Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Identity data: Full name.
• Contact data: Phone number, email address.
• Location data: Delivery addresses you provide when placing orders.
• Transaction data: Order history, items ordered, order values, payment method (cash/card), and order status.
• Device data: Push notification tokens to enable order status notifications on your device.
• Loyalty data: Points balance, point transactions, and redemption history.

We do not collect payment card numbers. Card transactions are handled directly by Tap Payments, a PCI DSS compliant payment processor.

2. How We Use Your Data

We use your personal data for the following purposes:

• To process and fulfil your food orders.
• To arrange delivery to your specified address.
• To send you real-time order status notifications (via push notification).
• To operate and administer the loyalty programme.
• To respond to customer service enquiries and complaints.
• To comply with legal and regulatory obligations in the Kingdom of Bahrain.

3. Payment Data

In-app card payments are processed by Tap Payments Co., a PCI DSS compliant payment service provider. When you make a card payment, your card details are entered directly on Tap Payments' secure platform. IL Gusto does not receive, store, or process your card number, CVV, or expiry date.

For more information on how Tap Payments handles your data, please refer to the Tap Payments Privacy Policy available on their website.

4. Data Sharing

We share your personal data only where necessary and with the following parties:

• Tap Payments: For processing card payments (when in-app payments are enabled).
• Delivery personnel: Your name, phone number, and delivery address are shared with our delivery staff solely to fulfil your order.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

5. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we retain order history for 3 years for legal and accounting purposes, after which it is permanently deleted.

Push notification tokens are deleted when you uninstall the app or revoke notification permissions.

6. Your Rights

Under the Kingdom of Bahrain's PDPL, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Delete your personal data, subject to our legal retention obligations.
• Object to processing of your data in certain circumstances.

To exercise any of these rights, contact us at: gustobahrain@gmail.com. We will respond within 15 business days.

7. Security

We implement appropriate technical and organisational measures to protect your personal data:

• All data is transmitted over HTTPS / TLS encrypted connections.
• Your data is stored in Supabase, a cloud infrastructure provider that maintains SOC 2 Type II compliance.
• Access to personal data is restricted to authorised IL Gusto staff on a need-to-know basis.

No transmission over the internet is 100% secure. While we use commercially reasonable measures, we cannot guarantee absolute security.

8. Cookies and Tracking

The IL Gusto mobile application does not use third-party advertising trackers or behavioural analytics cookies. The website uses only essential session cookies required for the Service to function. We do not engage in cross-site tracking or sell browsing data to advertisers.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via the app. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of the Kingdom of Bahrain, including the Personal Data Protection Law (PDPL) promulgated by Legislative Decree No. 30 of 2018.

12. Contact — Data Protection Enquiries

For privacy-related enquiries, to exercise your data rights, or to raise a concern, please contact us: