Privacy notice

This notice explains what personal data the Plum Catering website collects when you send an inquiry, and what we do with it.

It is prepared in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Last updated: 16 October 2026.

Who we are

Plum Catering is the catering brand of Advanced Food Co. (Closed Joint Stock, One Person Co.), C.R. 1010608170, 2663 Al Imam Saud Ibn Abdil Aziz Ibn Mohammed Road, Al Muhammadiah, P.O. Box 7893, Riyadh 12364. Advanced Food Co. is the controller of your personal data under the PDPL.

What we collect

Through the inquiry form:

• Name, company (optional), phone and email
• Event type, event date and number of guests
• Your message and preferred contact method

The site also records the page language, the page the form was sent from, and the date and time you ticked the consent box. The form cannot be sent without that tick.

All fields except company are required to send the form. Without them we cannot reply to your inquiry or prepare a quote.

Why we use it

To reply to your inquiry, prepare a quote and arrange your event. We do not use it for marketing unless you agree separately. We do not sell it.

We process your inquiry on the basis of your consent, given when you tick the box. We process the one-way IP code on the basis of our legitimate interest in protecting the form from spam.

Where it goes and who sees it

Your inquiry is saved in the website's admin area (WordPress) and emailed to the Plum inbox (Microsoft 365). Inside Plum, only the team handling inquiries and the website administrators have access. Our website hosting provider and Microsoft process this data on our behalf as service providers, and use it only to run the website and the inbox.

Our website server is in the United States, and Microsoft may store email outside the Kingdom. Your inquiry is therefore transferred outside the Kingdom to run the website and the inbox, under Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom.

Spam protection

Your IP address is turned into a one-way code to limit repeat sends. We keep the code for one hour, then delete it.

Cookies

We use one functional cookie, pll_language, which remembers your chosen language (English or Arabic) for one year. We use no analytics, advertising or tracking cookies.

WhatsApp and phone buttons

These buttons open WhatsApp or your phone app. Those services have their own privacy terms.

How long we keep it

We keep your inquiry for up to 24 months after our last contact with you, then delete it or make it anonymous. If your inquiry leads to a contract, the related records are kept for as long as the law requires.

Your rights

Under the PDPL you can:

• Be informed about how your data is used
• Access your data
• Request a copy of your data in a readable and clear format
• Correct, complete or update it
• Ask us to delete it
• Withdraw your consent
• Complain to the Saudi Data & AI Authority (SDAIA), through its National Data Governance Platform (dgp.sdaia.gov.sa)

You can withdraw your consent at any time by emailing [email protected]. This does not affect processing done before you withdraw.

Security

The site uses HTTPS, and access to your data is limited to staff who need it.

Contact and updates

To make a request, email [email protected]. We will reply within 30 days. If we need up to 30 more days because of the effort involved or several requests, we will tell you in advance and explain why.

We may update this notice. The date at the top shows the latest version.