Privacy policy

HAYPP Company KSA LLC

HAYPP Company KSA LLC (“HAYPP”, “we”, “us”, or “our”) is committed to protecting Personal Data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (the “PDPL”) and its Implementing Regulations. HAYPP is a company established in the Kingdom of Saudi Arabia and operates an e-commerce business selling age-restricted nicotine products to customers in the Kingdom, having its offices in Riyadh, Saudi Arabia. To complete a product order, all customers are required to age verify in connection with the purchase of the products.

This Privacy Policy explains how we process Personal Data when the customer purchase our products or otherwise interact with HAYPP through our website, digital channels, or customer service.

1. Definitions and Interpretation

In this Privacy Policy, capitalized terms have the meanings assigned to them under the PDPL and its Implementing Regulations, unless otherwise expressly defined in this Policy.

For ease of reference:

• “Personal Data” means any information that may identify an individual directly or indirectly.
• “Data Subject” means the individual to whom Personal Data relates.
• “Controller” means HAYPP KSA LLC, as the entity determining the purposes and means of Processing.
• “Processor” means any entity Processing Personal Data on behalf of HAYPP and under its instructions.
• “Processing” means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, analysis, and destruction.
• “Age Verification Services” means the age-verification solutions used by HAYPP in the Kingdom of Saudi Arabia from time to time, including but not limited to Nafath, or any other service provider selected by HAYPP at its sole discretion
• “Middleware” means the locally hosted technical layer in Saudi Arabia used to transfer age-verification outcomes to the e-commerce platform.

HAYPP processes Personal Data in accordance with the PDPL principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

This means we only process Personal Data where we have a valid legal basis, we clearly explain how and why data is used, we limit processing to what is necessary for specified purposes, we maintain appropriate data quality and security controls, and we keep evidence of compliance through documented governance and records.

2. Controller Details and Contact Information

The Controller of Personal Data covered by this Policy is:

• Entity Name: HAYPP Company LLC
• Address: 3244 King Abdullah street, Alnuzha district, Riyadh 12471, Saudi Arabia (Office 615)
• Phone Number: 0567891316
• E-mail: care@haypp.sa
• License / Commercial Register: CR 7054403493

For privacy requests, complaints, or rights exercise, please contact us using the details above.

3. Overview of Our Services and Audience

HAYPP provides e-commerce services for age-restricted products in Saudi Arabia. Users browse products, place items in basket, and proceed through checkout. Before a new user can complete checkout (and where applicable, account registration tied to checkout), age verification must be completed successfully.

HAYPP uses Shopify as its e-commerce platform, hosted in Ireland. For Saudi age verification, HAYPP uses NAFATH services from local providers, with locally hosted Middleware in Saudi Arabia (Google Cloud KSA environment) to process local age verification flow and transmit the verification result needed for checkout progression.

4. Personal Data We Collect

Depending on your interaction with us, we may collect and process the following categories of Personal Data:

• Identity information. Information that makes it possible to identify you, for example your full name, date of birth, account identifier, and login credentials.
• Contact information. Information that makes it possible to contact you, for example your email address, mobile number, delivery address, and billing address.
• Order and delivery information. Information about your order and chosen delivery method, for example the product, purchase price, order date, subscription status, and fulfilment records.
• Profile information. Information regarding your profile, for example your account preferences and purchase history.
• User generated information. Information regarding your activity and use of our website and digital channels, for example clicks, visits, and your behaviour when using our website and digital channels.
• Communication. Contents of communication with us, for example email correspondence with our customer service team, complaints, and service tickets.
• Technical information. Technical information about the device you use when visiting our website and digital channels, for example type of device, browser version, IP address, session logs, and operating system.
• Age verification outcome data. Information relating to the outcome of your age verification, for example your verification reference and verification result.

Where a field is mandatory for age verification, checkout, fraud prevention, order fulfillment, or legal compliance, failure to provide that information may prevent completion of service.

