Privacy Policy – Platio

Last updated: September 17, 2026

This Privacy Policy explains how Nibraz Ventures Company, a company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 7052848285 ("Platio", "we", "us", "our"), collects, uses, discloses, and protects personal data when you use the Platio mobile application, website at platiokitchen.com, or related services (the "Platform").

This Policy is issued in accordance with the Kingdom of Saudi Arabia's Personal Data Protection Law, issued under Royal Decree No. M/19 (as amended by Royal Decree No. M/148), its Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom issued by the Saudi Data and Artificial Intelligence Authority ("SDAIA") (together, the "PDPL").

By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where our processing relies on your consent, we will obtain that consent separately and explicitly at the relevant point in the Platform (for example, at registration or before enabling location or marketing permissions), in accordance with the PDPL.

If you do not agree with this Policy, please do not use the Platform.

1. Who We Are (Data Controller)

Where required under the PDPL's registration criteria (for example, if we process sensitive personal data at scale, conduct cross-border transfers, or otherwise meet SDAIA's registration thresholds), we will register as a controller on SDAIA's National Data Governance Platform.

2. Personal Data We Collect

2.1 Identity and Contact Data

Full name, mobile number, email address, date of birth (for age verification), and profile photo (if you choose to upload one).

2.2 Delivery and Location Data

Office/workplace delivery address, building or floor details, and, where you enable location permissions, precise or approximate device location used to confirm coverage and support accurate delivery.

2.3 Order and Subscription Data

Plan selected, meal choices, dietary or allergen preferences you provide, order history, skip/pause activity, and delivery feedback or complaints.

2.4 Payment Data

Transaction amount, payment status, and a masked/tokenized reference to your payment method. We do not collect or store your full card number, CVV, or banking credentials — these are collected and processed directly by our SAMA-regulated payment service provider(s).

2.5 Corporate Account Data

Where you submit a "For Companies" enquiry, we collect the company name, your name, work email, phone number, employee headcount range, and office location.

2.6 Device and Technical Data

Device type, operating system and version, app version, IP address, general (city-level) location derived from IP, and diagnostic/crash logs.

2.7 Usage Data

In-app activity such as pages/screens viewed, features used, and interaction with notifications, collected to operate and improve the Platform.

2.8 Communications

Records of your correspondence with our customer support team, including WhatsApp, email, or in-app chat.

2.9 Data We Do Not Intentionally Collect

We do not knowingly collect data revealing health conditions, religious beliefs, or other special-category data. Dietary/allergen preferences you voluntarily provide are collected solely to help you select appropriate meals and are treated with the heightened protection described in Section 4.

3. How We Collect Personal Data

We collect personal data: (a) directly from you when you register, place an order, submit the Companies enquiry form, or contact support; (b) automatically through your use of the app and website (cookies and similar technologies, see Section 9); and (c) from third parties such as our payment service provider (confirming payment status) and, where you choose to register using a social or Apple/Google account, basic profile data from that provider.

4. Sensitive Data and Heightened Protection

Where you voluntarily disclose an allergen, dietary restriction, or similar preference that could reveal health-related information, we treat this as sensitive data under the PDPL's data classification framework. We collect and use this data only:

• for the specific purpose of helping you avoid meals unsuitable for you, and
• with your explicit consent, given when you enter this information.

We apply enhanced access controls to this data and do not use it for any other purpose, including advertising, without obtaining your separate explicit consent.

5. Legal Basis for Processing

We process your personal data on one or more of the following bases recognized under the PDPL:

• Consent – where you have given explicit, informed, opt-in consent (e.g., for marketing communications, location access, or sensitive dietary data).
• Contractual necessity – where processing is necessary to create your account, fulfil your subscription, process payment, and deliver your meals.
• Legal obligation – where processing is necessary to comply with Saudi law (e.g., ZATCA invoicing, SFDA food safety traceability, or a lawful request from a competent authority).
• Legitimate interest – where processing is necessary for a legitimate business purpose (e.g., fraud prevention, service improvement) that does not override your rights and interests, and for which we maintain a documented assessment.

6. How We Use Your Personal Data

We use personal data to:

• create and manage your account and authenticate you;
• process orders, subscriptions, payments, and issue tax invoices;
• plan, prepare, and deliver meals to your nominated office location within the correct delivery window;
• provide customer support and respond to enquiries or complaints;
• send transactional notifications (order confirmations, delivery updates, payment receipts, policy changes);
• send marketing communications, only where you have separately opted in, and always with an option to opt out;
• evaluate and respond to "For Companies" enquiries;
• maintain the security of the Platform and detect or prevent fraud and misuse;
• comply with applicable legal, tax, and food-safety recordkeeping obligations; and
• analyze aggregated, de-identified usage trends to improve the Platform, menu planning, and delivery operations.

We do not sell your personal data to third parties, and we do not use your sensitive dietary/allergen data for advertising or profiling.

