Privacy Policy

Your privacy matters to us. Here we explain transparently what data we collect and how we handle it.

Last updated: October 2026

Who We Are

The party responsible for your personal data (the controller) is El Marakby restaurant (المراكبي), located at Jeddah — Tahlia St. at Madinah Rd., Tahlia Walk. For anything about your data: info@elmarakby.com or 0555291131.

This policy explains what data we collect when you use our website or our mobile app — to book a table, order online or subscribe to our newsletter — and when you join the walk-in queue at the restaurant or write to us on WhatsApp; why we collect it, who we share it with, how long we keep it, and your rights over it. We process your data under Saudi Arabia's Personal Data Protection Law and its regulations, on the legal basis given for each purpose below.

Data We Collect

We collect the data you provide yourself. When you book a table: your name, phone number, email (optional), the reservation date and time, party size, and any notes you add. When you place an online order: your name, phone number, email (optional), the items you ordered, the order type — delivery, pickup, or dine-in — your table number for dine-in orders, and any notes. If you choose delivery we also ask for your delivery address and district within Jeddah, so we can price the delivery fee and get your order to you, and you can optionally pin your location for the driver — either from your device's GPS, where your browser asks for location permission only when you tap the locate button, or by pasting a Google Maps link — and attach up to two photos of the building or door. If you pay by bank transfer, we store the receipt image you upload with the order.

When you join the walk-in queue at the restaurant, the host records your name, mobile number, party size and any note; we keep the status of the WhatsApp messages we send you (delivered, read or failed) and any reply you write back, which the host can see. If you write to us on WhatsApp about an order, your message is kept on that order for the restaurant team.

When you subscribe to the newsletter we store only your email address. When you comment on a blog post we store the name you choose, the comment text, and your email if you provide one, along with a hashed fingerprint of your IP address for spam protection — never the address itself.

Your Account (Optional)

You can create an account on the website or in the app — one account for both — to see your past orders, save addresses and favorite dishes, and collect loyalty points. You sign in with your mobile number and a one-time code we send you on WhatsApp — there is no password — and the account is created the first time you enter a correct code. We never store the code itself, only a hashed fingerprint of it that expires within minutes, and the record of the request, with the number that made it, is kept for 24 hours to limit abuse and then deleted. The account holds your mobile number, your name and email if you add them, the addresses you save, your favorites, your loyalty points and the date you last signed in, and the orders you place while signed in are linked to it. An account is never required: online ordering and table booking work as a guest without signing in. On the website we set one strictly necessary cookie to keep you signed in, removed when you sign out. You can delete your account at any time in the app, from your account page on the website, or by contacting us — see Delete your account.

Payments & Card Data

Payment methods depend on the order type: delivery orders are paid in advance — by card or Apple Pay through the Moyasar online payment gateway when it is enabled, or by bank transfer with a photo of the transfer receipt — while pickup and dine-in orders can be paid in cash when you collect, or by card or Apple Pay when enabled. For card payments, your card details are entered on the payment gateway's own page and never pass through our website; we do not store card numbers. What we keep is the payment method, its status, and the gateway's transaction reference. For bank transfers, we keep the receipt image with the order so the restaurant team can check the payment arrived before confirming the order; it may show details such as the bank name and the account holder's name.

Why We Use It, and the Legal Basis

To carry out your booking, order or place in the walk-in queue, contact you to confirm or adjust it, and let you track your order by its reference — to perform what you asked us for.
WhatsApp messages — with the consent you give when you order, or to the host when you join the queue: a "your order is ready" message for pickup orders; the queue confirmation, the "your table is ready" call and a reminder if you are late; and, after a delivery or a visit, one message asking for your review on Google — at most once per number every 30 days, sent to everyone alike whatever their experience. You can stop all our messages at any time by replying STOP (or «إيقاف») to any of them: you get one confirmation, then nothing more from us — except a sign-in code you ask for yourself — until you send START.
Sign-in codes — at your request, each time.
Keeping sales records for accounting and tax — a legal obligation.
Protecting the site and accounts from abuse, and our own cookie-free visit statistics with no personal identifier — our legitimate interest in running a safe service and improving it.
Third-party measurement and advertising tools — only with your consent through the cookie banner, which you can withdraw at any time.
The newsletter — with your consent when you subscribe and confirm it from your inbox; unsubscribe from the link in every email. We send no other marketing.

Analytics & Cookies

We record simple visit statistics on our own servers: the page you visited, the browsing language, the device type, and the site the visit came from — with no cookies and no personal identifier.