5. How We Collect Personal Data

We collect Personal Data directly from you when you make a purchase on our website, use our website and other digital channels, contact customer service, or participate in a market survey. When you make a purchase, we also collect identity information, contact information, and order and delivery information from our payment service providers. To ensure that your delivery has arrived or to track your shipment, we collect order and delivery information from the couriers and shipping companies we collaborate with. We collaborate with different companies, for example marketing platforms, and collect the Personal Data that they share with us to manage the relationship with the partner. If you visit our channels on social network platforms, we collect the Personal Data that you provide to us when using these channels. We also supplement the Personal Data that we collect about you with information from external information services, in order to communicate and send offers in various channels, to carry out analysis for customer insights, and to carry out age verification. We also collect certain technical information automatically from you or your device through cookies, server logs, and device/session analytics to support platform operation, security, diagnostics, service performance, and user experience improvements.

We also obtain certain Personal Data from third-party service providers such as age verification services. In particular, for age verification in Saudi Arabia, HAYPP uses NAFATH service through local Middleware. This flow is used to determine eligibility for adult-only purchases and to allow or block checkout accordingly.

6. How We Use Personal Data

We use Personal Data to perform age eligibility checks; operate user accounts; process and fulfill orders; manage subscriptions; process payments and refunds through authorized providers; coordinate shipping and delivery; provide customer support; detect and prevent fraud and abuse; maintain security and audit logs; comply with legal and regulatory obligations; and generate business analytics and operational reports.

Where marketing is enabled and when consent is given when and if needed, we may use contact and preference data to send promotional communications in accordance with applicable law and your choices. You can opt out using unsubscribe tools or by contacting us.

Where we rely on your consent to process Personal Data, such consent will be obtained in a clear and informed manner.

In all cases, Personal Data will be destroyed without undue delay once the purpose for which it was collected has been achieved, in accordance with PDPL. Personal Data will only be retained beyond that point where required by applicable Saudi law for a specified period, or where the data is necessary in connection with proceedings before a judicial authority, in which case it will be destroyed upon conclusion of those proceedings.

7. Age Verification Controls

HAYPP is required to verify the age of all customers, since the products sold are age-restricted. Age verification is mandatory before an eligible purchase can be completed. If age verification fails, is declined, or cannot be completed, checkout is blocked and the order is not processed.

The age-verification flow in Saudi Arabia is carried out through NAFATH integration, with local Middleware hosted in Saudi Arabia. The process is triggered only at first-time registration: the consumer enters their national ID number into HAYPP's system, which then submits the ID number to NAFATH for verification. Upon successful verification, NAFATH returns the consumer's identity data (including full name, age, national ID number, and address) to HAYPP. NAFATH acts as a Processor under PDPL Article 1(19), processing Personal Data on HAYPP's behalf and under HAYPP's instructions for the sole purpose of verifying customer eligibility to purchase age-restricted products.

HAYPP processes the data received from NAFATH to determine eligibility and, where the consumer meets the age threshold, transmits only the verification outcome (eligible / not eligible) to Shopify systems in Ireland to authorise the transaction. No underlying identity data returned by NAFATH is shared with Shopify; such data is retained by HAYPP only to the extent strictly necessary for order management and compliance purposes. HAYPP remains responsible as Controller for ensuring compliance with the PDPL and has a data processing agreement in place with NAFATH in accordance with PDPL.

After the initial registration and verification, the consumer is not re-verified through NAFATH for subsequent purchases; they simply log in to their existing HAYPP account.

8. Disclosure of Personal Data

HAYPP does not disclose Personal Data to third parties for unrelated purposes. We may disclose Personal Data to service providers and partners where necessary for service delivery and legal compliance.

Recipients may include Shopify (e-commerce platform operations), TAHAKOM (age-verification integration), infrastructure providers supporting local Middleware and hosting, payment service providers, logistics and delivery providers, customer-support and communication tools, analytics/security providers, and competent authorities where required by law.

All disclosures are limited to what is necessary for the intended purpose and are governed by contractual and operational safeguards.

