Panda Retail Company
Privacy Policy

Panda Retail Company (hereinafter referred to as "Panda", "we", "us", or "our"), is committed to protecting the personal data and privacy of users (hereinafter referred to as "you" or "your") of this mobile device application (the "Panda App" and the website. Please read this Privacy Policy carefully to understand how we collect, use and protect your personal data when you use our services via our products (including our website, App).

By using our App/website, you agree that we may collect, use, store, transfer and process your personal data in accordance with this Privacy Policy.

Who we are and what we do?

Panda is one of the main retail chain businesses in the Middle East and one of the biggest grocery retailer in the Kingdom. This Privacy Policy https://panda.com.sa/privacy-policy, is intended for Panda's customers and other persons that access Panda's services through either online or offline channels. For the purposes of applicable data protection laws and regulations, Panda head office and its branches in the Kingdom are controllers of your Personal Data.

Panda along with its subsidiaries, affiliates and related entities are committed to providing the highest level of protection to your Personal Data in accordance with applicable data protection laws and regulations.

What is Personal Data and what Personal Data do we collect?

As per the applicable data protection laws in the Kingdom "personal data" refers to "Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature".

The Personal Data we collect will vary based on the purpose it is used for. However, below are examples of Personal Data we collect:

• Identity Data: your title, full name, gender, nationality, example of signature, National ID/ Iqama number, passport details, and related documentation, and the date and place of birth.
• Contact Data: your email address (work and private), national address or business address, job title, contact telephone numbers and preferences regarding marketing communications.
• Transaction Data: data about your transactions and our products that you use, including account activity and product use and any details pertaining to payments to and from your accounts, transaction information, including the in-store and online purchases you earn points for and how you use your points, coupons, and vouchers when you use our loyalty program.
• Payment Data: this includes data collected for payment purposes, such as bank card number, payment amounts, etc.
• Third Party Data: this includes data obtained from other parties.
• Cookies Data: this includes data we collected by website logs, cookies or similar technologies including (but not limited to) your account login details, such as your username and the password that you have chosen.
• Account Data: collected from your use of our services, websites, or mobile apps (such as cookies). This may include:
  • Login information
  • IP Address
  • Mobile Number
• Usage Data: Collected during your website visits. This includes information about how you use our website, application, platforms, through and from our site (including date and time) etc.
• Interaction Data: This includes, records of phone calls between you and us and customer support requests and feedback that we receive from you either through our websites, mobile apps, and social media accounts, or any channels we use to communicate with our customers.

How we collect your Personal Data?

We will collect Personal Data directly from you. We also collect personal information about you from other sources where lawful and reasonable. The ways in which we will collect your Personal Data are set out in further detail below:

• During on boarding and service or product use. When you become a customer and use our products and services.
• Directly from you. This is Personal Data you provide to us when you use our online services, visit our physical stores, or interact with us through various channels.
• Communication exchanges. When you complete a form and upload it on our website or mobile apps, email, social media post, via calling our call centre, or through participation in promotional campaigns.
• Interactions (Social Media). Any posts and interactions you have directly with us on social media channels.
• Browsing pattern. Data about how you are exploring our website, the timings of your visit, Internet Browser types, and how you were referred to our website. Please see section on "Use of Cookies"
• Surveys. Online web surveys that enable us to gather feedback regarding issues. Such as your likes and dislikes about the look and feel of our website and mobile apps. Your valuable feedback enables us to enhance the quality of experience we provide to you as an organization.
• Third parties and public sources. This includes legal representatives and employees of companies with which we are in business, regulatory or a customer relationship or in the process of establishing such a relationship; businesses and other organizations; our corporate and business customers; cookies; part of business relationships with our service providers (data of representatives of service providers); and information legitimately acquired from publicly available sources and combined information from external sources.

What is the purpose and scope of this Privacy Notice?

The purpose of this statement is to inform you about how we collect, use, store, make available, disclose, update, safeguard, destroy or otherwise deal with (process) your Personal Data and also to explain your rights relating to the privacy of your Personal Data and how the law protects you:

• Deliver our products and services, or process your transactions;
• Assessing and providing products and services to our customers;
• Operating our business;
• Improving our products and services to our customers.

