Seller privacy policy

Seller privacy policy for the Marah app

Covering the seller's representatives, users, employees and drivers

Last updated: 18 August 2026

This policy explains how Meatsteak Company, unified national establishment number 7052155863, with its head office in Riyadh, collects the personal data connected with sellers joining and using the Marah app, and how it processes, protects, discloses and destroys that data. Meatsteak Company is the controller of this data where it determines the purposes and means of processing.

The policy applies to the seller where the seller is a natural person, and to the owners, representatives, employees, account users and drivers of the selling establishment and other natural persons whose data is provided to Marah for the purposes of the seller relationship. Establishment data that does not identify a natural person is not personal data, but may still be protected by confidentiality and other laws.

First: meaning of terms and scope of the policy

Personal data: any data that leads to identifying a natural person directly or indirectly, such as name, identity number, mobile number, email, account identifier and location.
Processing: any operation carried out on data, such as collection, recording, storage, use, analysis, disclosure, transfer, restriction and destruction.
Data subject: the natural person to whom the data relates, such as the seller's owner or representative, an employee, an authorised user or a driver.
This policy does not govern customer data obtained by the seller to fulfil an order; that data is subject to the seller terms, the customer privacy policy and the seller's own legal obligations.

Second: the data we collect

Identity, contact and business data: name, job title, the person's capacity with the seller, mobile number, email address, city, national address and employer details.
Verification and authorisation data: national identity or residency number, date of birth or an image of the official document, only where permitted or required by law, together with the authorisation, power of attorney or signing authority and the data of the owner or beneficial owner where required.
Establishment data connected with individuals: trade name, commercial registration, type of activity, national address, articles of incorporation, municipal, health and food licences, tax certificate and expiry dates, and the data of their owners or representatives contained in them.
Account and security data: user identifier, verification code and record of its success, roles and permissions, sign-in and change logs, account status, language, notification settings, and sign-in attempts or unusual activity.
Bank and settlement data: bank name, IBAN, beneficiary name and proof of account, and statements of orders, commissions, fees, taxes, transfers, refunds, banking chargebacks and payment transaction identifiers. Marah does not directly retain full payment card numbers or their security codes.
Store and operations data: branches and their locations and hours, means of contact, images of the store and products, prices, stock, preparation time, service area, minimum order, delivery option, and the names of the persons responsible for operations.
Order and performance data: orders accepted, rejected and cancelled, response, preparation and handover times, amounts, ratings, complaints, refunds, operational breaches and support actions.
Driver and delivery data where seller delivery is enabled: name, contact and account details, validity, driving licence, vehicle data, insurance or permits where required, trip location, and the statuses of collection, arrival, handover and its proof.
Location data: the branch location, and the location of the user's or driver's device where permission is granted and a feature relying on it is active. Precise tracking of the driver is limited to the trip or the necessary working period and is not used for continuous monitoring outside the stated purpose.
Communication and support data: correspondence, conversations and recorded calls after notice where required, complaints, attachments, images and the record of handling the order.
Technical and usage data: internet protocol address, device type and identifiers, operating system, app version, language and region, crash and performance logs, the pages and features used, the notification token, and analytics and campaign measurement tools depending on the installed version.
Marketing and preference data: marketing consent, the channels chosen, interaction with offers and invitations, and partner-specific programmes.

We do not collect sensitive data or images of official documents merely for convenience. If collection is necessary for a legitimate or statutory purpose, we identify the need and the basis, request explicit consent where consent is the basis, apply stronger protection, and do not use sensitive data for marketing.

Third: sources of data

Directly from the data subject on registration, verification, or managing the account, the store, orders, delivery, or contacting us.
From the seller, its owner or representative when creating accounts for its employees or drivers, or submitting documents containing their data.
Automatically from the device, the app and the dashboard during use, through technical, security, analytics and crash logs, location permissions and notifications.
From customers, drivers or delivery providers regarding fulfilment of the order, ratings, complaints and handover.
From payment providers and banks regarding settlement, the success or rejection of a transfer, chargebacks or fraud, without receiving full card data.
From official registries, publicly available sources and the competent authorities, to the extent permitted by law, to verify the establishment, its licences and representation.
Where we collect a person's data from someone else, we take the required notification steps without undue delay and within the statutory period, unless an established exception applies.