7. Legal Basis and Marketing Communications

Where we send you promotional messages (SMS, WhatsApp, push notification, or email), we do so only with your prior opt-in consent, consistent with the Communications and Information Technology Commission's ("CST") rules on commercial electronic communications. Every marketing message will identify Platio as the sender and include a clear, free way to opt out, which we will honor promptly. Opting out of marketing does not affect transactional communications necessary to operate your account and deliver your orders.

8. Sharing and Disclosure of Personal Data

We share personal data only as necessary, and only with:

• Payment service providers, to process payments securely;
• Delivery and logistics personnel/partners, limited to the information needed to complete delivery (name, delivery address, contact number);
• Cloud hosting and IT service providers, acting as our data processors under written data processing agreements that impose PDPL-equivalent obligations;
• Third-party marketplaces (e.g., Keeta, Noon Food, HungerStation), only where you place an order directly through that marketplace, in which case that marketplace's own privacy policy also applies to that transaction;
• Professional advisors and regulators, where necessary to comply with a legal obligation or a lawful request from a competent Saudi authority (e.g., SDAIA, ZATCA, SFDA, Ministry of Commerce); and
• A successor entity, in the event of a merger, acquisition, or reorganization of our business, subject to equivalent privacy protections.

We require all third parties who process personal data on our behalf to implement appropriate technical and organizational safeguards consistent with the PDPL.

9. Cookies and Similar Technologies

We use cookies, SDKs, and similar technologies on our website and app to keep you signed in, remember preferences, understand app performance, and (where you consent) measure marketing effectiveness. Where such technologies are not strictly necessary for the Platform to function, we will request your consent before activating them, and you may withdraw that consent at any time through your device or app settings. We do not currently use third-party advertising trackers for cross-site profiling; if this changes, this Policy will be updated and, where required, fresh consent obtained.

10. Cross-Border Data Transfers

10.1 We aim to store and process personal data collected in Saudi Arabia within the Kingdom wherever operationally possible.

10.2 Where it is necessary to transfer personal data outside the Kingdom (for example, to a cloud service provider with infrastructure located abroad), we will only do so in compliance with SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, which requires that the transfer does not prejudice national security or the vital interests of the Kingdom, and that one of the following applies: (a) the destination country/territory has been confirmed by SDAIA as providing an adequate level of protection; (b) appropriate contractual, corporate, or other safeguards approved under the PDPL are in place (e.g., SDAIA-approved standard contractual clauses); or (c) a specific derogation under the Implementing Regulations applies.

10.3 We maintain a record of any cross-border transfer and the safeguard relied upon, available to SDAIA upon request.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, tax (ZATCA), food-safety (SFDA), accounting, and dispute-resolution requirements. As a general rule:

• Account and order data is retained for the duration of your active account and for a period afterward as required by applicable Saudi commercial and tax record-keeping laws;
• Payment transaction references are retained in line with our payment provider's and SAMA's applicable retention requirements;
• Marketing consent records are retained until you withdraw consent, plus a reasonable period to evidence compliance.

Where retention is no longer necessary, we securely delete or irreversibly anonymize the data.

12. Your Rights Under the PDPL

Subject to the conditions and exceptions set out in the PDPL and its Implementing Regulations, you have the right to:

• Be informed about the legal basis and purpose of collecting your personal data (as provided in this Policy);
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete personal data;
• Request destruction/deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• Request a copy of your personal data in a readable format where technically feasible; and
• Lodge a complaint with SDAIA if you believe your rights under the PDPL have been violated.

To exercise any of these rights, contact us at support@PlatioKitchen.com. We will verify your identity and respond within the timeframe required under the PDPL's Implementing Regulations.

13. Children's Privacy

The Platform is intended for individuals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected personal data from a minor without appropriate parental/guardian consent, we will delete it promptly. Corporate account administrators are responsible for ensuring individual employee-users meet this age requirement.

14. Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, including encryption of data in transit, access controls and role-based permissions, regular security reviews, and contractual security obligations imposed on our service providers. No system can be guaranteed 100% secure; you are responsible for keeping your account credentials confidential.

15. Personal Data Breach Notification

In the event of a personal data breach that poses a risk to your rights or interests, we will notify SDAIA without undue delay and, in any event, within the timeframe required under the PDPL's Implementing Regulations (currently within 72 hours of becoming aware of the breach, where applicable). Where the breach is likely to result in harm to you, we will also notify you directly, without undue delay, describing the nature of the breach and the measures taken.

16. Third-Party Links and Services

The Platform may link to or integrate with third-party services (e.g., payment gateways, maps, or third-party ordering marketplaces). This Policy does not apply to those third parties, and we encourage you to review their respective privacy policies.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable Saudi law, including future guidance issued by SDAIA. Material changes will be notified to you via the app or email, and, where required, we will obtain fresh consent before applying the change to previously collected data. The "Last updated" date at the top of this Policy indicates when it was last revised.

18. Governing Law

This Privacy Policy is governed by the laws and regulations of the Kingdom of Saudi Arabia, including the PDPL and its Implementing Regulations.

19. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact:

You may also lodge a complaint directly with the Saudi Data and Artificial Intelligence Authority (SDAIA) through its official channels if you believe your rights under the PDPL have not been respected.