Privacy Policy.

We are committed to protecting the privacy of your personal data to the highest international standards, including Europe's General Data Protection Regulation (GDPR) and Saudi Arabia's Personal Data Protection Law.

This policy explains with full transparency how we collect your data, what we do with it, and who is allowed to access it. By using our services, you acknowledge that you have read this policy and agree to its terms.

We collect two types of data:

• Data you provide: name, email, mobile number, billing address, and payment details.
• Data collected automatically: IP address, browser type, device, pages you visited, and time spent on each page.

We never request sensitive data (religion, health, political affiliation) — everything we collect is necessary to deliver the service.

We use your data only for the following purposes:

• Completing purchases and activating subscriptions.
• Sending important notifications (payment confirmation, expiry, security alerts).
• Providing technical support when you request it.
• Improving the site experience by analyzing usage patterns (anonymized).
• Complying with our legal and tax obligations.

We will not use your data for marketing purposes without your explicit consent. You can unsubscribe from the newsletter at any time.

We use 3 types of cookies:

• Essential cookies: to keep your session active; these cannot be disabled.
• Analytics cookies: Google Analytics to understand how visitors use the site. Their data is aggregated and anonymized.
• Preference cookies: to remember your language, currency, and settings.

You can disable cookies in your browser settings, but this may affect some features (cart memory, auto login).

We never sell your data. We share it only with:

• Payment providers (Stripe, STC Pay, Apple) — to complete purchases.
• Infrastructure providers (AWS, Cloudflare) — to host and protect the site.
• Government authorities — only upon an official legal request.

All of these are bound by confidentiality and data-processing agreements that meet GDPR standards.

We apply multiple security measures:

• 256-bit SSL/TLS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Two-factor authentication for all technical team members.
• Periodic security audits by accredited third parties.
• We do not store payment-card data on our servers — only tokenization is used.

We retain your data for the duration of your activity on the platform, plus an additional 12 months after closure for tax obligations. After that, it is fully deleted.

Under data-protection law, you have the right to:

• Access: request a copy of all the data we hold about you.
• Rectification: correct any inaccurate data.
• Erasure: request full deletion of your data ("the right to be forgotten").
• Restriction: stop our use of certain data without deleting it.
• Portability: obtain your data in a portable format for another party.
• Objection: refuse the processing of your data for marketing purposes.

To exercise any of these rights, contact us via the contact form or at privacy@theme1.com.

We may update this policy from time to time in line with legal requirements or the evolution of our services. For any material change:

• We will email your registered address 30 days before the change takes effect.
• We will display a prominent "Update" badge on this page for 60 days.
• We will keep a copy of the old policy for a full year for reference.

For any inquiry, complaint, or request regarding this policy or your data, contact our Data Protection Officer (DPO):

• Email: privacy@theme1.com
• WhatsApp: +966 50 000 0000
• Postal address: P.O. Box 1234, Riyadh 11564, Saudi Arabia

We will respond to your request within 30 days at most, as required by law.