We share your Personal Data with the following categories of recipients where necessary for the purposes set out in this Privacy Policy:

• E-commerce platform provider. We share identity information, contact information, order and delivery information, and age verification outcome data with Shopify Inc., our e-commerce platform provider, for the purpose of operating our platform, managing orders, and processing transactions.
• Age verification providers. We share your full name, national ID number, date of birth, and mobile number with our age verification service providers (including Nafath, or any other provider selected by us from time to time) for the purpose of verifying your eligibility to purchase age-restricted products.
• Payment service providers. We share identity information, contact information, and order and delivery information with our authorised payment service providers for the purpose of processing payments and managing refunds.
• Logistics and delivery providers. We share identity information, contact information, and order and delivery information with our logistics and delivery partners for the purpose of fulfilling and delivering your order.
• Customer support and communications platforms. We share identity information, contact information, and communication data with our customer support and communications platform providers for the purpose of managing customer service interactions.
• Analytics and security providers. We share technical information and user generated information with our analytics and security providers for the purpose of monitoring platform security, preventing fraud, and improving our services.
• Marketing platforms. Where you have given your consent to receive marketing communications, we share identity information, contact information, and activity information with our marketing platform partners for the purpose of sending you offers and promotional materials. You may withdraw your consent at any time by using the unsubscribe link in our communications or by contacting us at care@haypp.sa
• Competent authorities. We disclose Personal Data to competent authorities, regulatory bodies, or law enforcement agencies where required to do so by applicable Saudi law or by a judicial order.
• Professional advisers. We share relevant Personal Data with our legal, financial, and compliance advisers where necessary for the management and defence of legal claims or for regulatory compliance purposes, under professional confidentiality obligations.

All recipients that process Personal Data on HAYPP's behalf do so under data processing agreements requiring them to process Personal Data only on HAYPP's instructions and in compliance with the PDPL and its Implementing Regulations. We do not sell your Personal Data to third parties.

9. International Transfers

Some processing activities may involve transfer or remote access outside Saudi Arabia, including processing required to operate Shopify-hosted services in Ireland.

Where Personal Data is transferred outside Saudi Arabia, HAYPP applies applicable PDPL cross-border transfer requirements, including appropriate assessments and contractual, organizational, and technical safeguards. HAYPP’s operating model is designed to keep age-verification processing local where required and to transmit only the minimum data necessary for transaction progression.

10. Storage, Retention, and Secure Destruction

HAYPP stores Personal Data securely in Ireland and Saudi Arabia, including approved service providers relevant to platform operations.

HAYPP retains Personal Data only for as long as necessary for the purpose of collection, legal/regulatory obligations, dispute management, fraud/security investigation, and legitimate operational needs permitted by law.

When the applicable retention period expires, or where Personal Data is no longer required for the purpose for which it was collected and processed, HAYPP securely destroys or irreversibly anonymises the data in accordance with its data retention and destruction controls and applicable legal requirements, using methods appropriate to the format and risk profile designed to prevent unauthorised access, recovery, reconstruction, or misuse. This includes the secure disposal of physical records and secure deletion of electronic data using methods appropriate to the nature and sensitivity of the data.

Where backup systems are used, HAYPP manages backup lifecycle and deletion processes in line with technical feasibility, security requirements, and legal obligations, and where immediate deletion from backup media is not feasible, HAYPP restricts access, prevents operational reuse beyond legitimate continuity needs, and ensures final deletion or irreversible anonymisation is applied within the backup lifecycle.

11. Your Rights Under PDPL

Under the PDPL and subject to legal limitations and exceptions, you may exercise your rights in relation to your Personal Data. These rights include:

• The right to be informed about how we collect and use your Personal Data, including the purposes of processing, legal basis, retention approach, how such data is stored, destroyed, and to whom it will be disclosed and categories of recipients.
• The right to request access to Personal Data we hold about you and to obtain a copy in a readable format where technically feasible.
• The right to request correction, completion, or update of inaccurate or incomplete Personal Data, such data will be reviewed and updated as soon as reasonably practicable.
• The right to request destruction of Personal Data in circumstances permitted by law. Where processing is based on consent, you may withdraw consent at any time; withdrawal will apply prospectively and will not affect processing already carried out lawfully before withdrawal. You also have the right to submit complaints regarding our processing of your Personal Data.
• The right to withdraw your consent for processing your Personal Data, at any time unless there are legal bases that require otherwise. Unless otherwise stipulated by the law, you will not be required to pay any fees in return for exercising this right. In case of submitting a request for exercising this right, you will receive a response within thirty (30) days as of the date the request is received.

