Privacy & Data (PDPL)

This privacy notice describes how Khalil Coffee ("we", "our", "us") collects, uses, stores, and discloses personal data when you visit coffeekhalil.com, place an order, subscribe to our journal, contact us, or otherwise interact with the storefront.

It is published in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL, issued by Royal Decree M/19 of 2021 and its implementing regulations) and is intended to be readable rather than performative. Where a defined PDPL term applies, we use it; where plain language is clearer, we use that instead.

Account & order data — name, email address, mobile number, billing and shipping addresses, order history, and order preferences (roast, grind, size).

Payment metadata — handled by our payment processors (Moyasar for Mada / Apple Pay / Visa / Mastercard; Tabby and Tamara for buy-now-pay-later). We do not store full card numbers; we store a transaction reference and the last four digits returned by the processor.

Communications — emails you send us, WhatsApp messages, contact-form submissions, and your wholesale-application details if you apply to stock our coffee.

Browsing analytics — privacy-friendly Plausible analytics (page views, referrer, country, device type) collected only with your consent. Errors are reported to Sentry to keep the site working.

Cookies — strictly necessary cookies for cart, language preference, and security; optional analytics and marketing cookies only after you opt in via the cookie banner.

Contractual necessity — to process and ship your order, deliver order updates, and handle returns or replacements.

Consent — to send the optional monthly journal, store optional analytics or marketing cookies, and to retain communications you initiate.

Legitimate interest — to keep the site secure, prevent fraud, and improve the storefront based on aggregated, de-identified usage data.

Legal obligation — to retain order and tax records for the period mandated by Saudi tax and commercial law.

Order and tax records — seven (7) years from the end of the financial year in which the order was placed, in line with Saudi tax-law retention requirements.

Marketing consent — until you withdraw it. Withdrawal is one click in any journal email, or by writing to us.

Analytics — aggregated and de-identified at collection; raw event data retained no longer than ninety (90) days.

Communications — email and WhatsApp threads retained for two (2) years from the last reply, then archived or deleted.

Payment processors — Moyasar (Mada / Apple Pay / Visa / Mastercard), Tabby (BNPL), Tamara (BNPL). They receive only the data needed to complete a payment.

Email delivery — Resend, used to send order, shipping, and journal emails.

Analytics & monitoring — Plausible (privacy-friendly analytics, EU-hosted) and Sentry (error monitoring).

Hosting — Vercel, which hosts the storefront infrastructure.

Shipping carrier — the courier handling your specific delivery, who receives your name, address, and phone number.

We do not sell personal data. We do not share data with advertisers. Where a third-party processor is involved, we operate under a Data Processing Agreement that limits use to the purpose we engaged them for.

You have the right to access the personal data we hold about you, correct any inaccuracies, request deletion (subject to retention obligations), restrict processing, object to direct marketing, and withdraw consent at any time.

You also have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe we have processed your data unlawfully.

To exercise any of these rights, email us at hello@coffeekhalil.com or message us on WhatsApp via the contact page. We respond within thirty (30) days of a verified request and will tell you in advance if we need longer for a complex request.

Strictly necessary cookies — for the cart, language preference, and security. These are always on; you cannot opt out without breaking the storefront.

Analytics cookies — Plausible, used only with your consent. Off by default.

Marketing cookies — used to remember your messaging preferences. None are active at launch.

You can change your choices at any time through the cookie banner or by clearing site data in your browser.

Data Protection contact: privacy@coffeekhalil.com — Tariq Hamayel, Founder & Data Protection Officer.

WhatsApp: linked from the contact page.

Postal address: Khalil Coffee, Irqah, Riyadh, Saudi Arabia. Full street address published once the shop opens to walk-in visits.