Privacy Policy

MHG Boutique KSA

Last Updated: [13/09/2026]

1. Introduction

This Privacy and Cookie Policy explains how Mohamed Hilal Group and/or the relevant entity operating MHG Boutique KSA collects, uses, stores, protects and otherwise processes personal data when you visit or use our website, place an order, create an account, contact our customer service, or interact with us through our authorized channels.

We respect your privacy and are committed to processing your personal data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations.

This Policy should be read together with our Terms and Conditions, Return, Exchange and Refund Policy, and other applicable policies published on our website.

You can contact us regarding this Policy or your personal data using the contact details provided at the end of this Policy.

2. Personal Data We May Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Contact and account information

This may include:

  • Full name
  • Mobile number
  • Email address
  • Delivery address
  • Billing address
  • Account information
  • Information required to communicate with you regarding your order

Order and transaction information

This may include:

  • Orders placed
  • Products purchased
  • Order date and time
  • Order value
  • Delivery information
  • Items added to your shopping cart
  • Abandoned or incomplete orders
  • Returns, exchanges and refund information
  • Customer preferences relating to your purchases

Customer service information

When you contact our customer service, we may collect information you provide to us, including:

  • Your name and contact details
  • Order information
  • Communications and correspondence
  • Complaints, requests and feedback

Where applicable, customer service conversations, including live-chat conversations, may be recorded or retained for customer service, quality assurance, security and complaint-handling purposes, subject to applicable law.

Technical and website information

When you visit our website, certain technical information may be collected, including:

  • IP address
  • Device type
  • Browser type
  • Operating system
  • Pages visited
  • Products viewed
  • Search terms
  • Referring URLs
  • Website interaction information
  • Approximate location information derived from technical data where applicable
  • Cookie and similar technology information

Information from third parties

We may receive information from service providers involved in providing services to you, such as:

  • Payment service providers
  • Delivery and logistics providers
  • Technology and hosting providers
  • Customer service providers
  • Marketing and analytics providers

We only process such information where permitted under applicable law and for relevant and legitimate purposes.

Information relating to other individuals

If you provide us with personal information relating to another person, such as a gift recipient, you confirm that you are authorized to provide that information and, where required by law, that you have obtained the necessary permission or consent from that individual.

3. Payment Information

Payment transactions on our website are processed through authorized payment service providers.

Where applicable, payment card information is transmitted securely to the relevant payment service provider for the purpose of processing the transaction.

We do not intentionally store complete payment card details on our own systems where the payment is processed directly by the relevant payment service provider.

Payment service providers may process payment information in accordance with their own privacy policies and applicable laws and regulatory requirements.

4. Why We Use Your Personal Data

We may process your personal data for the following purposes:

  • Processing and fulfilling your orders
  • Delivering products to you
  • Processing payments, refunds and returns
  • Managing your customer account
  • Providing customer service and responding to inquiries
  • Handling complaints and requests
  • Verifying transactions and preventing fraud
  • Maintaining the security of our website and services
  • Improving our products, services and customer experience
  • Conducting analytics and statistical analysis
  • Understanding website usage and customer preferences
  • Personalizing your shopping experience where permitted
  • Sending marketing communications where we have the required legal basis and consent, where applicable
  • Conducting promotional activities where permitted
  • Complying with legal and regulatory obligations
  • Protecting our rights, property, customers and systems
  • Any other purpose permitted or required by applicable law

We will not process personal data for purposes that are incompatible with the purposes communicated to you unless permitted by applicable law or where another valid legal basis applies.

5. Legal Basis for Processing

Depending on the nature and purpose of the processing, we may rely on one or more lawful bases permitted under the Saudi Personal Data Protection Law, including:

  • Your consent
  • Processing necessary to fulfill a contract or take steps at your request before entering into a contract
  • Compliance with a legal obligation
  • Protecting vital interests where applicable
  • Achieving a legitimate interest where permitted under applicable law and where such processing does not adversely affect your rights and interests
  • Other legal bases permitted under the PDPL and its Implementing Regulations

Where processing is based on consent, the relevant purpose will be clearly communicated to you and consent will be obtained in the manner required by applicable law.

Where consent is required, you may withdraw your consent in accordance with applicable law. Withdrawal of consent will not affect processing that was lawfully carried out before withdrawal or processing that relies on another lawful basis.

6. Direct Marketing

We may send you promotional and marketing communications, including by:

  • Email
  • SMS
  • Telephone
  • Push notifications
  • Other electronic communication channels

Where required by applicable law, we will obtain your prior consent before sending direct marketing communications.

Each marketing communication will identify the sender and provide a clear and easy mechanism for you to stop receiving marketing communications.

You may withdraw your marketing consent at any time, free of charge, using the unsubscribe mechanism provided in the communication or by contacting us.

Where you withdraw your consent, we will stop sending direct marketing communications without undue delay, subject to any processing that may lawfully continue for other purposes.

