Privacy policy
Privacy Policy
Effective date: 2 May 2026. Last updated: 26 October 2026.
1. Who we are
Blossom Wings is a brand of Barq AlMada Company (شركة بارك ألمادا), Commercial Registration 7054059360, VAT number 314731788300003. Registered address: Building 2999, Al Imam Faisal Bin Turki Ibn Abdullah St., Al Dirah Dist., Riyadh 12633, Kingdom of Saudi Arabia. We are the controller of your personal data under the Saudi Personal Data Protection Law (PDPL).
Privacy contact: privacy@blossomwings.com, WhatsApp +966 50 516 9433.
2. What we collect
From you: name, email, phone number, delivery and billing address, order history, your bank account details if we refund a Cash on Delivery order by transfer, messages you send us, reviews and photos you choose to post, and your marketing choices.
Automatically when you visit: IP address, device and browser type, pages and products viewed, referring site, approximate location (city level, from IP), and cookie identifiers.
From partners: payment confirmation and fraud signals from our payment providers, delivery status from our couriers, and aggregated ad reports from advertising platforms.
We never see or store your full card number.
3. Why we use it, and the legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| Taking, delivering and supporting your order | Performing our contract with you |
| Invoices, VAT records, consumer-law duties | Legal obligation |
| Fraud prevention and site security | Our legitimate interest |
| Site analytics (what is viewed, what breaks) | Our legitimate interest. You can opt out at any time (section 9) |
| Measuring and showing our ads on Snapchat, TikTok, Google and Meta (Facebook and Instagram) | For visitors in Saudi Arabia: our legitimate interest, with notice in this policy and an opt-out you can use at any time (section 9). For visitors in the EEA, UK, Iceland, Liechtenstein and Norway: your consent, given through the cookie banner |
| Marketing emails, SMS and WhatsApp messages | Your consent. Every message has an unsubscribe link |
| Reviews | Your consent for anything you post |
| Bloom Tracker | Your explicit consent, given inside the tracker (section 10) |
We do not use health data for marketing. We do not sell your personal data.
4. Who we share it with
Only the providers we need to run the store, each under a data processing agreement:
- Shopify (store, checkout, hosting)
- Tap Payments, the mada network, Apple Pay, STC Pay, Visa, Mastercard, Tabby and Tamara (payments). For Cash on Delivery, the courier or our delivery team collects the payment
- SMSA Express and our own Riyadh delivery team (delivery)
- Klaviyo (email and SMS you subscribed to)
- Judge.me (product reviews)
- Google Analytics 4 (analytics)
- Snapchat, TikTok, Google Ads and Meta (ad measurement, see section 9)
- Zoho (accounting and invoices)
- Professional advisers and authorities where the law requires it
5. Your rights
Under the PDPL you can: be told how we use your data, get a copy of it, have it corrected, have it deleted when we no longer need it, withdraw consent at any time, and object to advertising and analytics use. Email privacy@blossomwings.com or WhatsApp us. We answer within 30 days. There is no charge.
If you aren't satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA). If you live in the EEA or UK you also have the rights given by the GDPR, including a complaint to your local authority.
6. How long we keep it
Order and invoice records: 7 years. Marketing data: until you unsubscribe, plus a short record that you did. Analytics: 14 months. Support messages: 3 years from your last contact. Proof-of-delivery photos and signatures: 12 months. Bloom Tracker: see section 10.
7. Security
HTTPS across the site, PCI DSS compliant payment partners, access limited to the team members who need it. If a breach puts your data or rights at risk we tell SDAIA within 72 hours of learning of it, and we tell you without delay.
8. Transfers outside Saudi Arabia
Some providers process data outside the Kingdom: Shopify, Klaviyo, Google, Meta, Snap, TikTok and Judge.me. We rely on each provider's data processing terms and contractual safeguards.
We send only what each provider needs. Bloom Tracker history and symptoms never leave the Kingdom.
Delivery data also stays in the Kingdom when our own Riyadh delivery team delivers your order. We store it on our own server in our Riyadh office, not with a third-party cloud provider. It covers your name, phone number, delivery address, order number, the Cash on Delivery amount, any location pin a driver saves for your address, and the proof-of-delivery photo and signature. Only authorised team members can see it: each driver sees only the orders given to them, and only authorised managers can view proof-of-delivery photos and signatures. We keep proof-of-delivery photos and signatures for 12 months. Backups are kept on the same office server for 14 days. The connection between a driver's phone and our server is encrypted, and passes through a relay service (Tailscale) that cannot read it. When a driver taps to navigate or to message you, their phone opens Google Maps or WhatsApp with your address or number. Shopify still receives your order's delivery status (delivered or not delivered) with a short note.
Until 9 November 2026, an older copy of delivery records made before 26 October 2026 is also held by our previous provider, Supabase, in India. It will then be deleted.
9. Cookies, pixels and your choices
Full detail is in our Cookie Policy. In short:
- Strictly necessary cookies keep the cart, checkout and login working. They are always on.
- Analytics: Shopify analytics and Google Analytics 4. The data is pseudonymous and we read it in aggregate.
- Advertising and measurement: the Snapchat Pixel, TikTok Pixel, Meta Pixel and Google Ads tag, plus server-side "conversions API" events. If you have identified yourself to us (logged in, started checkout, subscribed), a hashed version of your email or phone may be included so the platform can match the event. We never send your readable email or phone to ad platforms.
- Klaviyo and Judge.me set cookies to run emails and reviews.
In Saudi Arabia these technologies are active when you visit. We don't show a consent banner in the Kingdom. You can opt out at any time:
- Block or delete cookies in your browser.
- Turn off ad personalisation inside your Snapchat, TikTok, Google, Facebook and Instagram accounts.
- Email privacy@blossomwings.com and we'll exclude you from advertising measurement wherever the platform allows it.
Visitors in the EEA, UK, Iceland, Liechtenstein and Norway see a consent banner, and nothing beyond strictly necessary cookies runs until they accept.
10. Bloom Tracker
What we collect: the period dates you log, the symptoms you select, and your settings. Why: to show your history and estimates inside your account, and to send a reminder if you switch it on. Where: servers inside Saudi Arabia (Google Cloud, Dammam region). Who else: only Klaviyo, and only if you enable reminders, and it gets your email, the reminder date and your language, nothing else. Consent: nothing is saved until you give explicit consent inside the tracker, and you can withdraw it at any time. Your controls: download or permanently delete your data from the tracker's Settings. Retention: deleted after 24 months of inactivity, or at once on request. Tracker data is never used for advertising and is never shared with ad platforms. The tracker gives general wellness estimates. It isn't a diagnostic tool and doesn't give medical advice.
11. Children
We don't knowingly collect data from anyone under 13. Under 18s should order with a parent or guardian.
12. Changes
We'll post changes here and update the date above. For material changes we'll also email customers we hold an address for.
13. Contact
privacy@blossomwings.com · WhatsApp +966 50 516 9433 · Blossom Wings, Barq AlMada Company, Building 2999, Al Imam Faisal Bin Turki Ibn Abdullah St., Al Dirah Dist., Riyadh 12633.