Privacy Policy

Effective 15 September 2026. The data controller is Osoul Al-Tahiya Food Company, which operates bakedbybm.com, of 3820 Prince Bandar bin Abdulaziz Street, Riyadh, Saudi Arabia. For privacy and rights: info@bakedbybm.com or 0559193712. This policy explains how customers' and visitors' data is handled.

What we collect, and from where

From the customer we collect the name, contact details, delivery address, order details and the correspondence needed to serve them. From payment and delivery providers we may receive the transaction's status and reference and the delivery status. While the site is in use, technical connection data such as the internet address, browser type, security logs and session data may be processed, to the extent needed to run and protect the service. We do not ask for data beyond the defined need of the service, and we explain any additional collection and its purposes when it is enabled.

Purposes and lawful bases

We use order and contact data to carry out the sale and delivery agreement and to serve customers, and accounting data to meet statutory obligations. Marketing messages rest on a separate, optional consent that can be withdrawn. Where we rely on a legitimate interest to protect the site and prevent fraud, we assess its necessity and its effect on individuals' rights as the law requires. Mandatory fields are marked on the form; not providing them may prevent the order being completed or delivered, without obliging the customer to accept marketing.

Sharing and transfer

We share the minimum necessary with payment and delivery providers, with hosting and technical support providers where they are engaged to deliver the service, and with the competent authorities where the law requires it. We set access permissions and require anyone processing data on our behalf to protect it and use it only for the defined purposes. We do not sell personal data. Any transfer of personal data outside the Kingdom, or access to it from outside, is subject to the statutory transfer controls and appropriate safeguards; using the site is not a general consent to transfer data.

Retention and security

We keep order and invoice data for as long as is needed to carry out the order, meet statutory record-keeping requirements and settle claims. Service correspondence is kept until the order or complaint is closed and it is no longer needed, and technical data for as long as is needed for operation, security and investigating incidents. Marketing data is used until consent is withdrawn or the purpose ends, keeping the minimum needed to honour a request to stop messages. We review whether retention is still needed, and destroy or anonymise data when the purpose has gone and no legal obligation requires it to be kept. We take appropriate technical and organisational measures to prevent unauthorised access, to deal with data incidents and to report them where the law requires.

Your rights

Subject to the statutory conditions and exceptions, you have the right to be informed of the processing of your data and to access it, to request a legible and clear copy, to have it corrected, completed or updated, to request its destruction, and to withdraw consent where the processing rests on it. Withdrawing consent does not affect the lawfulness of processing before it, and we may continue to hold data the law requires us to keep.

Making a request or a complaint

Send your request to info@bakedbybm.com describing the right you are exercising and how to reach you. We may verify your identity proportionately before disclosing data. We deal with the request within the statutory period, and explain any extension or inability and its reasons as the law requires. A complaint may be made to SDAIA through the National Data Governance Platform at dgp.sdaia.gov.sa.

Cookies

Necessary cookies are used, where needed, to run the site's functions such as the basket, the session and security. If non-necessary analytics or advertising tools are enabled, we tell the user the kind of data, the purpose, the provider and the cookie's lifetime through a privacy settings notice, and we ask for consent where the law requires it before enabling them. Cookies can be managed from the browser's settings and from the consent options the site provides when such tools are enabled. Disabling necessary cookies may affect some of the site's functions.

Marketing and updates to this policy

Subscribing to offers is optional and can be cancelled through the unsubscribe route in the message or by contacting us. Using the site is not an automatic consent to marketing. We show the date of the last update, explain material changes, and ask for fresh consent where the law requires it.