Privacy policy
We collect what we need to send you clothes and answer you, and nothing else. This page says exactly what that is, why we are allowed to hold it, how long we keep it, and how to make us delete it.
Version 1.0 · last updated 20 August 2026 · contact
Draft for legal review. Prepared against the Saudi Personal Data Protection Law (Royal Decree M/19, as amended), its Implementing Regulation, and SDAIA's Privacy Policy Guideline (v1, August 2024), and to be reviewed by Saudi counsel before the store takes payment. An Arabic version is required and is being prepared.
Who we are
ORSA is an independent clothing label based in Riyadh, Kingdom of Saudi Arabia, operating orsaclothing.com. For everything in this policy we are the data controller — we decide what is collected and why.
Privacy contact: privacy@orsaclothing.com. Everything else: hello@orsaclothing.com.
Our commercial registration number and registered address will be published here before the store takes payment.
The short version
- We collect your name, contact details, delivery address and what you ordered. That is the bulk of it.
- We never see your card number. Payment is handled by a licensed Saudi payment provider; we are told only whether it succeeded.
- We do not sell your data, rent it, or share it with advertisers.
- Marketing only if you asked for it, and one click to stop.
- You can ask to see, correct, export or delete your data, and we must answer within 30 days.
What we collect
| When | What | Required? |
|---|---|---|
| You join the list | Email; name and phone if you give them | Email only |
| You place an order or pre-order | Name, phone, email, delivery address (city, district, street), the pieces and sizes ordered, your order note, preferred payment method | All except the note |
| You pay | Confirmation of success or failure, the last four digits and card type, the payment reference. Not the full card number, and never the CVV | Required to sell to you |
| You write to us | Whatever you send, plus your contact details and our reply | Your choice |
| You return something | The reason, the pickup address, and the refund reference | Reason optional |
| You browse the site | Page views, device type, approximate country, referring site — aggregated, without cross-site tracking | Automatic |
We collect the minimum needed for each purpose, as the Implementing Regulation requires. We do not collect sensitive personal data — no health, biometric, genetic, religious or ethnic data — and we ask you not to send any in a message.
Why, and on what basis
Saudi law requires us to name a lawful basis for every purpose, so here they are individually:
| Purpose | Basis |
|---|---|
| Take your order, make it, deliver it, handle returns and refunds | Necessary to perform our contract with you |
| Tell you where your order is | Necessary to perform our contract with you |
| Answer your questions and handle complaints | Necessary to perform our contract, or your consent where there is no order |
| Issue invoices and keep tax and accounting records | Compliance with a legal obligation (VAT and commercial-records rules) |
| Detect and prevent fraud, and keep the site secure | Our legitimate interest in protecting the business and our customers |
| Send you drop and restock news | Your consent — never bundled with a purchase, always withdrawable |
| Understand how the site is used, in aggregate | Our legitimate interest in a working shop |
Where we rely on your consent, giving it is genuinely optional: we will never make marketing consent a condition of buying anything, and refusing costs you nothing. Withdrawing consent is as easy as giving it — one link in any message, or an email to us — and it takes effect without delay.
How long we keep it
| Data | Kept for | Why that long |
|---|---|---|
| Invoices, orders and accounting records | 6 years from the end of the tax period | The minimum retention period set by the VAT rules |
| Delivery address and order contact details | 24 months after the order, then reduced to the invoice record | Returns, warranty questions and repeat orders |
| Mailing-list subscription | Until you unsubscribe, then 30 days to action it | Consent-based; no reason to keep it after |
| Enquiries and complaints | 24 months | Context if you come back to us about the same thing |
| Site analytics | 14 months, aggregated | Year-on-year comparison, nothing longer |
When a period ends we delete or irreversibly anonymise the data. Tax records are the one thing we cannot delete on request — the law requires us to keep them.
Who else sees it
Only the people and services needed to do the things above. Each is bound by a written agreement requiring them to protect your data, use it only on our instructions, and tell us immediately if anything goes wrong.
- Our delivery partner — your name, phone and address. Nothing about payment.
- Our payment provider — a licensed Saudi gateway, which handles the card details we never see.