Fourth: purposes of processing and their lawful bases

Performance of the agreement or taking steps at request: assessing onboarding, creating the account, verifying permissions, operating the store, receiving orders, managing delivery, communication, collection, settlement, support, chargebacks and ending the relationship.
Legal obligation: verifying licences and identity where the law requires it; invoicing, tax, accounting, anti-fraud and anti-money-laundering; responding to the competent authorities; food safety and recall; keeping records and defending rights.
Legitimate interest: protecting the account, the platform and customers, preventing fraud and misuse, diagnosing faults, measuring service quality, improving features, managing claims and preparing aggregate statistics, after balancing the interest against the data subject's rights and without using this basis for sensitive data.
Consent: direct marketing, optional device permissions, non-essential personalisation or technologies, and any processing that requires consent. Consent can be withdrawn easily, without retroactive effect on lawful prior processing or on another basis.
Protection of health or safety and vital interests in the event of a food risk, a delivery incident or an emergency, to the extent permitted by law.
We may use aggregated or anonymised data for analysis and planning; where a person cannot reasonably be re-identified, it is not personal data.

Fifth: mandatory and optional data

Representative, contact, authorisation, registration, licence, tax, bank account, branch, account, security, order and settlement data is normally required for verification and to provide seller services. Failure to provide it may make activation, settlement or continuation of the service impossible.
Marketing data, a personal photograph, camera or photo permissions, precise location beyond what delivery requires, and additional preferences are optional data unless the screen states a specific and legitimate necessity.
Location, camera and notification permissions can be managed from the device or the app, and refusing a permission only makes the feature that depends on it unavailable.
Where precise location is necessary to carry out a delivery trip, the purpose is shown and collection is limited to the necessary period and scope; accepting marketing does not become a condition of using the service.

Sixth: automated decisions and performance measurement

Systems may use automated indicators to detect fraud, unusual activity, a drop in service quality or delay, which may result in an alert, a review or a temporary restriction to protect the account and the platform.
We do not take a final decision with a legal or material effect on the data subject based solely on automated processing unless that is permitted and they have been informed of the general logic, the effect and the necessary rights. Human review of a suspension or settlement decision may be requested through the partner channel.

Seventh: disclosure of data and recipients

We do not sell or rent personal data. We disclose only the minimum necessary, according to the purpose and the lawful basis, to the following categories:

Customers: store, branch, product and licence data or commercial information that must be displayed, and the first name, means of contact or driver's location may appear to the extent needed to hand over an order managed by the seller.
The seller's employees and authorised users: according to the roles and permissions needed to manage the store, orders and reports.
Payment providers, banks and anti-fraud parties: for collection, transfer, refunds and verifying the transaction.
Delivery providers and drivers: for assignment, arrival, communication and handover data and its proof, without giving them access to orders or settlements beyond what is necessary.
Providers of hosting, databases, technical support, analytics, crash reporting, notifications, communications and verification: as processors and under appropriate instructions and contractual safeguards.
Accountants, auditors, advisers, insurers or parties to a merger, acquisition or restructuring: to the extent necessary and subject to confidentiality and the required legal safeguards.
Governmental, judicial and supervisory bodies and law enforcement: where there is a request, an obligation or a lawful basis.

We limit recipients' permissions to the purpose, and require processors to observe confidentiality, security and instructions and not to use the data independently. If a processor breaches Marah's instructions and determines its own purpose, it may take on that capacity and liability under the law.

Eighth: cookies and app permissions

The website may use cookies, and the app uses identifiers and similar technologies to maintain the session, for security and preferences, and to measure performance, crashes and campaigns.
Technologies necessary to operate and secure the service run on the appropriate basis, while non-essential marketing or personalisation technologies are subject to consent where required.
An optional permission or technology can be disabled, and this does not prevent use of features that do not depend on it.

Ninth: storing data and transferring it outside the Kingdom

Data is stored in Marah's systems or with approved service providers, with access and protection controls appropriate to the nature of the data and the risks.
If operations require personal data to be transferred, or access to it granted, from outside the Kingdom, this only takes place for a permitted purpose, to the minimum necessary, and after applying the Personal Data Protection Law, the regulation on transferring personal data outside the Kingdom, and the appropriate safeguards.
The safeguards may include assessing the level of protection and the risks of the transfer, standard contractual clauses or another lawful means. General information about the categories of recipients, countries or safeguards may be requested, unless the law or the rights of others prevent disclosure of particular details.

