Azhar Tawseel Village grocery delivery

Privacy Policy

Last updated: 2026-10-30

Effective date: 12 October 2026

Azhar Tawseel respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. Please read it together with our Terms of Service.

At a glance

  • We collect what we need to verify you, take your order, deliver it to the right door, and get paid.
  • We do not sell your personal data, and we never give your name, mobile number, address, or order contents to advertisers.
  • The app uses your location only while you are using it, to pin and confirm your delivery point. During an active delivery, you can see your driver’s location.
  • Your driver sees only what is needed to deliver your order.
  • You can delete your account yourself at any time on our website, and ask to access, copy, or correct your data or withdraw optional consent at any time.

1. Who we are

Azhar Tawseel (أزهر توصيل) is the online grocery store of Mahal Saleh (محل صالح) in the Kingdom of Saudi Arabia. In the Azhar Tawseel customer app and on the website baqala360.com, you buy groceries and everyday products sold by Mahal Saleh, and our drivers deliver your order to you. Azhar Tawseel is not a general delivery or courier service: we deliver only the products you buy from us.

The customer app, the website, the driver app, and our customer support together make up the “Service”. Mahal Saleh (“we”, “us”, “our”) operates the Service, decides how and why your personal data is processed, and is responsible for it as the data controller.

Azhar Tawseel was previously called Baqala360 (بقالة 360), and before that Azhar Wasal (أزهر وصل). The name change does not change who is responsible for your data or the commitments in this policy. Existing accounts, orders, and reward points carry over unchanged.

2. Personal data we collect

2.1 Information you give us

  • Account and contact details: your name, Saudi mobile number, email address (optional), preferred language, and verification status. You can order as a guest with your mobile number; some features require a verified account.
  • Delivery addresses: saved addresses and their labels, village or service area, map pin, directions and notes for the driver, and any photos of your door or building that you choose to add.
  • Orders: products and quantities, custom item requests, your answers to substitutions, partial availability, and final-bill approvals, order notes, prices, fees, discounts, order history, favourites, ratings and reviews, complaints, and reports about a driver.
  • Payments: your chosen payment method, payment status, amounts, transaction references, and any bank-transfer receipt you upload. Card and Tabby payments are processed by the payment provider; we do not receive or store your full card number or card security code.
  • Messages: text, photos, and voice messages you exchange with your driver in the order chat, messages to customer support, and any information you send us by WhatsApp, phone, or email.
  • Rewards and referrals: your points balance and history, how points were earned, used, or expired, and referral codes you share or apply.

2.2 Information collected automatically

  • Location: with your permission, your device’s precise location, to place and confirm your delivery pin and check that it is inside a delivery zone, and the location you choose to share when a driver asks for it during a delivery. You can always set the pin by hand instead.
  • Device and technical data: device model, operating system, app version, language, IP address, push-notification token, request and error logs, and security signals such as failed verification attempts and unusual traffic.
  • Advertising identifiers: the Google Mobile Ads (AdMob) component in the app may collect your device’s advertising identifier, IP address, and ad interactions to show and measure ads (see section 6).
  • Usage data: your searches and the products and pages you open in the app, used to run and improve the Service.

2.3 Information from other sources

  • Payment providers such as Tabby, which tell us whether a payment was approved, completed, or refunded.
  • Our drivers and store staff, who update your order’s preparation and delivery status, item availability, final amounts, and delivery confirmation.
  • A friend who invites you with a referral code.

2.4 Information that stays on your device

Shopping lists, app preferences, and cached catalogue content are stored on your device and are not uploaded to our servers. Deleting the app removes this data from your device.

2.5 Sensitive data

We do not intentionally collect sensitive personal data, such as health, genetic, biometric, or religious data or criminal records. Please do not include it in order notes, chats, or photos.

3. How we use your data and our legal bases

  • Create and secure your account — verify your mobile number and email with one-time codes, sign you in, and protect sensitive actions. Basis: performing our agreement with you; our legitimate interest in security.
  • Take and deliver orders — share the necessary details with your driver, show live order and driver tracking, handle substitutions and the final bill, and send delivery alerts. Basis: performing our agreement with you.
  • Payments and refunds — process cash, card, bank-transfer, reward-points, and Tabby payments, confirm transfers, and issue refunds. Basis: performing our agreement; legal obligations.
  • Rewards program — credit, redeem, and expire points, and run referrals. Basis: performing our agreement (the program terms).
  • Service messages — verification codes and order, delivery, payment, security, and support messages, which are necessary to provide the Service. Basis: performing our agreement with you.
  • Offers and promotions — promotional notifications and messages. Basis: your consent, which you can withdraw at any time.
  • Chat translation — Arabic order-chat messages may be machine-translated into English so that a driver who does not read Arabic can help you. Basis: performing our agreement with you.
  • Advertising — showing ads in the app (see section 6). Basis: our legitimate interest in keeping the Service affordable, subject to your device’s ad-privacy settings.
  • Safety, fraud, and abuse prevention — rate-limiting requests, blocking suspicious traffic, investigating fake orders or payment receipts and misuse of codes, points, or referrals, and handling reports about drivers. Basis: legitimate interests; legal obligations.
  • Running and improving the Service — troubleshooting, analytics, planning delivery fees and coverage, and improving the product catalogue. Basis: legitimate interests.
  • Legal compliance — tax, zakat, e-invoicing, accounting, and consumer-protection requirements, requests from competent authorities, and establishing or defending legal claims. Basis: legal obligations; legitimate interests.

We use your data only for these purposes or for purposes compatible with them. If we want to use it for a new, unrelated purpose, we will tell you first and ask for your consent where required.

We use automated rules for security, such as temporarily blocking access after repeated failed attempts. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Tabby makes its own approval decisions independently.

4. Location

  • Customer app: uses location only while the app is open and only after you allow it — to place your delivery pin, check delivery coverage, calculate the delivery fee for that exact spot, and share your position with your driver if you choose to. The customer app does not track your location in the background.
  • Driver location: while your order is being delivered, you can see the assigned driver’s live location so you can follow your order. You cannot see the driver’s location outside your own delivery.
  • You can turn off location access in your device settings and enter your address manually. The delivery pin must still be accurate for us to deliver.

5. Who we share data with

We do not sell or rent your personal data. We share it only as described below, and only what each recipient needs:

  • Your driver: your name, mobile number, delivery address, map pin, notes for the driver, door photos, order items, the amount to collect, and the order-chat messages.
  • Service providers working for us: hosting and database providers; Cloudflare (website and API delivery and security); Google (Firebase Cloud Messaging for notifications, Firebase Phone Auth for verification codes, Google Maps, and AdMob); Apple (iOS notifications); Authentica (sending verification codes by SMS or WhatsApp); our email provider; and a translation provider for order-chat messages. They may use the data only to provide their services to us, under contracts or terms that require them to protect it.
  • Payment providers: Tabby and any other payment provider you choose receive the contact, order, amount, and transaction details needed to assess and process your payment. Tabby makes its approval decisions under its own terms and privacy policy.
  • Messaging apps: if you contact us or a driver by WhatsApp or phone call, that communication also passes through the provider you use (for example, WhatsApp/Meta) under its own terms.
  • Authorities and advisers: government, regulatory, tax, or judicial authorities when the law requires it or to protect rights, safety, and property; and our lawyers, accountants, and auditors, who are bound by confidentiality.
  • Business changes: if the Service or the business is transferred, merged, or restructured, your data may move to the new operator, which must keep protecting it under this policy and applicable law. We will tell you before this happens.

6. Advertising

The Azhar Tawseel app may show ads through Google AdMob. To show, limit, and measure ads, Google may collect your device’s advertising identifier, your IP address and the approximate location derived from it, device information, and how you interact with ads, and may use them to personalise ads according to Google’s policies and your device settings. We do not share your name, mobile number, email address, delivery address, or order contents with Google AdMob or any other advertiser.

You can limit personalised ads. On Android, open Settings → Google → Ads and delete or reset your advertising ID. On iPhone, open Settings → Privacy & Security → Tracking, and Settings → Privacy & Security → Apple Advertising. To learn more, see Google’s advertising policies at policies.google.com/technologies/ads.

7. Notifications and marketing

We send notifications about your orders, deliveries, driver arrival, payments, and account security. With your permission, we may also send offers and promotions. You can turn off notifications in your device settings at any time and ask customer support to stop promotional messages. If you turn off service notifications, you may miss driver-arrival alerts.

8. Transfers outside Saudi Arabia

Some of our providers (such as Google, Apple, Cloudflare, and our messaging, email, and translation providers) may store or process data outside the Kingdom of Saudi Arabia. We transfer personal data outside the Kingdom only as permitted by the PDPL and the Regulation on Personal Data Transfer outside the Kingdom, limited to what is necessary, and with appropriate safeguards such as contractual protections.

9. How long we keep data

  • Account and profile: for as long as your account is active. When you delete your account, or ask us to, we delete or anonymise it, except for the records we must keep as described below.
  • Orders, invoices, and payment records: for the period required by Saudi tax, zakat, e-invoicing, and accounting laws, and for as long as needed to resolve disputes or refunds.
  • Verification codes: codes expire shortly after they are sent, and phone verification codes are never stored in readable form. We keep limited records of verification attempts for security.
  • Saved addresses and door photos: until you delete them in the app or delete your account.
  • Order-chat messages, photos, and voice messages: kept with the order record for support, quality, and complaint handling.
  • Security logs: for a limited period needed to detect and investigate abuse.
  • Business applications: while the application is under review and, if it is not taken forward, for a limited period afterwards before deletion.

When data is no longer needed, we delete it, anonymise it, or securely restrict access to it.

10. How we protect your data

We use administrative, technical, and organisational safeguards appropriate to the risk, including encrypted connections (HTTPS), role-based access for staff and drivers, hashed verification codes, request limits and automatic blocking of abusive traffic, monitoring, and limiting each piece of data to the people who need it. No system is completely secure, so please keep your phone, verification codes, and account safe and never share a code with anyone. Azhar Tawseel staff and drivers will never ask you for a verification code.

If a personal data breach occurs that is likely to harm you, we will notify the Saudi Data & AI Authority (SDAIA) and, where required, you, within the time limits set by law, and take steps to contain it.

11. Your rights

Under the PDPL, you have the right to:

  • be informed about how your data is collected and used, as this policy does;
  • access your personal data and obtain a copy of it in a clear, readable format;
  • correct data that is inaccurate, incomplete, or out of date;
  • have data deleted when we no longer need it, including deleting your account;
  • withdraw your consent at any time for processing based on consent, such as promotional messages, without affecting processing carried out before you withdrew it; and
  • complain to the Saudi Data & AI Authority (SDAIA) if you believe your data has been mishandled.

You can update your name, email address, saved addresses, door photos, and notification and permission choices in the app or in your device settings.

Deleting your account: you can delete your account at any time at baqala360.com/account/delete. We confirm it is you with a code sent to your registered mobile number, then straight away delete your profile, saved addresses and door photos, favourites, notifications, and reward points. Points cannot be restored or paid out after deletion. We keep orders, invoices, and payment records as the law requires, with your name, number, address, and map pin removed, and a one-way coded form of your number so that new-customer offers and blocks cannot be misused. If an order is still on its way, finish or cancel it first.

For any other request, contact us using the options in section 16. We will verify your identity (usually with a code sent to your registered mobile number) and respond within 30 days, or tell you if we need more time as the law allows. We do not charge for reasonable requests. Some data may be kept after deletion where the law requires it, for completed transactions and refunds, or to prevent fraud.

12. Children

The Service is intended for adults who have the legal capacity to place orders and is not directed at children. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or legal guardian. A parent or guardian who lets a minor use their device is responsible for that use. If you believe a child has given us personal data without consent, contact us and we will delete it.

13. Drivers and business applicants

  • Drivers: we process drivers’ identity and contact details, account and device information, live location while on duty (including in the background while delivering), delivery activity, cash collected and settlements, customer ratings and reports, and order chats. Driver location is used to assign and route orders, show customers the progress of their delivery, and resolve disputes. A customer can see a driver’s location only during that customer’s own delivery.
  • Business applicants: if you send us a business application through the form on our website, we collect your business details (such as its name, type, commercial registration and VAT numbers, address, location, logo, and documents), your name and contact details, and a hashed version of your IP address for spam prevention. We use them only to review your application and contact you about it.

14. Website cookies

Our website uses only strictly necessary cookies, for example to secure the forms on our website and to protect the site from abuse. Our security provider, Cloudflare, may set its own security cookies. We do not use advertising cookies on our website.

15. Changes to this policy

We may update this policy when the Service, our providers, or the law changes. We will publish the new version here with a new effective date, and for significant changes we will notify you in the app or by message before they take effect.

16. Contact us

For privacy questions, requests, or complaints, contact Azhar Tawseel customer support by phone, WhatsApp, or the other contact options shown in the app under Settings or on baqala360.com. Please write “Privacy request” and include the mobile number registered to your account. Data controller: Mahal Saleh (محل صالح), operator of Azhar Tawseel, Kingdom of Saudi Arabia.