Privacy Policy

1. Who we are

Forno Mood Restaurant — Commercial Registration No. 7051882061, E-Commerce Authentication No. 0000317261.

A bakery and restaurant serving freshly made manakeesh and sandwiches, prepared in front of the customer, in Al-Nazlah Al-Yamaniyah, Jeddah. We primarily serve university and school students and people working nearby.

We are the Data Controller responsible for personal data collected through our app and website, under the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

2. Contact details

Registered address: Building 7257, Taha Hussain Street, Mishrifah District, Jeddah 23341, Kingdom of Saudi Arabia

Phone: +966 50 950 0106

Email: admin@fornomood.com

For any question about your privacy, or to exercise your rights, contact us through any of the above.

3. What personal data we collect

Account data (required to create an account): first and last name, mobile number, gender.

Optional data: email address.

Order data: the items you ordered, amounts, times, and any notes you added.

Loyalty data: your stamp count and earned free items.

Website contact form: your name, phone, email and message.

Payment data: handled by our payment provider Geidea. We never store card numbers on our systems.

We use no tracking cookies, no analytics, and we do not collect location data.

4. How we collect it, and why

We collect data directly from you only: when you create an account in the app, complete the website contact form, or place an order.

Purposes: fulfilling pickup orders and communicating about them; verifying your identity at sign-in via a code sent to your phone; running the loyalty card; sending personalised offers by SMS if you have been away a while; answering your enquiries.

Gender is used to tailor offers and communications.

We limit collection to the minimum necessary and directly related to these purposes.

5. Legal basis for processing

Performance of a contract: processing your order, taking payment, and managing your account and loyalty card — we cannot provide the service without this data.

Your explicit consent: sending marketing offers by SMS. You may withdraw consent at any time by contacting us, without affecting your ability to order.

Legal obligation: retaining invoice and transaction records as required by Saudi tax regulations.

Legitimate interests: improving our service and preventing fraud, where this does not override your rights.

6. Sharing your data

We do not sell your personal data, and we do not disclose it to third parties for their own direct marketing.

We share the minimum necessary with: Geidea for payment processing; our SMS provider for verification codes and offers; and our cloud hosting provider (Alibaba Cloud).

Each processes data on our behalf and only for that specific purpose.

We may disclose data where legally required by a competent authority.

7. Storage, retention and destruction

Your data is stored on servers within the Kingdom of Saudi Arabia (Riyadh region) with our cloud hosting provider.

Account data: kept while your account exists. Destroyed immediately when you delete your account.

Order and invoice records: retained for the period Saudi tax rules require, but once your account is deleted they are held in anonymised form with no personal data attached.

Loyalty data: destroyed immediately when your account is deleted.

Verification codes: destroyed within minutes of being issued.

Method of destruction: records are permanently removed from the database, and identifying fields are overwritten with values that cannot be traced back to you.

We apply technical and organisational safeguards including encrypted connections, one-way hashing of passwords and verification codes, and role-based access restrictions.

8. Your rights

Right to be informed: to know how and why your data is collected and who it is shared with — which this policy sets out.

Right of access: to see the personal data we hold about you.

Right to obtain a copy: to receive your data in a readable, clear format.

Right to correction: edit your details directly in the app (Account → My details), or by contacting us.

Right to destruction: delete your account and personal data directly in the app (Account → Delete my account), or by contacting us. Order records are retained anonymously to meet tax obligations.

Right to withdraw consent: stop marketing messages at any time.

Right to complain to the competent authority (the Saudi Data and Artificial Intelligence Authority).

Right to compensation for material or moral damage resulting from a breach of the PDPL.

We respond to requests within 30 days of receiving a complete request, free of charge.

9. Complaints

If you have a concern or complaint about how we handle your data, contact us first at admin@fornomood.com or +966 50 950 0106. We will investigate and respond within 30 days.

If you are not satisfied with our response, or we do not respond within 30 days, you may escalate your complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA), Riyadh, Kingdom of Saudi Arabia.

Website: sdaia.gov.sa — National Data Governance Platform: dgp.sdaia.gov.sa

10. Update log

August 2026 — Restructured to follow SDAIA's official privacy policy guideline; added legal bases, retention periods and the complaints mechanism.

July 2026 — First version.

We review this policy periodically and will publish any material change here with its date.