Tenth: retention period and destruction

We retain account, authorisation and operational data throughout the life of the seller's account, then for the period needed to close it, settle orders and claims, and meet legal obligations.
We retain contract documents, invoices, orders, payments, settlements, taxes, refunds and complaints in line with the retention periods imposed by financial, tax and commercial laws, or as needed for an existing dispute.
We retain security, sign-in and crash logs for the period needed for protection, investigation and improving the service, then delete them or anonymise them.
We retain trip and proof-of-handover data to the extent and for the period needed to fulfil the order, settle a complaint and meet legal requirements, then destroy or restrict it.
We retain marketing data and consents until consent is withdrawn or the purpose ends, with a limited record to evidence the opt-out and prevent resending.
We destroy an image of an official document or sensitive data as soon as the purpose that permitted its collection has ended, unless the law requires retention, covering the available and backup copies under a secure deletion cycle.
Where there is a dispute, an investigation or a lawful order, data may be restricted rather than destroyed until the reason ends, and during that period it is not used for another incompatible purpose.

Eleventh: data security and breach incidents

We apply appropriate organisational, administrative and technical measures, including permission management, verification, encryption where appropriate, backups, monitoring, updates, management of providers and training of authorised persons.
The seller undertakes to protect the account and devices and to notify us immediately of a lost device, the departure of an authorised user, or suspicion of unauthorised access.
If a breach occurs, we take containment, investigation and documentation steps, notify the competent authority within a period not exceeding seventy-two hours from becoming aware where the statutory notification conditions are met, and notify the data subject without undue delay if the potential harm requires it.
No means guarantees absolute security, but we limit access to those who need it and review the controls and risks periodically.

Twelfth: the data subject's rights and how to exercise them

Under the Personal Data Protection Law, and subject to the statutory exceptions and restrictions, the data subject has the right to:

Be informed of the basis, the purpose, and the methods of collection, processing, storage and destruction, of the parties to whom data is disclosed, of transfers outside the Kingdom, and of the mandatory and optional data.
Access their personal data held by Marah.
Request a readable, clear copy in a commonly used electronic format, where that is legally possible.
Request correction of inaccurate data, completion of incomplete data, or updating of outdated data. We may ask for a necessary supporting document and then destroy it after verification, unless there is a reason to retain it.
Request destruction of the data once the purpose has ended and there is no lawful basis for retention.
Withdraw consent at any time for processing that relies on it, without retroactive effect and without affecting processing based on another basis.
Submit a complaint to Marah, and then to the Saudi Data and Artificial Intelligence Authority in accordance with its procedures if not satisfied with the processing or the outcome.

Rights are exercised through privacy@marahapp.sa or in-app support in the seller app, writing 'Privacy request' and stating the type of request. We may ask for reasonable information to verify identity and protect the account. We respond within a period not exceeding thirty days from completion of the request and verification, extendable by up to a further thirty days in the cases permitted by the regulation, with notice to the data subject of the extension and its reason.

Deleting the account may not result in the immediate destruction of all data where a contract, order, payment, invoice, tax or dispute record must be retained. In that case use is limited to the purpose that justifies retention.

Thirteenth: marketing and notifications

We send offers and marketing campaigns through app notifications, email, text messages or WhatsApp only after obtaining the required, separate and demonstrable consent.
We identify Marah as the sender, provide an easy and free means of unsubscribing, and stop marketing without undue delay when consent is withdrawn.
Cancelling marketing does not affect essential operational messages, such as verification, security, orders, settlements, agreement updates or regulatory requirements.
We do not use sensitive data for marketing purposes, and do not disclose contact data to a partner for it to market independently without the necessary basis and consent.

Fourteenth: data of individuals provided by the seller

If the seller provides the data of an owner, representative, employee, user or driver, it must ensure the data is correct and that providing it is lawful and necessary, and must inform the person of this policy and how to access it.
The seller may not provide the data of a person unconnected with operations, excessive documents, or sensitive data without a need and a basis. The seller's undertaking does not substitute for separate consent where consent is required from the person themselves.
The data subject may contact us directly to exercise their rights, and this does not depend on their continuing to work for the seller.

Fifteenth: amendment of the policy

This policy may be updated when practices, services or laws change. The date of the last update is shown, and we give notice of a material change through the app or an appropriate means before the new processing begins, where the law requires this, and request fresh separate consent if it is necessary.

Sixteenth: contact, complaints and language

For enquiries, complaints or to exercise data rights: privacy@marahapp.sa or in-app support in the seller app. For commercial and operational matters: partners@meatsteak.sa. Unified number: 920018084.
A complaint may be submitted to the Saudi Data and Artificial Intelligence Authority through its official channels in accordance with the applicable procedures and timeframes.
The Arabic version is the approved version. Any translation is for guidance, and the Arabic text prevails in the event of a difference, subject to the applicable legal provisions.

Back to the homepage