Privacy Policy
Effective Date: July 30, 2026
Company Name: Cilantro Limited ("we," "our," or "us")
Applicability: This Privacy Policy governs the collection, use, disclosure, and processing of personal data through our loyalty and ordering mobile application (the "App") and website (the "Website"), in full compliance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable laws of the United Arab Emirates (UAE).
1. Introduction and Scope
Cilantro Limited respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we handle personal information when you use our loyalty program, place orders through our Website or App, or otherwise interact with our services.
By accessing or using our App and Website, you acknowledge that you have read and understood this Privacy Policy. Where required by UAE law, we will obtain your clear, affirmative consent before collecting or processing your personal data.
2. Personal Data We Collect
In accordance with the data minimization principle under UAE law, we only collect personal data that is necessary, adequate, and limited to what is required for the purposes outlined in this policy. Because we operate an ordering and loyalty platform, we may collect the following categories of information:
Identity and Contact Data: Full name, telephone number, email address, and delivery or pickup address.
Account Credentials: Usernames, passwords, and security-related authentication details for your App profile.
Order and Transaction History: Details regarding food or product orders, favorite items, purchase frequency, order timestamps, and preferred pickup or delivery locations.
Loyalty and Rewards Data: Points accrued, reward redemptions, tier status, vouchers used, birthday or anniversary dates (if provided for special loyalty perks), and referral history.
Financial and Payment Data: Transaction confirmation details, billing details, and payment card information (note: actual debit/credit card numbers are processed securely through certified PCI-DSS compliant payment gateways and are not stored directly by Cilantro Limited).
Technical and Usage Data: IP address, browser type, device identifiers, operating system, app usage metrics, crash logs, and pages visited on our Website or App.
Location Data: Precise or approximate GPS location data from your device, subject to your device permission settings, used to find nearby stores, calculate delivery distances, and ensure accurate order fulfillment.
3. Lawful Basis and Purpose of Processing
We process personal data only when there is a valid lawful basis under Article 4 of the UAE PDPL, specifically to power our ordering and loyalty features:
Contractual Necessity: To process and fulfill your food/product orders, manage your account, deliver items to your location, and provide customer support.
Consent: Where you have given clear, explicit consent for specific activities (e.g., opting in to push notifications, promotional marketing, location tracking, or providing optional profile details for loyalty rewards).
Legitimate Interests: To improve our menu offerings, analyze user ordering trends, secure our platform against fraud, and administer our loyalty and rewards program efficiently.
Legal Obligation: Where we must process your data to comply with applicable UAE federal and local tax, consumer protection, and regulatory requirements.
4. How We Share and Disclose Personal Data
We do not sell, rent, or trade your personal data. We may share your data only under strict compliance safeguards with:
Service Providers: Trusted third-party vendors who assist us in operating our Website and App infrastructure, managing our loyalty platform, processing secure online payments, dispatching delivery logistics, and providing customer support (all bound by strict data processing and confidentiality agreements).
Legal and Regulatory Authorities: Government, tax, or regulatory bodies in the UAE when required by law, court order, or to protect the legal rights, safety, and security of Cilantro Limited, our customers, or the public.
5. Cross-Border Transfers of Personal Data
As a UAE-registered entity, any transfer of your personal data outside the borders of the UAE is strictly regulated under the UAE PDPL. If we transfer your personal data to cloud servers or third-party service providers located outside the UAE, we ensure that the destination country provides an adequate level of data protection or that appropriate contractual safeguards (such as standard contractual clauses) and technical security measures are legally implemented.
6. Data Security Measures
Cilantro Limited implements robust technical and organizational measures to protect your personal data and order history against accidental loss, unauthorized access, destruction, alteration, disclosure, or illegal processing. These measures include tokenized payment processing, encryption in transit and at rest, multi-factor authentication options, regular security vulnerability assessments, and strict role-based access controls.
7. Data Retention
We retain your personal data—including order records and loyalty account points—only for as long as necessary to fulfill the purposes for which it was collected, maintain your loyalty status, or as required to comply with legal, accounting, or tax reporting requirements under UAE law. If you request account closure, we will delete or permanently anonymize your data, except where retention is legally mandated.
8. Your Rights as a Data Subject
Under the UAE PDPL, you hold several legal rights regarding your personal data:
Right to Access: You have the right to request a copy of the personal data and loyalty history we hold about you.
Right to Rectification: You can request the correction of inaccurate, incomplete, or outdated profile or address data.
Right to Erasure: You can request the deletion of your account and personal data under certain conditions (e.g., when you no longer wish to use the loyalty program and data is no longer needed).
Right to Restrict or Object to Processing: You have the right to object to or restrict our processing of your data under specific situations, such as opting out of direct marketing or promotional push notifications.
Right to Data Portability: You can request to receive your profile and order data in a structured, commonly used format or have it transferred directly to another controller where technically feasible.
Right to Withdraw Consent: Where processing relies on your consent (such as location tracking or marketing preferences), you may withdraw your consent at any time via your App settings or by contacting us.
To exercise any of these rights, please contact us using the details provided below.
9. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our loyalty features, app updates, ordering systems, or legal obligations under UAE law. Any changes will be posted on this page with an updated "Effective Date." We encourage you to review this policy periodically.