Privacy Policy

1. Who we are (data controller)

For the purposes of the Saudi Personal Data Protection Law (PDPL), the data controller responsible for your personal data is Royal Botanica, in the Kingdom of Saudi Arabia. Our contact details are in section 14.

2. Data we collect

This website is a brand showcase and does not sell products or process payments, so we collect only limited personal data. Depending on how you use the Site, this may include:

• Information you give us — for example, your name and email address if you contact us or subscribe to updates, and the content of your message.
• Information collected automatically — such as your device type, browser, approximate location, pages viewed, and similar usage data, collected through cookies and analytics tools (see section 5).

Where a field is optional, we will tell you; if certain information is required (for example, an email address to reply to an enquiry), not providing it may mean we cannot respond. We do not intentionally collect sensitive personal data through this Site.

3. How we use your data

We use personal data only for clear, limited purposes, including to:

• respond to your enquiries and provide information you request;
• send you updates or marketing communications where you have asked us to;
• understand how the Site is used so we can improve it;
• maintain the security of the Site; and
• comply with our legal and regulatory obligations.

4. Our lawful basis

We process your personal data on a lawful basis under the PDPL. Depending on the purpose, this will be your consent (for example, for marketing emails or non-essential cookies), our legitimate interests (for example, to keep the Site secure and improve it), or to comply with a legal obligation. Where we rely on consent, you may withdraw it at any time.

5. Cookies & analytics

Cookies are small files stored on your device. We use essential cookies needed for the Site to function, and we may use analytics cookies (for example, to measure how the Site is used) only where you consent. You can control or delete cookies through your browser settings; blocking some cookies may affect how the Site works.

6. Marketing

We will only send you marketing communications where you have given us your explicit consent. You can opt out at any time — for example, by using the unsubscribe link in any email or by contacting us. Withdrawing consent does not affect any processing carried out before withdrawal.

7. Sharing your data

We do not sell your personal data. We may share it only with:

• Service providers who act on our behalf — such as website hosting, email, and analytics providers — under appropriate confidentiality and data-protection obligations;
• Our distribution partners, GSS and Al Mujtama Pharmacy, where necessary and only with your knowledge; and
• Competent authorities where required by the laws of the Kingdom of Saudi Arabia.

Please note that purchases made through third-party platforms such as Trendyol Saudi Arabia, or in pharmacy, are handled by those parties under their own privacy policies, which we do not control.

8. Cross-border transfers

Some of the service providers we use (for example, hosting or analytics) may store or process data outside the Kingdom of Saudi Arabia. Where personal data is transferred outside the Kingdom, we will do so only in accordance with the PDPL and its rules on cross-border transfers, and take steps to ensure your data remains protected to an appropriate standard.

9. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable law. When data is no longer needed, we securely delete or anonymise it.

10. Security & breaches

We apply appropriate organisational and technical measures to protect personal data against loss, misuse, and unauthorised access, disclosure, or alteration. In the event of a personal data breach, we will notify SDAIA and, where required, affected individuals in line with the timeframes and conditions set out in the PDPL and its Implementing Regulations.

11. Your rights

Under the PDPL, and subject to its conditions, you have the right to:

• Be informed about how and why your personal data is processed;
• Access your personal data held by us;
• Obtain a copy of your personal data in a readable format;
• Request correction of data that is inaccurate or incomplete;
• Request deletion of your personal data where it is no longer required; and
• Withdraw your consent to processing at any time.

To exercise any of these rights, contact us using the details below. We will respond within the period required by the PDPL (generally within 30 days). You also have the right to lodge a complaint with SDAIA.

12. Children's privacy

This Site is not directed at children, and we do not knowingly collect personal data from children without the consent of a parent or guardian. While some Royal Botanica products are intended for the care of babies and children, those products are purchased and used by adults. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. The current version will always be posted on this page with its "Last updated" date. We encourage you to review it periodically.