Privacy and Personal Data Protection Policy

This policy applies when you browse lahmahcuts.com, create or use an account, place or receive an order, contact support, submit a review, exercise a legal right, or otherwise interact with Lahmah Cuts. The registered operator shown above is the data controller for those activities unless a separate notice says otherwise.

A service provider that processes data only on our documented instructions acts as a processor. A payment provider, bank, social network, or government body may separately act as an independent controller for its own legal purposes and must provide its own notice where required.

We collect only data reasonably needed for the stated purposes. The data depends on how you use the service.

• Identity and account data, such as name, email address, telephone number, user ID, authentication records, preferred language, and account role.
• Order and delivery data, such as items, preparation notes, recipient, address, map pin or coordinates, delivery instructions, order history, and proof of fulfilment.
• Transaction and finance data, such as payment method, payment status, provider references, amounts, receipts, COD collections, refunds, disputes, reconciliation events, and fraud checks. We do not intend to receive or store complete card numbers or card security codes.
• Communications and content, such as support messages, calls or WhatsApp correspondence, complaints, reviews, survey responses, photographs supplied for a claim, and marketing preferences.
• Technical and usage data, such as IP address, device and browser details, timestamps, pages and actions, cookie or similar identifiers, security events, diagnostic logs, and approximate location inferred from an IP address.
• Compliance data, such as consent records, policy versions accepted, requests to exercise rights, identity-verification information where necessary, and legally required audit records.

We obtain data directly from you, from a person ordering for you, automatically from your browser or device, from staff who fulfil or collect an order, and from providers involved in authentication, maps, delivery, communications, hosting, security, analytics, or payments. We may also receive data from banks, payment providers, public authorities, or fraud-prevention sources where lawful and necessary.

If you provide another person’s data, you must have authority to do so and should direct them to this policy. Please do not include unnecessary health, identification, financial, or other sensitive information in free-text notes or support messages.

Depending on the activity, we process data because it is necessary to take steps at your request or perform an order contract; comply with legal, accounting, consumer-protection, food-safety, security, or regulatory duties; pursue a legitimate business interest permitted by law that is not overridden by your rights; protect vital interests; establish or defend legal claims; or because you gave valid consent where consent is required.

• Operate accounts, carts, checkout, order preparation, delivery, receipts, payments, COD collection, refunds, and customer support.
• Verify identity or authority, authenticate users, prevent abuse and fraud, secure systems, maintain audit trails, and investigate incidents or disputes.
• Keep financial and operational records, reconcile payments and collections, enforce agreements, respond to lawful requests, and meet statutory obligations.
• Improve accessibility, reliability, product selection, delivery operations, and customer experience through proportionate analytics and feedback.
• Send service notices and, only with the permission required by law, promotions. You may withdraw marketing consent at any time without affecting an order.

When online payment becomes available, payment details are entered into or transmitted to the selected payment provider. We receive limited transaction information such as status, amount, method category, token, and provider reference. The provider and financial institutions process payment data under their own notices and payment-network requirements.

We may use transaction, device, account, delivery, and order signals to prevent fraud and protect customers. A suspicious transaction may be held for proportionate manual review. We do not make a decision producing legal or similarly significant effects solely by automated means unless allowed by law with required safeguards.

We do not sell personal data. We disclose only what is reasonably necessary to vetted recipients, under appropriate contractual, confidentiality, and security controls where required.

• Technology and operations providers for cloud hosting, database and storage, authentication, email, messaging, maps, delivery, analytics, error monitoring, security, backups, and support. Current infrastructure may include services provided by Supabase and Vercel.
• Payment providers, banks, card or payment networks, and fraud-prevention partners when processing, refunding, investigating, or reconciling a transaction.
• Professional advisers, auditors, insurers, prospective corporate transaction parties, and their advisers under duties of confidentiality and only as necessary.
• Courts, regulators, law enforcement, tax or government bodies where disclosure is required or authorised by law, or necessary to protect rights, safety, and security.
• Another recipient at your direction or with your valid consent.

