Privacy Policy.

This Privacy Policy explains how KURO collects, uses, stores, shares and protects personal data when you:

• visit or use thekurocafe.com;
• view our menu, location or other website content;
• submit feedback or contact information;
• interact with website buttons, links or embedded services; or
• communicate with KURO through the contact details displayed on the website.

For the purposes of this Privacy Policy, “KURO,” “we,” “us” and “our” refer to the KURO café brand and the party responsible for processing personal data through this website.

CR / Unified No.: 7051169048  |  VAT No.: 314121847200003
Website: thekurocafe.com  |  Email: hello@thekurocafe.com  |  Phone: 059 859 5124
Location: Midtown Plaza, Prince Abdulaziz Ibn Musaid Ibn Jalawi Street, Riyadh, Saudi Arabia

This Policy is intended to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia, its Implementing Regulations and other applicable Saudi laws and regulations.

This Privacy Policy applies to personal data processed through the KURO website and its website-based forms and tracking technologies.

It does not govern:

• information processed entirely offline at the café;
• employee or job-applicant information;
• CCTV footage;
• third-party websites, platforms or applications that have their own privacy policies; or
• information processed independently by Google, Meta, Instagram, TikTok or other third-party platforms after you leave the KURO website.

When you submit feedback, contact us or otherwise communicate with KURO, we may collect:

• your name;
• your email address;
• your phone number, when provided;
• the content of your feedback, request or communication;
• the date and time of your communication; and
• any other information that you choose to provide.

Please do not submit sensitive personal data, payment-card details, identity documents, medical information or confidential information through the website feedback form.

When you use the website, we and our approved service providers may collect:

• IP address;
• browser type and version;
• device type and operating system;
• language preference;
• approximate location derived from IP address;
• referring page or advertising source;
• pages viewed and time spent on those pages;
• dates and times of visits;
• menu categories or website sections viewed;
• interactions with buttons such as View Menu, Get Directions, Call, Email or social-media links;
• cookie identifiers and advertising identifiers;
• consent choices;
• website errors, security logs and performance information; and
• other technical information necessary to operate, secure and improve the website.

With your consent, we may use Google and Meta technologies to understand whether a website visit or action resulted from an advertisement.

This information may include:

• advertising and browser identifiers;
• campaign and referral information;
• event name and time;
• page URL;
• device and browser information;
• IP address and user-agent information; and
• interactions such as menu views, contact actions or Get Directions clicks.

KURO does not send the text of your feedback, your contact message or unnecessary customer-entered personal information to advertising platforms for targeted-advertising purposes.

We may receive limited information from third parties such as Google or Meta, including aggregated advertising performance, campaign attribution and website analytics information.

We collect personal data:

• directly from you when you complete a form or contact KURO;
• automatically through website logs, cookies, pixels and similar technologies;
• through embedded services such as Google Maps; and
• from advertising, analytics and social-media platforms where permitted by law and your consent choices.

We may use personal data to:

1. receive, investigate and respond to feedback, questions or complaints;
2. provide requested information about KURO, its menu, location and services;
3. operate and display the website correctly;
4. maintain website security and prevent misuse, fraud or technical abuse;
5. diagnose errors and improve website performance;
6. understand how visitors use the website;
7. measure the effectiveness of advertising campaigns;
8. attribute website actions to relevant advertising campaigns;
9. improve KURO’s menu, service, website and customer experience;
10. maintain records of consent and privacy preferences;
11. establish, exercise or defend legal claims; and
12. comply with legal, regulatory or governmental requirements.

KURO does not currently use feedback-form contact details for email or SMS marketing. Separate consent will be requested before introducing any direct-marketing use.

Depending on the purpose and circumstances, KURO may process personal data based on:

• your consent, including consent to analytics or advertising cookies;
• your request, where processing is needed to respond to feedback, an inquiry or another action initiated by you;
• legitimate interests permitted under Saudi law, such as securing the website, preventing misuse, maintaining necessary technical logs and improving services, provided those interests do not override your rights;
• compliance with legal obligations; or
• the establishment, exercise or defence of legal claims.

You may withdraw consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn or processing supported by another lawful basis.

