BlogLegal documents
What an online store's privacy policy has to say
Article 12 sets the minimum, and the buyer should see it before paying
Article 12 requires a privacy policy, available before you collect any data. SDAIA’s guide explains it for stores. Here is what a buyer should find.
Who you are
The store’s registered name, what you sell, and a contact someone reads. If you appointed a data protection officer, name them.
What you collect and why
Separate what the buyer types in from what the site collects on its own, like cookies and analytics. For each kind, say whether it is required, what it is for, and on what basis. That is consent, the order itself, or another law.
Shipping rests on the order. Retargeting ads need their own consent, and checkout must not depend on it (article 7).
Who gets it, and where it lives
Name the kinds of parties that receive data, such as the payment gateway, the courier and the email tool, and why.
Say where the data is stored. A payment or email provider outside the Kingdom is a transfer, and article 29 limits when that is allowed. Give a retention period for each kind of data, and say how you destroy it.
The buyer’s rights
List the rights in article 4. These are to know, to get a copy, to correct, to have data destroyed, and to withdraw consent. Say how to use them, and that you answer within 30 days.
Add how to complain to you, and that they can complain to SDAIA within 90 days. Link the policy in the footer and at checkout, and update it when what you collect changes.
References
