Privacy Policy – Bajri Platform

Last updated: May 2026

Dream Valley Company, the owner of the Bajri Digital Notifications Platform, hereinafter referred to as the "Service Provider" or "We", is committed to protecting your personal data and processing it in accordance with the highest standards of security and in compliance with the laws and regulations in force in the Kingdom of Saudi Arabia.

1. Nature of the Data We Collect

We collect and process only the minimum data necessary to provide the service, including:

• Name and mobile number: for the purpose of sending notifications that a booking/order is ready, only where you use such service.
• Technical access data: such as notification receipt time and browser type, for the purpose of ensuring technical performance quality and providing technical support.
• iOS app device identifiers: when using the native Bajri iOS app, we collect Apple Push Notification (APNs) tokens and Live Activity tokens to enable delivery of order-ready notifications to your device. An anonymous UUID and device fingerprint are also generated and stored locally on your device only, used to associate notifications with the correct device. These identifiers contain no personal information and cannot be used to identify you outside the scope of the application.

2. Purpose of Data Processing

Your data shall be processed solely for the following purposes:

• To provide you with instant notifications informing you that your order or booking with the "Subscriber" is ready.
• To enable the Subscriber to manage alerts and monitor the operational performance of the service through an administrative dashboard.
• To improve the efficiency of the Platform and provide the necessary technical support.

3. Legal Basis for Processing

Your data is processed on the basis of:

• Your explicit consent, as given when activating the service.
• Performance of a contract, in order to enable the Subscriber (merchant) to fulfill its obligation towards you by notifying you that your order or booking is ready.

4. Data Sharing and Disclosure

• We are committed to strict confidentiality and shall not disclose your data to any third party without your prior written consent, except where disclosure is required by law.
• Dream Valley Company (the Service Provider) undertakes to maintain the confidentiality of your data and not to disclose or use it for any purpose outside the scope of the service provided, while fully acknowledging the rights of the data subject as guaranteed under the Personal Data Protection Law.

5. Data Storage and Security

• Data shall be stored and processed within the territory of the Kingdom of Saudi Arabia to ensure the highest level of legal protection.
• We implement strict technical and administrative measures to prevent unauthorized access to, or leakage of, personal data.
• Data retention period: the mobile number shall be retained only for the duration of activation of the notification service and shall be deleted immediately upon cancellation of the subscription or once the purpose of collection has ceased, unless a law requires retention for a specified period.

6. Your Rights under the Personal Data Protection Law (PDPL)

As a Data Subject, you have the following rights:

• Right to be informed: to know the purpose of collecting your data and how it is processed.
• Right of access: to access the data we hold about you.
• Right to rectification: to request that your data be updated if it is inaccurate.
• Right to destruction: to request deletion of your data once the purpose of collection has ended, unless there is a legal requirement to retain it.
• Right to withdraw consent: you may withdraw your consent to the processing of your data at any time without restriction, and the Service Provider shall cease processing upon receipt of such withdrawal request, provided that this may affect your ability to benefit from the notification service.
• Right to lodge a complaint: you may file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe that your data has been processed in violation of the Personal Data Protection Law, through the Authority's official website: sdaia.gov.sa.
• Method of exercising rights: any request relating to your rights may be submitted via the email address set out in Clause 8 below, and such request shall be responded to within a period not exceeding thirty (30) days from the date of receipt.

7. Amendments to this Policy

The Service Provider may amend this Policy in line with technological and legislative developments in the Kingdom, and users shall be notified of any material changes.

8. Contact Us