Privacy Policy

1. Data We Collect

When you create an account: your Saudi mobile number (the account identifier), name, email address, password (stored encrypted; we cannot read it), date of birth, username, and any profile or cover photo you choose to add.

When you create a wishlist: the required delivery details, including your shipping address within the Kingdom (city, district, street, building, postal code, notes) and your national short address if you add it.

When you gift as a guest without an account: your mobile number (verified by a one-time code), your name if you choose to enter one, and technical request data (IP address and browser type) used for abuse prevention only and never shown to any user.

When you contribute: the amount, your chosen name-display mode, and your gift message if you write one. When you choose hidden gifting, your identity is not displayed to other users, including the wish owner. Hidden gifting does not delete account data, guest-gifter data, or payment records; access to retained data is limited to authorised parties for the purposes described in the Privacy Policy.

When you request additional verification (KYC): your national ID/Iqama number and legal name (both stored encrypted) and the document images you upload.

What you post: wishlist and wish images, Thankful moments, and messages, displayed on platform pages according to the privacy settings you choose; access through public image URLs is explained in Section 3.

We use no advertising or marketing trackers. The only cookies are functional: language preference and day/night theme. The website uses a technical monitoring service to detect faults and improve the platform's reliability; this service may process technical data about your browsing session.

2. Purposes and Legal Basis

We process your data with your consent and/or to perform our contractual relationship with you (PDPL Arts. 5–6), in order to: create your account and verify your mobile number with one-time codes; operate wishlists and receive contributions; process payments through the payment service provider; fulfil completed wishes (purchasing the product and delivering it to your address); send notifications about your account and wishes; prevent fraud and abuse; and meet legal obligations. The data required at registration is mandatory for creating an account, and the required delivery details, including a valid delivery address within the Kingdom, are mandatory for creating a wishlist. Photos and the national short address are optional. When requesting additional data, we explain whether it is required for the requested service and the effect of not providing it.

We may send you messages about Omniya's services and offers; you can ask us to stop at any time via support@omniya.sa.

3. Disclosure and Sharing

We do not sell your personal data and disclose it only as follows:

The licensed payment service provider: processes your payment on its own secure page; your card details never reach us and are not stored by us.

The SMS delivery provider: receives your mobile number to deliver verification codes.

The email delivery provider: receives your email address to deliver platform messages.

The store and delivery carriers: when fulfilling a completed wish, we provide the seller and carrier with the recipient's name, address, and mobile number to the extent needed for delivery.

Cloud hosting and storage providers: platform data and images are stored with cloud service providers and may be processed or stored outside the Kingdom; we take the measures required to protect data in accordance with PDPL Art. 29.

Competent authorities: where required by law or to satisfy judicial requirements.

Note: profile, wishlist, wish, and Thankful-moment images uploaded to the public image area are stored on a public content-delivery network. Wishlist privacy settings control access to its pages within the platform, but do not protect direct image URLs; anyone with a direct image URL may be able to access that image outside the wishlist page. Do not upload sensitive images or identity documents to this area.

4. Retention and Destruction

We keep your data while your account exists and as long as the purposes above require. When you delete your account, the account is deactivated and your sign-in identifiers are detached from it; we retain financial transaction records, contributions, and whatever a legal basis requires us to keep (such as financial and anti-fraud requirements), and destroy what is no longer needed in accordance with PDPL Art. 18. Account deletion is temporarily refused while a wish of yours is being fulfilled, until fulfilment concludes.

5. Your Rights

Under PDPL Art. 4 you have the right to: be informed of the purposes of processing (which this policy provides); access your data and obtain a copy by requesting it from support@omniya.sa; correction and updating (you can edit your name, photos, birthday, and address in account settings, and change your username and email after verification); destruction of data no longer needed; and withdrawal of consent at any time.

To exercise any of these rights, contact us at support@omniya.sa and we will respond within the legally prescribed period. If you believe our processing violates the law, you may lodge a complaint with the competent authority (the Saudi Data & AI Authority, SDAIA) under PDPL Art. 34.

6. Data Security

We apply organisational and technical measures to protect your data, including: encryption of passwords and of KYC identity numbers and legal names; database-level access controls; one-time-code verification of sensitive operations (such as email change and account deletion); and restricting guest-gifter data to the operations team. If a breach affects your data in a way likely to cause serious harm, we will notify you and the competent authority in accordance with PDPL Art. 20.

7. Eligibility

The platform is intended for those with the legal capacity to enter into contracts. If we learn that data has been processed without valid consent from its subject or their guardian, we will take the necessary action.

8. Changes and Contact

We may update this policy; the updated version applies from its publication on the platform, and we will notify you of material changes. Publication of the updated policy, continued use of the platform, or acceptance of the Terms does not replace any separate consent required for personal-data processing. For any question about this policy or your data: support@omniya.sa.