Some providers may store, access, or support data outside Bahrain. Before a restricted transfer, we assess the destination and recipient and use the approval, adequacy finding, contractual protection, consent, or other lawful transfer mechanism required by Bahrain law. We also limit access, require security, and transfer only the data needed for the service.

Contact us for information about the safeguards relevant to your data, subject to confidentiality and security restrictions.

We keep personal data only as long as reasonably necessary for the stated purpose and applicable legal duties. We consider the contract and complaint period, food-safety traceability, financial and commercial recordkeeping, payment disputes, fraud prevention, security logs, limitation periods, regulatory directions, and the need to establish or defend claims.

Order, receipt, payment, refund, and audit records may be retained for the legally required accounting, commercial, consumer, and dispute period even after account closure. Marketing data is retained until consent is withdrawn or the campaign record is no longer needed. When retention ends, data is securely deleted, anonymised, or isolated from ordinary use until backup rotation completes.

We use proportionate organisational and technical measures designed to protect confidentiality, integrity, availability, and resilience. Measures include role-based access, server-side authorisation, database row-level controls, encryption in transit, protected secrets, audit trails, monitoring, backups, provider due diligence, and staff access limited to business need.

No system is completely secure. If a personal-data incident occurs, we will contain and assess it, preserve evidence, correct weaknesses, and notify the Personal Data Protection Authority and affected people when and within the period required by law. Contact us immediately if you suspect account or data misuse.

We use essential browser storage and similar technology for authentication, security, language choice, cart continuity, load management, and other requested functions. We may use proportionate measurement, performance, and error-monitoring technology to understand reliability and improve the service.

Where Bahrain law requires consent for a non-essential technology, it will remain disabled until valid consent is obtained. You can use browser settings to delete or block storage, but essential features may stop working. Third-party sign-in, maps, payment, or embedded services may set their own technology when you choose to use them.

Order confirmations, receipts, delivery updates, security notices, and responses to requests are service communications and are not marketing. Promotional email, SMS, telephone, or WhatsApp messages are sent only where permitted. You may opt out through the message method or by contacting us. We may retain a minimal suppression record so we honour the choice.

Subject to Bahrain law, applicable conditions, and exemptions, you may ask for information about processing and recipients; access or a copy of your data; correction, updating, blocking, erasure, or cessation of unlawful processing; objection to direct marketing or certain processing; and withdrawal of consent. Withdrawal does not affect processing already lawfully completed.

Send a request using the contact details below. State the right you wish to exercise and enough information to locate the relevant account or order. We may verify identity and authority proportionately before disclosing or changing data. We will respond within the legally required period and explain any lawful refusal, restriction, extension, or fee. You may complain to Bahrain’s Personal Data Protection Authority and may have a right to seek a judicial remedy.

The service and purchasing functions are not directed to children under 18. A parent or legal guardian should contact us if a child submitted personal data without proper authority. We will investigate and delete or restrict it where required, while preserving records that must lawfully be retained.

A product or site review you choose to publish may be visible to the public together with the displayed name or profile information shown at submission. Do not include an address, telephone number, health information, payment information, or another person’s data. We may moderate content for safety, privacy, authenticity, and legal compliance without changing the substance of a genuine review.

Interactions on a third-party social platform are also governed by that platform’s privacy terms. Public posts can be copied or indexed outside our control.

We may update this policy when processing, providers, law, or security practices change. We will update the effective date and provide prominent or direct notice where a change is material or renewed consent is required. Earlier versions may be retained for accountability and to identify the notice that applied to a transaction.

Contact the controller using the details below and write “Privacy request” in the subject where possible. If you are dissatisfied, you may complain to the Bahrain Personal Data Protection Authority using the official channels published at pdpa.gov.bh. You may also contact another competent authority where the matter concerns consumer protection, payments, or food safety.