HAYPP provides channels for rights requests and complaints through care@haypp.sa. To protect your Personal Data, we may need to verify your identity before implementing a request. HAYPP will respond to your request within 30 days of receipt in accordance with IR Article 3(1)(a). This period may be extended by a further 30 days where the implementation of your request requires disproportionate effort or where we receive multiple requests from you concurrently, in which case we will notify you in advance of the extension and the reasons for the delay. Unless permitted by law, we will not charge fees for ordinary rights requests. Where Personal Data has not been collected directly from you, HAYPP will provide required privacy information in accordance with PDPL and applicable regulations.

12. Cookies and Similar Technologies

HAYPP uses cookies and similar technologies for essential platform functions, security, performance monitoring, and analytics. Where non-essential cookies or tracking technologies are used and consent is required, HAYPP provides a consent interface and allows users to manage preferences through cookie settings. Users may update preferences at any time.

HAYPP collects the following data through cookies and similar technologies when you use our website and digital channels:

• Essential cookies. We use cookies that are strictly necessary for the operation of our platform, including security functions, authentication, and session management. These cookies do not require your consent as they are necessary to provide the service you have requested.
• Performance and analytics cookies. We use cookies and similar technologies to monitor platform performance, carry out analytics, and improve our services.
• Marketing and tracking cookies. Where you have given your consent, we use cookies and similar technologies to deliver relevant marketing content and to follow up and evaluate our campaigns.

You may manage your cookie preferences and withdraw your consent at any time through our cookie settings at cookie settings. The withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal. Withdrawing consent for non-essential cookies will not affect your ability to use the core functions of our platform.

For direct marketing, HAYPP uses contact and preference data in accordance with PDPL requirements and user choices. Users may opt out at any time through unsubscribe tools or by contacting HAYPP.

13. Security Measures

HAYPP applies technical and organizational measures appropriate to risk, including access controls, authentication controls, monitoring and logging, encryption/protection controls where appropriate, environment hardening, secure development/change controls, and incident response procedures.

HAYPP periodically reviews and improves safeguards. No system can be guaranteed to be completely risk-free.

14. Privacy Governance and Accountability

HAYPP maintains a privacy governance framework to support ongoing compliance with PDPL. This includes maintaining records of processing activities covering purposes, data categories, recipient categories, retention logic, and international transfer scenarios where applicable.

For processing activities likely to present elevated risk, HAYPP performs documented privacy impact assessments and applies mitigation measures proportionate to identified risks. HAYPP also maintains governance controls for consent-based activities, including consent capture records, withdrawal handling, and preference/suppression management.

15. Personal Data Breach Handling

If a Personal Data breach occurs, HAYPP follows internal incident management procedures for detection, containment, investigation, remediation, and required notifications. Where required by law, notifications are made to competent authorities and, where applicable, affected Data Subjects, within required timelines.

16. Complaints and Objections

If you have any concerns about how HAYPP processes your Personal Data, you may submit a complaint using the contact details provided in section 2 (Controller Details and Contact Information).

If you are not satisfied with how we process your complaint, or if we fail to respond within the timeframe set in section 11 (Your Rights Under PDPL), you can file a complaint to the Competent Authority (SDAIA). Address: Riyadh, Kingdom of Saudi Arabia. Website: sdaia.gov.sa. National Data Governance Platform (DGP): dgp.sdaia.gov.sa.

17. Policy Updates

This Privacy Policy was last updated on July 15, 2026. We may update this Policy from time to time to reflect legal, technical, or operational changes. The latest version is published on our website.