Why do we process your personal information?

In order for us to provide you with our products and services we need to process your Personal Data and also for the reasons set out below. Any Personal Data received by us will be used for the purposes indicated in this Privacy Notice or in a separate notice provided to you. Except for where permitted by law, we will not process your Personal Data in a manner that is inconsistent with the defined purpose for which it was collected.

What are the legal basis and purposes for collection and the use of your Personal Data?

We only collect and use Personal Data as required by our businesses to provide you with products and services. In most cases, our legal basis and purposes include, but are not limited to:

• Performance of a contract. It may be necessary to process your Personal Data in order to perform a contract with you relating to the following purposes:
  • to create your Panda account;
  • to allow us to provide you with our products or services;
  • enhance our products, services, and your experience across our channels and to inform you about key updates and changes to our channels including Privacy Notice and other terms and policies;
  • for the purposes of identity management and when you sign-in to your Panda account.
• Compliance with a legal obligation. As a regulated entity we are subject to a number of statutory and regulatory obligations that may require us to process your Personal Data (e.g., AML/KYC purposes). We also need to process your Personal Data to comply with any obligations and requirements issued by governmental, legal and regulatory authorities within the Kingdom.
• Legitimate Interests. Where necessary we process your Personal Data in the regular management of our business and to protect Panda interests, the interests of our customers, shareholders, employees and other third parties, including our business partners and members of the general public. Examples of where we rely on legitimate interests includes:
  • to understand your needs as a customer and your eligibility for products and services and to understand how you use and interact with our products and services and the people or things you are connected to and interested in.
  • to contact you for your opinions about our products and services, including through surveys and other market research.
  • to respond to enquiries and communications and to record these interactions for the purpose of analysis and improvement;
  • to design, develop and test products, services and solutions for customers, which may include combining sources and types of your Personal Data across multiple legal entities and countries, subject to compliance with applicable laws;
  • to deliver and improve our products and services, or process your transactions;
  • to operate our business;
  • to keep you and our staff safe;
  • to detect, investigate and prevent financial crimes;
  • to conduct risk management;
  • to ensure security and business continuity;
  • to conduct data analytics for customers targeting;
  • to protect our legal rights.
• Consent. In addition to the reasons above, we may process your Personal Data if we have specific consent for a defined purpose. We will also obtain your consent where we are required to do so under applicable laws. We will rely on your consent for the following purposes which may include:
  • to send you marketing and advertising communications via telephone, SMS, Email, WhatsApp, In-App notification, Pop-up Messages, (please note that you can opt-out of receiving such communications at anytime by contacting us at the details provided below);
  • to promote new products or services that may be of interest to you.

If we rely on consent to process your Personal Data, you may at any time withdraw such consent. However, this will not affect the lawfulness of the processing, based on your consent, conducted prior to such withdrawal, or where we have other legitimate reasons for processing your Personal Data.

How and why do we retain your Personal Data?

We will retain your Personal Data in an identifiable form only for the period necessary to fulfil (i) the purposes outlined in this Privacy Notice, (ii) our business and operational purposes and in line with our legal and regulatory obligations.

We will only retain your Personal Data after the purposes for why we collected it no longer exists, in the following cases:

• if there is a legal or regulatory requirement for retaining your Personal Data for a specific period, in which case the Personal Data shall be destroyed upon the lapse of that period or when the purpose of the collection is satisfied, whichever longer.
• if your Personal Data is closely related to a case under consideration before a judicial authority and the retention of the data is required for that purpose, in which case the Personal Data shall be destroyed once the judicial procedures are concluded.

Upon your request, we will delete your account, personal data include name, email, and phone numbers. However, the unique customer ID that was created randomly with no personal identification information of the customer will be retained as per our general T&Cs.

What are your rights to your Personal Data?