This approach reflects the Saudi PDPL and its Implementing Regulations regarding direct marketing.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies to provide, maintain and improve our services.

Cookies may be used for different purposes, including:

Essential / Functional Cookies

These cookies are necessary for the operation of the website and may enable functions such as:

  • Shopping cart functionality
  • Checkout
  • Account login
  • Security
  • Website navigation
  • Remembering necessary preferences

Analytics Cookies

These technologies help us understand how visitors use our website, including:

  • Which pages are visited
  • How visitors interact with the website
  • Website performance
  • Conversion and purchase activity

This information helps us improve the website and customer experience.

Preference Cookies

These cookies may remember preferences such as language, region or other website preferences where applicable.

Advertising and Marketing Cookies

Where applicable and subject to the required legal basis, these technologies may be used to:

  • Deliver relevant advertising
  • Measure advertising performance
  • Understand campaign effectiveness
  • Limit repetitive advertising
  • Build or measure advertising audiences

Third-Party Cookies

We may use technologies provided by third-party service providers, including analytics, advertising, payment, security and other technology providers.

Where cookies or similar technologies involve the processing of personal data, we will process the relevant information in accordance with applicable Saudi data protection requirements and any consent requirements that apply.

You may manage or delete cookies through your browser settings and, where provided, through our cookie-management tools.

Disabling certain cookies may affect some website functionality.

8. Who We May Share Personal Data With

We may disclose personal data, where permitted or required by applicable law, to:

  • Companies within our corporate group
  • Payment service providers
  • Delivery and logistics companies
  • Warehousing and fulfillment providers
  • Technology and hosting providers
  • Shopify and relevant technology providers
  • Customer service providers
  • Analytics providers
  • Marketing and advertising service providers
  • Professional advisers, including legal, accounting and audit advisers
  • Insurance providers where relevant
  • Government authorities and regulatory bodies where required or permitted by law
  • Law enforcement authorities where legally required
  • Other service providers necessary to provide our products and services

We require relevant service providers to process personal data appropriately and to apply appropriate safeguards in accordance with applicable law and contractual requirements.

We do not sell your personal data to third parties for their independent commercial purposes.

9. International Data Transfers

Some of our service providers, technology providers or group companies may process or store personal data inside or outside the Kingdom of Saudi Arabia.

Where personal data is transferred outside the Kingdom, we will ensure that such transfers are carried out in accordance with the applicable requirements of the Saudi Personal Data Protection Law and its Implementing Regulations, including applicable requirements and safeguards relating to international transfers.

Where appropriate, we may assess the destination, the level of protection, contractual safeguards and other relevant measures required by applicable law.

10. Data Retention

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Retention periods may depend on:

  • The nature of the data
  • The purpose for which it was collected
  • Our relationship with you
  • Legal and regulatory requirements
  • Accounting and tax requirements
  • Dispute resolution
  • Fraud prevention
  • Legal claims and obligations

When personal data is no longer required, we will take appropriate steps to delete, destroy or anonymize it in accordance with applicable law and our internal retention procedures.

11. Security of Personal Data

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, destruction or other unlawful processing.

These measures may include:

  • Access controls
  • Authentication
  • Encryption where appropriate
  • Monitoring
  • Security reviews
  • System protection measures
  • Internal controls
  • Secure payment technologies provided by authorized payment providers

However, no method of transmission or electronic storage can be guaranteed to be completely secure.

12. Your Rights

Subject to the conditions and exceptions provided under the Saudi Personal Data Protection Law, you may have rights relating to your personal data, including the right to:

  • Be informed about the purposes and legal basis for collecting and processing your personal data
  • Request access to your personal data
  • Request correction or completion of inaccurate or incomplete personal data
  • Request destruction of personal data where legally applicable
  • Request withdrawal of consent where processing is based on consent
  • Exercise other rights provided under the PDPL and its Implementing Regulations

To exercise your rights, please contact us using the contact details below.

We may need to verify your identity before responding to certain requests in order to protect your personal data and prevent unauthorized access.

13. Children

Our website is not intended for children to independently create accounts or place orders.

Where personal data relating to a child is processed, we will handle such data in accordance with applicable Saudi laws and regulations.

14. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices, security, content or policies of third-party websites.

We recommend reviewing the privacy policies of third parties before providing them with personal information.

15. Changes to This Privacy Policy

We may update this Privacy and Cookie Policy from time to time to reflect:

  • Changes to our services
  • Changes in technology
  • Changes in applicable laws or regulations
  • Changes in our data-processing practices

The latest version will be published on this page together with the applicable effective or update date.

We encourage you to review this Policy periodically.

16. Contact Us

If you have any questions, concerns or requests relating to this Privacy and Cookie Policy or your personal data, please contact us:

Mohamed Hilal Group / MHG Boutique KSA

Email: customercare.ksa@hilal.cc
Phone: +966 55 749 9599
Country: Kingdom of Saudi Arabia

We will handle privacy requests in accordance with applicable Saudi laws and regulations.