Privacy Policy

01Order information and purposes

We collect information you provide: name, mobile number, city, district, address, ordered items, amounts, status and optional delivery notes. A confirmed map pin is saved with the order if you choose one. Essential contact and address fields are required to fulfil your order; the pin and notes are optional.

We use this information to process and deliver orders, contact you about them, support warranties and returns, prepare invoices and records, and meet legal obligations. Ordering is not consent to marketing. We do not currently collect payment-card details. Please do not include medical information, identity-document images or payment details in delivery notes.

When choosing Apple Pay, you can share your saved Wallet name, email and address to fulfil the order, depending on the details you have saved. Direct purchase uses the name, phone and address you confirm in Wallet, with delivery fees shown for that city before payment. A verified account retains its verified phone; regular checkout with a map retains the pin you confirmed. Tap and Apple process payment information; the store does not receive your card number or security code.

02Basis for processing

We process information needed to enter into and fulfil your order on the basis of our agreement with you. Records and invoices required by law are processed to meet legal obligations. Optional browsing analytics rely on your consent, which you can withdraw in Privacy settings without affecting your order.

Using the map and submitting a confirmed pin are optional. Your selected location is used to establish the delivery address when fulfilling the order. Consent to purchase and delivery information are not used to send unsolicited marketing.

03Maps and location

Maps are optional. Opening a map connects your browser to OpenStreetMap, which may receive connection and viewed-area information. Confirming a pin sends its coordinates to Photon to suggest an address, without your name, phone or order contents.

Using your current location requires browser permission. You can decline, remove the pin, and enter your city and address manually. Map results are suggestions for you to review, not verified addresses. Map providers may process information outside Saudi Arabia; using them is not required to order.

04Who receives information

Authorized store staff can access order details. Only necessary delivery information is shared with the driver or carrier. Hosting and operational services process information needed to run the store; Resend handles operational email notifications.

When the accounting integration is enabled, the store uses a shared Wafeq contact. The actual buyer name and order reference appear on the invoice alongside the items and amounts needed for accounting. Authorized managers can access customer and order reports for service and operations. Placing an order does not mean consenting to promotional messages. We do not sell customer data. Linking a shopping session to an order for campaign measurement requires optional analytics consent and does not authorize promotional messages. Access is limited to people and services needed for the purpose.

05Basket, account and analytics

Your basket, language and privacy choices are stored on your device. You can currently order as a guest without an account or SMS verification code and follow the order through its private link. Knowing a phone number alone does not provide access to past orders. Any account or mobile verification service will be explained before you use it if it becomes available.

Optional shopping analytics start after your consent. They record pages, products, basket actions, checkout stages, error categories, ad source and device type. We link the session to the order identifier and delivery and collection outcome to measure campaigns within the store; authorized administrators can link it to the order record. Browsing events do not contain names, phone numbers, addresses or coordinates and are not sent to ad platforms. Sessions expire after 30 minutes of inactivity; visitor identifiers change daily. Events and order-attribution links older than 90 days are periodically deleted. Withdrawing consent in Privacy settings stops future tracking and clears device identifiers; contact us to request removal of past records.

After separate analytics consent, we use Google Analytics to measure traffic sources, shopping steps and aggregate paid-order amounts. We avoid sending medical product names or details, customer names, phone numbers, addresses, coordinates, private tracking links or search text. Google may process connection data and analytics-cookie identifiers outside Saudi Arabia. Ad personalization and Google Signals are disabled. The Google tag loads only after consent, which can be withdrawn in Privacy settings. Browser measurement may not include every order; store records remain the source of truth for actual sales.

06Retention and security

Order records are retained as needed for fulfilment, warranties, returns, disputes and statutory financial-record requirements. Information is deleted or de-identified when it is no longer needed for a lawful operational or legal purpose.

We use encrypted connections and restricted administration access. Keep your tracking link private because it provides access to your order and invoice, including the details on it. Do not share API keys, passwords or card details in order notes or emails.

07Your rights and contact

Subject to applicable conditions and exceptions, you may request access, a copy, correction or destruction of information no longer needed, and withdraw consent where processing relies on it. Declining analytics does not prevent shopping. Proportionate identity checks may be needed to protect your information.

For privacy requests or complaints, contact info@cmsest.com.sa or +966593988466. Address: Khalid bin Al-Walid Street, Al Sharafiyah, Jeddah. We handle requests to exercise data rights within 30 days. An extension of no more than a further 30 days may apply in the circumstances permitted by the regulations, with advance notice explaining the reasons. You may also complain to the competent personal-data protection authority through the National Data Governance Platform.

08Customer reviews and publication consent

Customers may rate their shopping and delivery experience from one to five stars and leave a comment after delivery is recorded. Reviews remain pending until the customer explicitly consents to publication and the store approves them.

Published fields are first name, last name, rating and comment only. We do not publish order numbers, phone numbers, email, addresses or purchased products. Please leave contact and health information out of the review text.

Reviews help measure customer satisfaction and support transparency. The store may decline publication, unpublish or delete a review. Customers can edit and resubmit a review for approval, or withdraw publication consent from their order details. Moderation does not change the wording or star rating.