It is important to us that you understand your rights under the law and how you can exercise them. You have the following rights:

• right to be informed about the legal basis and the purpose of the collection of your Personal Data.
• right to request access to your Personal Data that we hold about you.
• right to request your Personal Data from us in a readable and clear format.
• right to request corrections to your Personal Data if incorrect, and/or modifications to your Personal Data if incomplete or updates where your Personal Data held by us is out of date. In this instance you may request us to restrict processing of your Personal Data that is incorrect.
• right to request destruction of your Personal Data.
• right to withdraw your consent you previously gave us to the extent any of your Personal Data is collected based on consent. You can exercise your right to withdraw consent as set out below.
• Right to lodge a complaint with the data protection authority in respect of our processing activities regarding your Personal Data.
• Right to claim compensation for material or moral damage if you are harmed as a result of any violation stipulated under the applicable laws.

Direct marketing

We will not send you any communications for the purpose of direct marketing without obtaining your prior explicit consent. If you consent to receive such direct marketing communications, you have at any time a right to opt out by contacting us via the email dataprotection@panda.com.sa or follow the instructions provided in the direct marketing communication.

Transfer of your Personal Data cross border:

We may share your Personal Data with our affiliates or subcontract the processing of your data to, or otherwise share your data with service providers located inside or outside the Kingdom. Such third parties may be engaged in, among other things, the provision of services to you, the processing of transactions, payments and/or the provision of support services. We will fulfil any requirements in relation to the international transfers of Personal Data under applicable laws.

Where we store your personal data?

We will store your Personal Data at both inside and outside the Kingdom of Saudi Arabia and by way of cloud storage, whether such Personal Data are stored on our headquarters servers or on servers of an external entity, such as cloud computing service providers (whether inside or outside the Kingdom). We will store your Personal Data for a period of up to three years or to the extent permitted as per applicable law in accordance with regulatory requirements. In destroying your Personal Data, after its intended purpose is fulfilled, we will use appropriate technical measures when destroying Personal Data and we will ensure that such data cannot be viewed or recovered. Depending on the type of your Personal Data, we will use appropriate administrative, technical, and organizational means and measures to protect Personal Data from incidents of leakage, damage, or illegal access

How do we protect your Personal Data?

We ensure your Personal Data is appropriately protected by utilizing the necessary physical, technical, administrative, and procedural security measures to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal. We safeguard and protect your data in a manner that complies with the applicable data protection regulation of the Kingdom.

In order to protect your Personal Data, Panda has put in place a number of technical and organizational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data, or unauthorized access, such measures include protecting your information from unauthorized access, alteration, disclosure, or destruction taking into consideration the risk presented by the processing and the nature of the Personal Data being processed. Organizational measures include restricting access to personal data solely to authorized persons with a legitimate need to know for the purposes of the processing operations.

When, how and with whom will we share your Personal Data?

We may share your Personal Data with third parties under the following circumstances:

• Service Providers: We engage trusted third-party service providers to assist in delivering our services and running our business operations. This includes entities that provide order delivery, marketing, personalization, and customer engagement services. For example:
  • Service providers facilitating delivery logistics.
  • Technology providers offering analytics, app functionality, and marketing solutions.
  • IT Solution providers for the purpose of Web hosting, data storage and infrastructure and security.
• Legal and Regulatory Requirements: We may disclose your Personal Data to governmental or legal authorities if required by law or in response to valid legal processes.
• Payment Processing: Your credit/debit card details and other payment-related information will only be shared with authorized payment processors to facilitate transactions. We do not store, sell, share, rent, or lease your payment information with other entities.
• Business Transfers: In the event of a business restructuring, sale, merger, or transfer of assets, your Personal Data may be transferred to the involved parties as part of the transaction.
• Employees: We share your Personal Data with our employees on a need-to-know basis for the performance of their duties in providing you with our services.
• Other Third Parties: In limited circumstances, we may share your Personal Data with third-party entities to fulfill contractual obligations or provide you with requested information or services. Such disclosures are strictly for lawful purposes and aligned with the scope of our relationship.

How to withdraw your consent?

When we rely on your consent (and no other alternate legal bases) you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you wish to withdraw your consent, you can do so by contacting our Data Protection Officer (DPO). Please note that even after you withdraw your consent, we may be obliged to keep your Personal Data due to legal requirements.

