Scope & Controller Identity
This Privacy Policy applies to the services, applications, websites, and APIs operated by TableGreet LLC ("TableGreet", "we", "us") for venues and dining guests across the Kingdom of Saudi Arabia ("KSA"), governed by the Saudi Personal Data Protection Law (PDPL) issued by Royal Decree No. (M/19) as amended.
TableGreet LLC — KSA Data Protection Office
Email: privacy@tablegreet.com
Data Protection Officer: dpo@tablegreet.com
Information We Process
We process account credentials, venue menu data, subscription billing records, and technical telemetry in strict compliance with PDPL data minimisation mandates.
Guest & Diner Data Notice
When dining guests scan QR codes in Saudi Arabia, we collect minimal technical telemetry without building behavioral profiles. For full disclosures on table ordering, reservations, and loyalty, see our dedicated Diner Privacy Policy (Section 08) below.
Legal Bases for Processing (Saudi PDPL)
- Contractual Necessity: Delivering SaaS subscription services and digital menu hosting.
- Explicit Consent: Voluntary enrollment in loyalty programs or marketing notifications.
- Legitimate Interests: Defending network security and preventing QR tampering.
- Statutory Obligation: Complying with ZATCA tax invoicing rules and regulatory directives.
Cybersecurity & Encryption Standards
We apply robust technical and administrative safeguards, including TLS 1.3 in transit and AES-256 at rest, database multi-tenant isolation, and automated security monitoring in line with National Cybersecurity Authority (NCA) frameworks.
Your Statutory Rights (Saudi PDPL)
Right to be Informed
Know the legal basis and purpose of personal data processing.
Right to Access
Review or obtain a legible copy of your processed personal data.
Right to Correction
Request correction or updating of incomplete or inaccurate data.
Right to Destruction
Request permanent deletion of data when purpose concludes.
To exercise statutory rights, contact privacy@tablegreet.com.
Cross-Border Data Transfers
Data transfers outside KSA strictly adhere to the Saudi PDPL transfer regulations and SDAIA guidelines, ensuring equivalent standards of data protection and security encryption.
Supervisory Authority & Escalations
If you believe that your personal data has been handled inconsistently with the PDPL, you may file a complaint with the Saudi Data and AI Authority (SDAIA) via sdaia.gov.sa.
Diner Privacy Policy (Saudi Arabia)
A. Scope & Controller Responsibilities
This section governs personal data of restaurant diners and guests ("Diners") interacting with TableGreet digital menus in Saudi Arabia. TableGreet acts as a data processor for on-premise tableside orders and waiter calls on behalf of the venue, and as an independent data controller for platform security and direct support requests.
B. Data Collected from Diners
- Menu Browsing: Coarse country-level IP geolocation, browser language, device type. No personal profiling.
- Tableside Orders: Assigned table number, ordered dishes, item notes, ephemeral session token. Local browser storage tokens purge after 12 hours.
- Reservations & Loyalty: Guest name and mobile number voluntarily submitted for reservations or loyalty rewards.
C. Privacy Rights & Contacts
Diners in KSA enjoy full rights of access, correction, and destruction under the Saudi PDPL. Inquiries may be submitted directly to privacy@tablegreet.com.