We also use third-party measurement and advertising tools; switched on right now: Meta Pixel, TikTok Pixel, and Snap Pixel. They load only if you tap "Accept" on the cookie banner shown on your first visit. They then set their own cookies and send their providers data about your browsing and about the dishes, value and reference of an order — never your name, phone or address — and are governed by their providers' privacy policies. If you decline, the whole site works the same. Your choice is stored in your browser only, and an acceptance covers only the companies the banner named: if we switch on a tool from a new company, we ask you again before it loads.

Who We Share It With

We do not sell or rent your personal data. We share it only with the service providers we need to run the service, each with only what its job requires:

Meta Platforms (WhatsApp Business): your name, mobile number, the text of order, booking and queue messages and sign-in codes, and what you write to us on WhatsApp.
Moyasar, the payment gateway: the order amount and reference, and the card details you enter on its own page.
Bunny CDN (BunnyWay d.o.o.): a content delivery network that serves the site's files and images from servers worldwide; your device's IP address passes through it when pages load.
The hosting provider of the server that runs the site and its database.
Our email provider: to send confirmations and the newsletter.
The measurement and advertising providers (Meta Pixel, TikTok Pixel, and Snap Pixel) — only after your consent.

Internally, access is limited to the restaurant team authorized to manage reservations, orders and the queue, each by their role, and we only disclose your data otherwise when required to do so by law.

Transfers Outside Saudi Arabia

Some of the providers above process data on servers outside Saudi Arabia: Meta (WhatsApp messages), Bunny CDN (the EU and its global network), the measurement and advertising tools (Meta Pixel, TikTok Pixel, and Snap Pixel) after your consent, and the site's own server may itself be outside the Kingdom. We send them only the minimum the specific purpose needs, and rely on each provider's data processing terms, under the regulation on transferring personal data outside the Kingdom.

Data Retention

We keep each kind of data only as long as its purpose needs; a daily automatic job then deletes or anonymizes it:

Walk-in queue (name, number, notes and your replies): 90 days.
A delivery's map pin, building or door photos and directions: 90 days from the order.
What you write to us on WhatsApp about an order: 90 days.
Waiting-list entries for a full booking slot: 90 days after the slot.
Contact details on table bookings (name, number, email, notes): one year from the booking date (365 days).
Sign-in code requests: 24 hours.
Orders: 6 years as accounting and tax records (dishes, amounts, VAT and payment proof), after which your personal details are removed from them.
Your account: until you delete it. The newsletter: until you unsubscribe.
Your request to stop WhatsApp messages: kept while it stands, so we do not message you.

Data Protection

We apply appropriate technical and organizational measures to protect your data from unauthorized access, loss, or misuse, and we restrict access to staff who need it to do their job.

Mobile App

This policy also covers the El Marakby Android app. The app collects the same data as the website and for the same purposes: your name, phone number, email (optional), order items and order type, your delivery address and district when you choose delivery, and your booking details when you reserve a table. All of it is sent to our servers over an encrypted connection (HTTPS). Signing in to the app is optional and works as described under Your Account above. The app asks for location permission only when you tap "Use my current location" on a delivery order, to pin your location on the map for the driver — the same as on the website, and deleted after 90 days; it never follows your location at any other time or in the background. It does not ask for your contacts, camera, or photos. If the app crashes or cannot open the payment page, it sends our server a technical error report (the error message and its technical trace, the order reference when it concerns a payment, the app version and the operating system) so we can fix it — without your name or number. It contains no ads, no advertising trackers, and collects no advertising identifier. Stored locally on your device only: your cart, your chosen language, the name, phone number and address you last entered at checkout (to fill the form in for you next time), the references of your recent orders so you can track them, and, while you are signed in, your session token and mobile number. The session token and number are removed when you sign out, and all of it is erased when you uninstall the app. To delete your account, see Delete your account; to request deletion of other data you have already submitted, email us at the address below.

Your Rights and How to Use Them

You have the right to be informed of how your data is collected and used (this policy); to access it and get a copy in a clear format; to have it corrected or completed; to ask for it to be deleted once it is no longer needed; and to withdraw your consent at any time, without affecting what came before — WhatsApp messages by replying STOP, the measurement tools with the "Change my cookie choice" button above, and the newsletter from its unsubscribe link.

To use any of these rights, email info@elmarakby.com, message us on WhatsApp at 0555291131 from the same number, or call 0555291131. We first check that the request comes from the person the data is about, then answer within 30 days. You can delete your account yourself — see Delete your account. If you believe your data was handled against the law, you can complain to the Saudi Data & AI Authority (SDAIA) through sdaia.gov.sa.

Changes to This Policy

We update this policy whenever what we collect or how we handle it changes, and show the date of the last update at the top of the page. If a change affects a consent you gave, we ask for it again.