Panda's DPO can be reached at customercare@panda.com.sa. Please feel free to reach out if you have any questions or concerns about how we handle your data.

What happens if you do not provide us with your Personal Data?

The Personal Data requested by the Panda is necessary to provide you with our products and services. If it is not provided, we may be unable to comply with our legal or regulatory obligations or provide you with our products and services.

Changes to our Privacy Notice

We reserve the right to amend this Privacy Notice at any time. The Effective date of the Privacy Notice, as stated above, indicates the latest date the Privacy Notice was revised or changed. Checking the Effective date below allows you to determine whether there have been changes since the last time you reviewed the Privacy Notice. Therefore, we recommend you check the Privacy Notice periodically to be aware of the most updated version of this Notice.

Use of Social Plugins

The app uses social plugins ("plugins") provided by third parties including Facebook, and Google for secondary option for authentication. When you login we establish a direct connection to the servers of the relevant PI Provider (which may be located overseas) and your plugin content is transferred to your browser. The relevant personal information provider is then able to receive information about your having accessed that page of the app. This occurs even if you do not have an account with the PI Provider or are not logged into it at the time. If you are logged into the app of a PI Provider, and you interact with the relevant plugins on our site (for example by clicking "Like" or entering a comment) the corresponding information is transmitted from your browser directly to the PI Provider server and stored by it. The information may also be published on your PI Provider account page and visible to those whom you have given access as "friends" or otherwise. You can block plugins by using add-ons for your browser, like the "Facebook Blocker". For information on the purpose and scope of data collection by Facebook, Pinterest and Instagram and how it is processed and used, as well as your rights in this respect and settings options for protecting your privacy please read the privacy policy of the relevant PI Provider: Facebook, Instagram, Pinterest.

Use of Cookies

In order to improve our customers' experience, our websites and apps use a standard technology called "cookies" to collect information about how our websites are used, which may include your data. The use of cookies is essential to the operation of our websites. The use of cookies is essential to the operation of our websites [please add your website/cookies page].

Cookies help to make a website or app function better and make it easier for us to give you a better user experience on our online channels. To use or store cookie types that are not required for the functioning of the website or app and are optional, we will obtain your consent first.

For this reason, we limit our use of cookies to:

• providing products and services that you request;
• delivering advertising through marketing communications;
• providing you with a better online experience and tracking website performance; and
• helping us make our website more relevant to you.

Limited employee access to personal information

Panda App limits its access to your personal information to only those employees who hold a business reason for having access to such information. Panda App also educates all their employees about the importance of confidentiality and customer privacy. In addition, individual usernames and passwords are used by approved Panda App personnel to access your personal information online, providing audit trails to further safeguard the privacy of your personal information.

Location Services

Our Mobile Apps will be using your device location services in order to display the nearest available branch eligible for delivery, promotion & campaigns assigned to that store will be listed accordingly.

Apple Pay

Panda App uses Apple Pay as a payment method to provide a secure and convenient checkout experience. Please note that we do not store or process any of your payment information directly. All payment-related data is managed by Apple Pay, which ensures secure transactions through its own privacy and security policies. For more information on how Apple handles your data, please review Apple's Privacy Policy.

Communicating with us

In case of any questions, you can contact us via the email dataprotection@panda.com.sa, and social media or through our website and mobile app.

Alternatively, you can reach us at customercare@panda.com.sa or call us on our helpline 9200-27707.

If you are unhappy with how we've handled your Personal Data or have further questions on the processing of your Personal Data, our Privacy Notice, and privacy practices, please contact us at dataprotection@panda.com.sa.

For further details regarding the processing of your Personal Data and how to exercise your rights, you can contact the DPO at Panda using the below mentioned contact details:

Complaint or Objection Filing Method

If you have any concerns, or wish to exercise any of your rights, you can contact us at "Customer Engagement" within Panda using one of the following channels:

• Contact Center 9200-27707
• WhatsApp 9200-27707
• Email customercare@panda.com.sa
• Social Media Channels (Facebook, Instagram, X, TikTok, Google Reviews)
• App Stores (IoS & Android)