KURO uses cookies and similar technologies for website operation, preferences, analytics, advertising measurement and embedded content.

Strictly necessary technologies may operate without optional consent where required to provide the website or remember your privacy choices.

Analytics, advertising and other non-essential technologies will be used only after you provide the relevant consent through the cookie banner or Cookie Settings panel.

More information is available in the KURO Cookie Policy.

KURO does not sell or rent personal data.

We may disclose limited personal data to:

• website hosting, cloud, database and security providers;
• website developers and technical-support providers;
• Google, where Google Analytics, Google Ads, Google Tag Manager or Google Maps are enabled;
• Meta, where Meta Pixel or Conversions API measurement is enabled;
• email and customer-support service providers;
• professional advisers, auditors or insurers;
• government, regulatory or law-enforcement authorities when legally required; and
• another party involved in a lawful business restructuring, subject to appropriate confidentiality and data-protection safeguards.

Service providers may process data only for authorised purposes and subject to appropriate contractual, security and confidentiality requirements.

Some third-party providers may also process information under their own privacy terms when acting independently.

Some technology providers used by the website may process or store personal data outside the Kingdom of Saudi Arabia.

Where personal data is transferred or made accessible outside Saudi Arabia, KURO will take reasonable steps to ensure that the transfer is made in accordance with applicable Saudi data-transfer requirements and that appropriate safeguards are used.

KURO retains personal data only for as long as reasonably necessary for the purpose for which it was collected.

Unless a longer period is required by law, a dispute or a legal claim, the intended retention periods are:

• feedback and contact-form data: up to 24 months after the last relevant interaction;
• general customer communications: up to 24 months;
• website security and technical logs: up to 12 months;
• KURO-controlled analytics data: up to 14 months;
• cookie-consent and preference records: up to 24 months; and
• legal or regulatory records: for the period required by applicable law.

Third-party platforms may apply their own retention periods as described in their privacy policies.

When personal data is no longer needed, it will be deleted, anonymised or securely destroyed, subject to lawful retention requirements.

KURO applies reasonable administrative, technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful use or disclosure;
• accidental loss;
• alteration;
• destruction; and
• other personal-data breaches.

These measures may include access controls, secure connections, encryption where appropriate, restricted permissions and review of website users and service providers.

No internet transmission or storage system can be guaranteed to be completely secure.

Subject to the conditions and exceptions under applicable Saudi law, you may have the right to:

1. be informed about the collection and use of your personal data;
2. access personal data held about you;
3. request a clear and readable copy of your personal data;
4. request correction, completion or updating of inaccurate or incomplete data;
5. request destruction of personal data where the legal requirements are satisfied;
6. withdraw consent where processing is based on consent; and
7. submit a complaint concerning the processing of your personal data.

To exercise a right, email hello@thekurocafe.com using the subject line “Privacy Request”. Your request should explain the right you wish to exercise and provide enough information for KURO to verify your identity and locate the relevant data.

KURO will normally respond without undue delay and within 30 days. Where permitted by law and the request requires unusual effort or involves multiple requests, this period may be extended by an additional 30 days, and you will be informed of the reason.

Requests are generally processed without charge unless applicable law permits otherwise.

Privacy concerns should first be submitted to hello@thekurocafe.com using the subject “Privacy Complaint”.

You may also submit a complaint to the Saudi Data and Artificial Intelligence Authority through the National Data Governance Platform where you believe your rights under the Saudi Personal Data Protection Law have been violated.

The website is intended for a general audience and is not designed to collect personal data from children.

Persons under 18 should not submit personal data without the involvement of a parent or legal guardian.

Where KURO learns that personal data was submitted by a child without appropriate authorisation, KURO will take reasonable steps to delete it.

The website may contain links to or content from Google Maps, Google Business Profile, Instagram, TikTok, Meta and other third-party services.

Those third parties may collect information independently under their own privacy policies. KURO is not responsible for the privacy practices of third-party websites or platforms.

KURO may update this Privacy Policy when its website, services, technologies or legal obligations change.

The revised version will be posted on this page with an updated “Last updated” date. Material changes may also be communicated through a website notice.

Questions about this Privacy Policy or KURO’s handling of personal data may be sent to: