Privacy Policy

1. Introduction

This Privacy Policy explains how Neuvano Company (شركة نيوفانو), Commercial Registration No. 7053942988, trading as dammfidyahmakkah (“we”, “us”), collects, uses, stores, shares and protects personal data when you visit dammfidyahmakkah.com (the “Website”), contact us, or place an order for Damm, Fidyah, Hady, Sadaqah or livestock services.

We are the data controller for personal data processed in connection with the Website and our services. We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations (together, the “PDPL”), and other applicable laws.

This Policy should be read together with our Terms & Conditions. If you do not agree with this Policy, please do not use the Website or provide personal data to us.

2. Personal data we collect

Data you provide directly:

• Identity and contact data: name, phone number, WhatsApp number, email address, country and (where needed) postal address.
• Order data: the type of sacrifice, quantity, requested date, the name(s) of the person(s) on whose behalf the sacrifice is performed (which may include family members or group members), group or agent details for bulk orders, and any notes you add.
• Payment data: payment method, transaction reference, amount, bank-transfer details you provide, and billing information. Full card numbers are entered directly with our licensed payment provider and are never stored by us.
• Communications: messages, calls, complaints and feedback exchanged with us by WhatsApp, email, phone or Website forms, including any reviews or testimonials you submit.

Data collected automatically. Our hosting infrastructure keeps short-lived technical logs (such as IP address and request time) needed to run and secure the Website. Beyond that, usage data — pages visited, browser type, referring website, approximate location derived from IP address — is collected through Google Analytics only if you consent, as described in Section 8. If you do not consent, it is not collected at all.

Data generated when we perform your order:

• Proof-of-performance media: photographs and/or videos of the animal and the slaughter, which may display your order number and the name(s) you designated, together with date, time and location records.
• Fulfilment records: purchase, slaughter and distribution records relating to your order.

Data about other people. When you provide the name or details of another person (for example, the person on whose behalf a sacrifice is performed, or members of a group order), you confirm that you are authorised to share that data with us and that you have informed them of this Policy. We use such data only to perform and evidence the order.

We do not intentionally collect sensitive personal data (such as health, biometric or credit data) beyond what is inherent in the service. The fact that you have ordered a religious sacrifice may indicate your religious belief; we process this only to perform your order and do not use it for profiling or marketing segmentation.

The Website and services are not directed at children under 18. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.

3. Why and on what basis we use personal data

Each purpose below rests on a legal basis under the PDPL:

• Receiving, confirming, scheduling and performing your order, and delivering proof of performance — performance of a contract with you, or steps at your request before a contract.
• Processing payments, refunds and invoices, and preventing fraud — performance of a contract; compliance with legal obligations (including tax and e-invoicing rules); our legitimate interest in preventing fraud.
• Responding to enquiries, complaints and support requests — performance of a contract; legitimate interest in providing customer service.
• Maintaining business, accounting, tax and dispute records — compliance with legal obligations; legitimate interest in defending legal claims.
• Operating and securing the Website — legitimate interest in running a secure and functional Website.
• Website analytics — your consent, given through the cookie banner and withdrawable at any time (Section 8).
• Sending marketing messages about our services — your consent, which you may withdraw at any time.
• Using reviews or testimonials you submit in our marketing — your consent.
• Sharing data with authorities where required — compliance with legal obligations.

We do not sell personal data. We do not use automated decision-making that produces legal or similarly significant effects on you.

4. Who we share personal data with

We share personal data only where necessary for the purposes above, with:

• Payment providers: licensed payment gateways — currently Stripe — and banks that process your payment and refunds.
• Communication platforms: WhatsApp (Meta), email and SMS providers used to send confirmations, proof of performance and support messages. Messages sent through these platforms are subject to the platform's own privacy terms.
• Hosting and IT providers: the platforms that host the Website and our order records, analytics providers — currently Google Analytics (Google LLC), Section 8 — and IT support.
• Fulfilment partners: slaughterhouse operators, livestock suppliers, transport and distribution helpers, who may see the order number and the designated name(s) strictly to perform and evidence the sacrifice.
• Professional advisers: lawyers, accountants and auditors under confidentiality obligations.
• Public authorities: regulators, courts, law-enforcement or tax authorities where required by law or a lawful request.
• A successor operator of the brand in the event of a corporate reorganisation, subject to this Policy.

We require our service providers to process personal data only on our instructions and to protect it appropriately.

5. International transfers

Many of our customers order from outside Saudi Arabia, and some of the service providers listed in Section 4 (for example, messaging, email, hosting or analytics platforms) may store or process data outside the Kingdom. Where personal data is transferred outside Saudi Arabia, we do so only where permitted by the PDPL and its transfer rules, and we take steps intended to ensure an appropriate level of protection, such as contractual commitments with the recipient.

By sending us data from outside Saudi Arabia, you acknowledge that your data will be transferred to and processed in the Kingdom of Saudi Arabia.

6. How long we keep personal data

• Order, payment, invoice and proof-of-performance records: for as long as needed to perform the order and thereafter for the period required by Saudi commercial, tax and e-invoicing rules and to handle any dispute.
• Proof-of-performance photographs and videos: retained for 30 days after delivery to you, then deleted, unless needed for a dispute or legal requirement.
• Enquiries and support messages that do not lead to an order: 30 days.
• Marketing consents: until you withdraw consent, after which we keep a record of the withdrawal only.
• Analytics: the Google Analytics cookies last at most two years, and we delete them from your browser immediately if you withdraw consent. In Google Analytics itself, event-level data is deleted automatically after 2 months and user-level data after 14 months; only aggregated statistics remain beyond that.

When personal data is no longer needed, we delete or anonymise it securely.

7. How we protect personal data

We apply technical and organisational measures appropriate to the risk, including HTTPS encryption of the Website, restricted access to order data on a need-to-know basis, use of licensed payment providers so that card details are never stored by us, and secure storage of proof media.

Your proof page is reached through a long, unguessable link created for your order. That link is the key to the page: anyone you forward it to can view that order's certificate and media, so treat it as you would the documents it unlocks. The link is never sent to analytics (Section 8) and is only shared with you.

No system is completely secure. If a personal-data breach occurs that is likely to cause harm to you, we will notify the competent authority and, where required, affected individuals in accordance with the PDPL.

8. Cookies and analytics

Essential storage. The Website stores your language, currency and cookie choice in your own browser so they survive a reload. This is functional storage: it never leaves your device and identifies nobody. Our payment provider applies its own security measures on its payment page.

Analytics, only with your consent. We use Google Analytics 4 (Google LLC) to count visits and understand which pages are useful. Until you choose “Accept” on the cookie banner, nothing is loaded — no Google script runs and no analytics cookie is written. If you decline, that choice is remembered and analytics stays off.

Changing your mind. You can reopen the choice at any time from “Cookie settings” in the Website footer. Withdrawing consent stops analytics and deletes its cookies from your browser.

What analytics never receives: your name, your phone number, payment references, or the link to your proof. Proof pages are reported under an anonymous placeholder, and administrative pages are not reported at all.

We do not use marketing or advertising cookies, and Google Analytics' advertising features (Google signals) are switched off.

9. Your rights

Under the PDPL you have the right to:

• Be informed about how your personal data is collected and used (this Policy).
• Access your personal data and obtain a copy in a readable format.
• Request correction, completion or updating of inaccurate data.
• Request deletion of your personal data, subject to legal retention requirements.
• Withdraw consent at any time where processing is based on consent — for analytics via “Cookie settings” in the footer, for marketing via the opt-out in the message or by contacting us. This does not affect processing already carried out.
• Object to or restrict certain processing, including direct marketing.
• Lodge a complaint with the competent authority (currently the Saudi Data & AI Authority, SDAIA) if you believe your rights have been infringed.

To exercise any right, contact us using the details in Section 12. We may need to verify your identity before responding. We aim to respond within the timeframe required by the PDPL, currently 30 days, extendable in complex cases where the law allows.

Requests relating to proof media that also show other customers' orders may be subject to redaction to protect other individuals.

10. Marketing and communications

We send transactional messages — order confirmation, scheduling, proof of performance, payment and refund messages — as part of performing your order. These are not marketing.

We send marketing messages about our services (for example, Hajj-season availability) only if you have opted in. You may opt out at any time by using the unsubscribe option in the message or contacting us. We do not share your data with third parties for their own marketing.

11. Third-party websites and platforms

The Website may link to third-party websites and platforms, including payment pages, WhatsApp, maps and social media. This Policy does not cover those services, which have their own privacy policies. Reviews you post on public platforms (such as Google) are governed by those platforms' terms and are visible to the public.

12. Contact and complaints

• Data controller: Neuvano Company (شركة نيوفانو), trading as dammfidyahmakkah — CR 7053942988.
• Address: Al-Layth Road Slaughterhouse (B), Makkah Al Mukarramah, Kingdom of Saudi Arabia.
• Privacy contact: info@dammfidyahmakkah.com.
• WhatsApp: +966 50 600 7271.
• Supervisory authority: Saudi Data & AI Authority (SDAIA) — National Data Management Office.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our services, technology or the law. The date at the top shows when it was last updated. Where changes are material, we will notify you through the Website or by the contact details you have given us.

Effective date: 31 August 2026.