and usage information, including IP address, browser information, device information, website activity, cookies and similar technologies.
Marketing preferences, including whether you have agreed to receive marketing communications and whether you have withdrawn that consent.
How We Collect Personal Data
We may collect personal data:
- directly from you when you create an account, place an order, contact us, subscribe to communications or otherwise provide information;
- automatically when you use our website, including through cookies and similar technologies;
- from Shopify and other service providers that help us operate the website and fulfill orders;
- from payment providers, shipping carriers and logistics providers;
- from marketing and advertising platforms where permitted by law; and
- from other sources where collection is permitted by applicable law.
Why We Process Personal Data
We process personal data only for legitimate and specific purposes and on an appropriate legal basis.
Fulfilling Your Order and Our Contract With You
We process personal data to:
- process and fulfill orders;
- arrange payment;
- deliver products;
- provide order confirmations and updates;
- manage returns, refunds and exchanges;
- provide customer support; and
- maintain your customer account.
The legal basis for this processing is generally the performance of a contract to which you are a party or taking steps at your request in connection with such a contract.
Legal and Regulatory Compliance
We may process and retain information where necessary to comply with Saudi laws and regulatory obligations, including requirements relating to taxation, invoicing, accounting, customs, fraud prevention, regulatory enquiries and legal proceedings.
The legal basis for this processing is compliance with applicable legal obligations.
Security and Fraud Prevention
We may process information to verify transactions, detect suspicious or unauthorized activity, protect customers and Wadi Bodega, enforce our Terms and prevent fraud or misuse.
Where applicable, this processing may be based on Wadi Bodega's legitimate interests, provided that such processing does not override the rights and interests of the data subject and is otherwise permitted under applicable law.
Customer Service
We use personal data to respond to enquiries, complaints and requests and to maintain our relationship with customers.
Depending on the circumstances, this processing may be necessary to perform our contract with you or to pursue legitimate interests permitted under applicable law.
Marketing
We may use personal data to send marketing, promotional or product-related communications where you have provided the consent required by applicable law.
You may withdraw your consent to direct marketing at any time by using the unsubscribe mechanism provided in the communication or by contacting us.
Withdrawal of marketing consent does not affect transactional communications relating to an order, account, return, security matter or other non-marketing purpose.
Saudi PDPL requires consent before personal data is used for direct marketing and requires a simple mechanism to stop receiving such communications. Data Governance Platform
Cookies and Similar Technologies
Wadi Bodega and its service providers may use cookies and similar technologies to operate the website, remember preferences, maintain security, measure website performance and, where permitted, support analytics and advertising.
Where consent is required by applicable law, optional cookies or similar technologies will be used in accordance with the user's consent choices.
You may also control certain cookies through your browser or device settings, although disabling necessary cookies may affect website functionality.
How We Disclose Personal Data
We may disclose personal data only where necessary and permitted by law, including to:
Shopify, which hosts and supports our e-commerce store.
Payment and instalment providers, including PayTabs, Tabby, Tamara and other providers used to process or facilitate payment.
Shipping and logistics providers, including carriers and fulfilment providers required to deliver your order.
Technology and professional service providers, including providers of hosting, IT, accounting, analytics, fraud prevention and customer-support services.
Marketing and advertising providers, where processing is permitted and any required consent has been obtained.
Government, regulatory, customs, tax, judicial or law-enforcement authorities, where disclosure is required or permitted by law.
Professional advisers, including accountants, auditors and legal advisers where reasonably necessary.
We require service providers processing personal data on our behalf to handle such data in accordance with applicable legal and contractual requirements.
Shopify
Our online store is hosted by Shopify.
Shopify may process personal data in order to provide the e-commerce platform, checkout, account, security and related functionality used by Wadi Bodega.
Shopify may also process certain personal data independently under its own privacy terms. Customers should review Shopify's applicable privacy information for further details regarding such processing.
International Transfers
Some of Wadi Bodega's technology, payment, logistics or other service providers may process personal data outside the Kingdom of Saudi Arabia.
Where personal data is transferred or disclosed outside Saudi Arabia, Wadi Bodega will do so only where permitted under the PDPL and applicable regulations and will take appropriate measures required for such transfer or disclosure.
Cross-border transfers will be limited to what is necessary for the relevant purpose and will be subject to the applicable safeguards and requirements under Saudi law. Saudi regulations require controllers to preserve an appropriate level of protection when transferring personal data outside the Kingdom. Data Governance Platform
Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or to satisfy applicable legal, regulatory, accounting, tax, contractual or dispute-resolution requirements.
In particular:
- order, invoice, payment, customs and accounting records may be retained for the period required by applicable Saudi tax and accounting laws;
- Wadi Bodega's VAT-related records are generally required to be retained for at least six years, subject to longer periods where applicable; ZATCA
- customer-account information may be retained while the account remains active and thereafter where reasonably necessary for legal, accounting or dispute-resolution purposes;
- customer-service and transaction correspondence may be retained for a period reasonably necessary to resolve enquiries, protect legal rights or comply with applicable requirements;
- marketing information will be retained until consent is withdrawn or the information is no longer needed for the relevant marketing purpose, subject to maintaining an appropriate record of any opt-out request.
When personal data is no longer required and no lawful basis exists for continued retention, it will be deleted, destroyed, anonymized or otherwise made irretrievable in accordance with applicable requirements.
Security
Wadi Bodega takes reasonable administrative, technical and organizational measures designed to protect personal data against unauthorized access, misuse, alteration, loss, destruction or disclosure.
However, no electronic system or method of transmission can be guaranteed to be completely secure.
Customers should protect their account credentials and should not send sensitive payment information through unsecured communication channels.
Your Rights
Subject to the PDPL and its Implementing Regulations, data subjects may have the following rights:
- the right to be informed about the processing of their personal data;
- the right to access personal data held about them;
- the right to obtain a copy of their personal data in a readable and clear form, subject to applicable requirements;
- the right to request correction, completion or updating of inaccurate or incomplete personal data;
- the right to request destruction of personal data where the applicable legal requirements are satisfied; and
- the right to withdraw consent where processing is based on consent.
These rights are recognized under the Saudi PDPL and its Implementing Regulations. Data Governance Platform
Some rights are subject to statutory exceptions, including where Wadi Bodega is required to retain information for tax, accounting, legal or regulatory purposes.
Exercising Your Rights
To exercise a data-protection right, please contact:
We may request information reasonably necessary to verify your identity before processing a request.
We will respond within the period required by applicable law.
Where processing is based on your consent, you may withdraw that consent through the mechanism provided for the relevant service or by contacting us.
Children
The Services are intended for individuals capable of entering into lawful transactions.
Wadi Bodega does not knowingly seek to collect personal data from children in circumstances where parental or guardian authorization is required by applicable law.
If you believe that a child has provided personal data to us improperly, please contact us so that we can review the matter.
Complaints
If you have concerns regarding Wadi Bodega's processing of your personal data, please contact us first so that we can investigate and respond.
You may also have the right to submit a complaint concerning an alleged violation of the Saudi Personal Data Protection Law through the competent Saudi data-protection authority. SDAIA provides a service for submitting and tracking PDPL complaints through the National Data Governance Platform. Data Governance Platform
Third-Party Websites
Our website may contain links to websites or services operated independently by third parties.
Wadi Bodega is not responsible for the privacy practices of independent third-party websites, and customers should review the privacy information provided by those parties before supplying personal data.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, service providers or applicable laws and regulations.
Where required by law, we will provide appropriate notice of material changes.
The current version of this Privacy Policy and its most recent update date will be published on our website.
Contact
For questions regarding this Privacy Policy, Wadi Bodega's handling of personal data or the exercise of data-subject rights, please contact:
Wadi Bodega Establishment (مؤسسة وادي بوديقا)
Commercial Registration No. 7054677823
Riyadh, Kingdom of Saudi Arabia
hamad@wadibodega.com
+966 50 345 7377