Bait Al Mahashi

Privacy Policy

What we collect, why, who we share it with, how long we keep it, and how you control it.

Effective from
Last updated

This page explains how we handle your personal data when you use the Bait Al Mahashi website or order from us. We comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

Who we are

BAIT AL MAHASHI Restaurant, an establishment registered in the Emirate of Ras Al Khaimah, United Arab Emirates, Trade License 18534. "We" and "us" on this page mean that establishment; "you" means the user of this website.

Google sign-in only

Our website has no password-based registration. The only way to create or access an account is "Sign in with Google". When you do, Google sends us your name and email address only. We never see your Google password and we hold no password for you at all.

You may also order as a guest without an account; in that case we collect only what is needed to prepare and deliver your order.

Data we collect

  • Account data: the name and email address from the Google account you chose.

  • Contact and delivery data: the phone number and delivery address you enter.

  • Order data: your items, order value, branch, time and status.

  • Payment data: the outcome only (succeeded or failed), the amount, and the gateway's reference.

  • Optional preferences: your preferred language, and your marketing consent if you give it.

What we do not collect

  • We store no card data whatsoever - no card number, no expiry, no security code, not even the last four digits. You enter those directly with a licensed online payment gateway; they never pass through our systems at any point.

  • We do not ask for your Emirates ID, passport, or any official document.

  • We do not sell your data. We may share specific data with advertising platforms after your consent, for the purposes set out in our Cookie Policy.

Why we use your data

  • To prepare your order and deliver it to the right address.

  • To contact you about your order (confirmation, delay, delivery problem).

  • To issue your tax invoice as required by UAE VAT law.

  • For customer service when you call or message us on WhatsApp.

Who we share it with

  • The delivery company: for delivery orders we share your name, phone number, address and order contents with the courier fulfilling it - for delivery only.

  • The payment gateway: receives your payment details directly from you and returns only the transaction outcome to us.

  • Authorities: where we are under a legal obligation, such as the Federal Tax Authority.

We may share necessary data with service providers who help us operate the site, fulfill orders, process payments, deliver, and provide analytics and advertising. Depending on the services enabled and your consent, these providers include delivery companies, payment gateways, analytics providers, and advertising platforms such as Google and Meta. We will not use data for consent-based advertising purposes without your appropriate consent.

International data transfers

Our systems are hosted with international cloud providers whose data centres are outside the UAE, so your account and order data is stored and processed outside the country. This transfer is necessary to fulfil your order and to operate the service you asked us for; we cannot provide it otherwise.

Separately, and only with your consent, hashed identifiers and measurement data are sent to the advertising platforms we use, which run their infrastructure in the United States and other countries. That transfer rests on your explicit consent, and withdrawing it in the Privacy Centre stops it immediately without affecting your ability to order.

The payment gateway receives your payment details directly from you and processes them under its own policy, which may be outside the UAE depending on the provider in use.

Retention

We do not keep your personal data longer than is necessary for the purpose it was collected for. In practice:

  • Your personal data (name, phone, email, addresses): deleted automatically 12 months after your most recent order. No action is required from you.

  • The order record: retained for our accounting records, but after the twelve months it is stripped of your identity - no name, phone or address remains on it, only the amount, date and items.

  • The tax invoice: retained exactly as issued - including your name - for five years, as required by Cabinet Decision No. 74 of 2023 on Tax Procedures. An invoice is an issued accounting document; altering it after the fact is not permissible, because it would destroy the evidential value of the books in an audit. This is an express exception to the right to erasure under Article 15 of the Personal Data Protection Law, which applies where erasure conflicts with other legislation binding on the controller.

  • Proof of your consents: we keep a record of your marketing consent and your tracking consent, together with the time you gave it and the version of the policy that was published at that moment. The record survives your withdrawal, because it is the evidence that we only ever acted with your permission.

  • Loyalty balance or gift card: retained while an unspent balance exists.

We chose twelve months rather than a shorter window because a card payment can be disputed months after the order, and we cannot defend your order - or your rights - if we have already erased its record.

Your rights

At any time you may ask to access, correct, delete, restrict or object to the processing of your data, receive a copy of it, or withdraw your marketing consent. Email support@baitalmahashi.ae or call us, and we will respond within 30 days.

Security

The entire site runs over an encrypted connection (HTTPS), and access to customer data is limited to staff who need it to do their job.

Children

Our services are intended for people aged 18 and over. We do not knowingly collect data from anyone younger, and we delete it immediately if we learn we have.

Changes to this policy

We may update this page; the effective date and version number are shown at the top. An update does not retroactively change what you agreed to: your tracking consent is recorded against the version of this policy that was published when you gave it, and you can review or withdraw it at any time in the Privacy Centre.

How to reach us