Data Privacy Notice & Policy
Data Privacy Notice & Policy – Murtadha Ahmed Alshaikh Jafar Establishment
Last Updated: August 2026
1- Introduction & Scope
Welcome to Nova Leaf online store, owned and operated by Murtadha Ahmed Alshaikh Jafar Establishment (referred to in this policy as “the Establishment”, “we”, “us”, or “Nova Leaf”).
We place the utmost importance on the privacy of your personal data and consider its protection a fundamental commitment. This Privacy Notice explains to individuals residing in or located within the Kingdom of Saudi Arabia (KSA) how we collect, use, store, and protect your personal data in accordance with the KSA Personal Data Protection Law (PDPL) issued under Royal Decree No. 19/m, dated 9/2/1443H (16 September 2021) and its implementing regulations.
As the “data controller” of your personal data, we are committed to full transparency regarding how your data is processed. If we make material updates to this Policy, we will notify you by publishing the updated version on our platform.
2- What is Personal Data and Processing?
• Personal Data: Any information—regardless of its source or form—that can identify you as an individual directly or indirectly. This includes, but is not limited to : ◦ Identifiers: Full name, National ID/Iqama number, nationality, age, and gender. ◦ Contact & Location Data: Phone number, email address, shipping address, and geolocation. ◦ Financial & Technical Data: Purchase history, payment details, IP address, device identifiers, and activity logs on our store.
Processing: Any operation performed on personal data by any means, whether manual or automated, such as collecting, recording, storing, modifying, retrieving, sharing, or destroying data.
3- Lawful Bases for Processing
We process your personal data strictly when there is a valid lawful basis under the PDPL, including :
Explicit Consent: Obtained during registration or when requesting specific services (you may withdraw consent at any time).
Contractual Necessity: Necessary processing to execute sales transactions, product delivery, and post-purchase customer support.
Legitimate Interest: Necessary processing to enhance our services, optimize user experience, and secure our platform without conflicting with your rights.
Legal Compliance: Processing required to comply with statutory, tax, or regulatory requirements in Saudi Arabia.
Vital Interest / Direct Benefit: In circumstances where contacting you is difficult, but processing yields a clear and direct benefit for you.
4- Purposes of Data Processing & Activities
We collect and process personal data for specific, lawful purposes designed to deliver the best possible service :
| Processing Purpose | Examples of Processing Activities |
|---|---|
| Account Registration & Management | Collecting your basic details (name, phone, email, address) to grant secure account access. |
| Transaction Execution & Checkout | Enabling product discovery, cart management, invoicing, and processing payments via certified payment gateways. |
| Shipping & Delivery Services | Sharing shipping address and contact details with approved courier partners for timely delivery. |
| Customer Service & Support | Contacting you regarding order updates, handling inquiries, and improving customer service. |
| Usage Reminders & Self-Care Support | Sending optional notifications and reminders to assist in organizing usage schedules for supplements based on your purchase history. |
| Marketing & Promotional Offers | Sending promotional updates regarding Nova Leaf products via social media, email or SMS (subject to your consent, with opt-out options at any time). |
| Analytics & Service Enhancement | Analyzing statistical and technical data to improve store performance and overall customer experience. |
Note:
Providing basic mandatory data is required for fulfilling sales agreements. Failure to provide essential information may prevent us from delivering the requested services.
5- Data Protection & Limitation of Liability
Our Commitment: Murtadha Ahmed Alshaikh Jafar Establishment (Nova Leaf) implements reasonable technical and organizational measures to safeguard your data against unauthorized access, loss, alteration, or disclosure. We utilize industry-standard encryption protocols and secure digital environments.
Standard of Care & Limitation of Liability: While the Establishment exercises due diligence and commercially reasonable efforts to maintain high security standards, no electronic transmission or digital storage method can be guaranteed 100% secure against unforeseen cyber risks, unauthorized third-party interferences, or force majeure events beyond our reasonable control. In the event of a security incident, we commit to taking prompt remedial actions and notifying affected users and relevant authorities in accordance with the PDPL.
User Responsibility: You remain responsible for maintaining the confidentiality of your account credentials and password and avoiding disclosure of sensitive access information to third parties.
6- Data Sharing & Disclosure
We never sell your personal data. We may share limited personal data only when necessary and strictly for the purposes described in this policy with trusted third parties :
Service Providers & Operational Contractors: Such as IT hosting, cloud management, and payment processing partners.
Logistics & Shipping Partners: For dispatching and delivering physical orders to your designated location.
Marketing & Analytics Partners: To optimize digital campaigns and user interface experience under strict confidentiality agreements.
Governmental & Regulatory Bodies: When required by mandatory laws, regulations, or binding court orders.
Business Transfers: In the event of a merger, acquisition, or restructuring, provided the acquiring entity adheres to equivalent data privacy standards.
7- Cross-Border Data Transfers
Some operational tools or service providers may process data on servers located outside the Kingdom of Saudi Arabia. Whenever cross-border data transfer is necessary, the Establishment commits to complying with the provisions and controls established under the Saudi Personal Data Protection Law (PDPL) and regulations issued by SDAIA, ensuring that the level of protection provided to your data outside KSA is not degraded.
8- Data Retention & Destruction
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable legal, statutory, tax, or regulatory retention periods in KSA.
Upon expiration of the retention requirement or when data is no longer necessary, data will be permanently destroyed or fully anonymized to prevent re-identification.
9- Your Rights Under KSA PDPL
Under the Saudi PDPL, you hold the following primary rights regarding your personal data :
1. Right to Information: To know the lawful justification and purpose of processing your data.
2. Right to Access: To inspect and receive a copy of your personal data held by us.
3. Right to Rectification: To request correction, completion, or updating of inaccurate or incomplete data.
4. Right to Erasure: To request destruction of your data when it is no longer needed (subject to statutory retention exceptions).
5. Right to Withdraw Consent: To withdraw your consent at any time (without affecting the lawfulness of processing prior to withdrawal).
10- Contact Us
For any privacy-related inquiries, requests to exercise your rights, or questions regarding this notice, please contact our Data Protection Team at: support@nova-leaf.net
"نوفا ليف" (nova-leaf.net) علامة تجارية مملوكة ومُدارة من قِبل مؤسسة مرتضى أحمد الشيخ جعفر — MURTADHA AHMED ALSHAIKH JAFAR ESTABLISHMENT.