- Tabby or Tamara, if you choose to pay in instalments — they become a separate controller of the data you give them, under their own privacy policies.
- Our website host and form provider — which store form submissions on our behalf.
- Our email and messaging providers — to send order updates and, if you asked for it, drop news.
- Professional advisers and the authorities — where the law requires it.
We do not sell or rent your personal data. We do not share it with advertisers or data brokers. We do not build profiles of you across other websites.
Data outside the Kingdom
Some of the services above are operated outside Saudi Arabia — our website host and email provider in particular. This means some personal data is processed abroad, and Saudi law requires us to tell you so plainly.
When that happens we ensure the transfer meets the conditions of Article 29 of the PDPL and the Regulation on Personal Data Transfer: the transfer does not prejudice national security or the Kingdom's vital interests, it is limited to the minimum data needed, we assess the risk before relying on safeguards, and the recipient is contractually bound to a standard of protection no lower than the Kingdom's.
Our tax and invoice records are kept accessible from inside the Kingdom, as the VAT rules require.
Marketing
We send drop and restock news only to people who asked for it. Every message carries a one-click unsubscribe, and we act on it immediately. We will not pass your details to anyone else to market to you.
If you have bought from us and later unsubscribe, we still send the transactional messages you need — order confirmation, dispatch, delivery, refunds. Those are part of the sale, not marketing, and you cannot opt out of them while an order is live.
Cookies and your bag
There is no cookie-specific law in Saudi Arabia; cookies matter here only where they involve personal data, and ours largely do not.
- Your bag lives in your own browser (local storage), not on our servers. Clearing your browser data empties it.
- A session marker so the intro animation does not replay all day.
- Privacy-respecting analytics — page views and device type in aggregate, with no cross-site tracking and no advertising identifiers.
We do not run advertising cookies or third-party trackers on this site. If that ever changes we will ask for your consent first and update this page before doing it.
Your rights
Under the PDPL you have the right to:
- Be informed of the legal basis and purpose for collecting your data — that is what this page is for.
- Access the personal data we hold about you.
- Obtain a copy of it in a readable, clear format.
- Correct, complete or update anything inaccurate or out of date.
- Request destruction of data we no longer need for the purpose we collected it for.
- Withdraw consent at any time, where consent is the basis.
- Complain to us and, if unsatisfied, to the supervisory authority.
Write to privacy@orsaclothing.com. We will answer within 30 days. If a request is genuinely complex we may extend that once by up to 30 further days, and we will tell you before the first 30 days are up and explain why. Exercising any of these rights is free.
We may ask you to confirm your identity first — normally by replying from the email address on the order — so that we do not hand your data to somebody else.
How we protect it
- The whole site is served over encrypted connections (HTTPS).
- Card details never touch our systems.
- Access to order data is limited to the people who need it, with individual accounts and multi-factor authentication.
- We keep a written record of our processing activities, as the Implementing Regulation requires.
- We collect the minimum, and delete on the schedule above.
If something goes wrong
If personal data is lost, leaked or accessed without authorisation, we will notify SDAIA within 72 hours of becoming aware of it where the law requires, and we will tell affected customers without undue delay where the breach could harm you or your rights. We will say what happened, what data was involved, what we have done, and what you should do.
Children
ORSA sells adult clothing and the site is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.
Changes to this policy
When we change this policy we update the version and date at the top and keep a record of what changed. If a change materially affects how we use your data we will tell you directly — by email if you are on our list or have ordered — rather than relying on you to notice.
| Version | Date | Change |
|---|---|---|
| 1.0 | 20 August 2026 | First published version. |
Contact us and complaints
Privacy questions, requests and complaints: privacy@orsaclothing.com.
ORSA · Riyadh, Kingdom of Saudi Arabia · Sunday to Thursday, 10:00–19:00 AST.
We acknowledge privacy complaints within one working day and aim to resolve them within 30 days. If you are not satisfied with our answer, you may complain to the Saudi Data & AI Authority (SDAIA), the competent authority for personal data in the Kingdom, at sdaia.gov.sa. You may go to SDAIA whether or not you have come to us first.