Last updated: February 2026

1. Introduction

Welcome to Lula Tea (lulatee.com) — a Saudi online store specializing in premium tea and tea products. We value your privacy and are committed to protecting your personal data in accordance with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree M/19, dated 9/2/1443H, and its implementing regulations. This policy explains how we collect, use, and safeguard your information when you use our website or communicate with us.

2. Information We Collect

We collect the following types of information:

a. Information you provide directly:

Full name
Phone number / WhatsApp
Email address
Delivery address (city, district, street)
Payment information (when using credit/debit card or STC Pay)
Tea and product preferences (preferred flavors and types)

b. Information collected automatically:

IP address and approximate location
Browser type and device information
Pages visited and duration of visit
Cookies

3. Legal Basis for Data Processing

We process your personal data in compliance with the Saudi PDPL based on the following legal grounds:

Contract performance: Processing your data to fulfill tea purchase orders and delivery
Consent: Sending marketing messages and promotional notifications (with your prior consent)
Legal obligation: Compliance with SFDA (Saudi Food and Drug Authority) and applicable Saudi regulations
Legitimate interest: Protecting the website from fraud and improving the quality of our services and tea products

4. How We Use Your Information

We use your data for the following purposes:

Processing and delivering your tea orders
Communicating with you regarding order status
Sending notifications via WhatsApp or email (with your consent)
Providing personalized tea recommendations based on your preferences
Improving our website and services
Compliance with Saudi Food and Drug Authority (SFDA) requirements for food and beverage product safety
Complying with legal and regulatory requirements in the Kingdom of Saudi Arabia

5. Information Sharing

We do not sell or trade your personal information. We may share your data with:

Payment providers: Tap Payments, STC Pay — to securely process payments
Delivery companies: To deliver your tea orders to the specified address
Technical service providers: Such as hosting and analytics services to operate the website
Government authorities: When required to comply with Saudi regulations including SFDA

6. Cross-Border Data Transfers

Some of your data may be transferred and processed outside the Kingdom of Saudi Arabia through our technical service providers (such as cloud hosting services). This is done in accordance with the provisions of the PDPL and its implementing regulations, ensuring an adequate level of protection for your data and that transfers occur only for necessary purposes.

7. Data Protection

We implement security measures to protect your information, including:

Encryption of sensitive data using AES-256
Secure connection via HTTPS/SSL
Restricting access to personal data to authorized personnel only
Regular review of security procedures
No storage of bank card details on our servers

8. Cookies

We use cookies to improve your experience on the website. Cookies help us remember your preferences (such as language and preferred tea types) and analyze website usage. You can control cookie settings through your browser, though disabling cookies may affect some website functionality.

9. Your Rights

Under the Saudi Personal Data Protection Law (PDPL), you have the right to:

Know the legal basis and purpose for processing your data
Access your personal data stored with us and obtain a copy
Request correction, update, or destruction of your information
Request deletion of your data (subject to legal retention requirements)
Object to the processing of your data in certain circumstances
Unsubscribe from marketing communications at any time
File a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) if you are dissatisfied with how your data is processed

10. Data Retention

We retain your data for the duration of your active account and for a period not exceeding what is required by the purpose of collection or as mandated by law. Payment card data is deleted immediately after the transaction is completed and is not stored on our servers.

11. Policy Updates

We may update this policy from time to time to keep pace with regulatory developments. Any material changes will be posted on this page with an updated “Last updated” date, and you will be notified of material changes through available communication channels.

12. Contact Us

For any questions about this privacy policy or to exercise your data protection rights, please contact us:

For information about the Saudi Personal Data Protection Law: sdaia.gov.sa

Privacy Policy