Privacy Policy for a Salla Store: What PDPL Requires and Where It Goes

Every Salla store needs a privacy policy page, and under Saudi Arabia's Personal Data Protection Law (PDPL) that page has to describe your store as it actually runs: the data you collect when customers register and order, the companies that receive it, the marketing tools you connect, and the cookies those tools set. Salla gives you the page and the place to put it. The content is yours, because as the merchant you are the controller of your customers' data.

This guide covers what a Salla store's policy should say, section by section, where it goes in the Salla dashboard, and a suggested structure for its headings. It is a practical guide, not legal advice: have a lawyer review your final text, especially if you sell sensitive products or send data outside Saudi Arabia.

The law is being enforced: SDAIA confirmed 48 enforcement decisions in its January 2026 announcement. A policy that matches what your store really does is the first thing you can point to when a customer or the regulator asks about their data.

For the law itself, including consent for cookies, see Saudi PDPL and cookie consent.

Where does the privacy policy go in the Salla dashboard?

In Salla, the privacy policy is one of your store pages (الصفحات التعريفية). Salla's help centre, in an article last updated on 31 August 2026, gives these steps; the menu names below are quoted from the Arabic help centre:

• From the main menu, open Store & Sales Channels (المتجر وقنوات البيع), then Pages (الصفحات التعريفية).
• Click New page (صفحة جديدة).
• Enter the page title and choose the page type Terms of Use & Privacy (سياسة الاستخدام والخصوصية). Salla fills the content with a starter draft for you to edit.
• Write or paste your policy, create the page, and check that it is active rather than a draft.

Salla also offers an HTML Code page type, but its help centre lists the Pro or Special plan and your own domain as requirements for it; on other plans, paste the policy as text into the privacy page type. Whichever type you use, make sure customers can reach the page from your store footer. Salla's starter draft is a starting point: read it against the sections below and add what it cannot know about your own store.

Who collects what in a Salla store?

You are the controller, and several companies handle data on your behalf. Salla's own help article on the PDPL describes the merchant who has access to customers' data as the controller (جهة التحكم). Your policy should name each party that receives customer data and say what it receives:

Name them. “We may share your data with third parties” tells a customer nothing; “we share your address with the shipping company that delivers your order” does. Each time you install an app or connect a new pixel, update the policy.

What does Salla's registration notice cover, and what doesn't it?

Salla already shows your policy at one point. According to its help centre (updated 29 August 2026), when a customer creates an account, the registration window says that completing registration counts as accepting the store's privacy policy, with a link to read it. The same form has an option to subscribe to promotional messages, which is ticked by default; the customer can untick it, and can switch messages on or off later from their account settings.

That notice reaches customers who create an account. A visitor who browses without registering never sees it, yet the analytics and advertising tags you connected can load from their first page view and set cookies. Your privacy policy explains that tracking; it does not ask permission for it. Asking before non-essential cookies run is the job of a cookie consent banner.

To find out whether your Salla store needs a banner and what it has to do, read the Salla cookie consent guide.

What must a Salla store's privacy policy cover under PDPL?

Enough for a customer to know who holds their data, what it is used for, who else receives it, how long it is kept and how to exercise their rights. For a Salla store, that means:

• Who you are: the store's legal or trading name, your commercial registration if you have one, and a contact for privacy requests.
• What you collect: account details, order and delivery details, payment status, messages to customer service, reviews, and what cookies and pixels collect while visitors browse.
• Why: each purpose on its own, from fulfilling and delivering orders to customer service, promotional messages for those who subscribed, measuring the store, and advertising.
• Who receives it: Salla, your payment provider, your shipping companies, your marketing and analytics tools and the apps you installed, by name.
• Cookies: the categories you use and how a visitor changes their choice, with a link to a separate cookie policy.
• Promotional messages: how customers subscribe, and how they unsubscribe from their account settings.
• How long you keep it: a period or a rule for each kind of data, for example keeping orders for as long as accounting and tax rules require.
• Transfers outside Saudi Arabia: whether any of your tools process data abroad, and which ones.
• Rights: the rights of the data subject and how to use them (see the section on rights below).
• Complaints: that customers can contact you first, and that SDAIA is the authority that receives complaints under the PDPL.
• Last updated: the date of the current version.

How should the policy cover cookies?

On most stores, much of the data collection happens through cookies: Google Analytics, Meta Pixel and the Snapchat and TikTok pixels all set cookies or similar identifiers. Keep this part of the privacy policy short: name the categories you use (necessary, analytics, marketing, preferences) and explain how a visitor gives, refuses or withdraws consent for the non-essential ones. Leave the detail — each cookie, its provider and how long it lasts — to a separate cookie policy linked from the privacy policy.

For that separate page, start from the cookie policy template in Arabic and English, which has placeholders for your store's own cookies.

And for the banner that asks for consent, take the wording from ready-to-copy cookie banner text in Arabic and English.

Which rights of the data subject should the policy list?

The PDPL gives your customers the rights below, and Salla's help centre lists the same ones for merchants. Name each right and say how a customer uses it:

• To be informed: why their data is collected and what it is used for.
• To access the personal data you hold about them.
• To obtain a copy of their data in a clear format.
• To have their data corrected or updated so it stays accurate.
• To have their data destroyed when it is no longer needed.
• To withdraw their consent to processing at any time.

Give one channel for requests, such as an email address, say how you confirm the requester's identity, and state how long you take to reply. Say that customers can stop promotional messages from their account settings, and how they withdraw consent to cookies.

An example structure for a Salla store's privacy policy

These headings are a skeleton, not legal text. Fill each one with what is true for your store:

• Who we are and how to contact us
• The data we collect: when you register, place an order, contact us or browse the store
• Why we use your data
• Who we share it with: Salla, payment, shipping, marketing and analytics tools, apps
• Cookies and similar technologies, with a link to the cookie policy
• Promotional messages and how to unsubscribe
• How long we keep your data
• Transfers outside the Kingdom
• Your rights and how to use them
• Complaints
• Changes to this policy and the date of the last update

So you don't start from a blank page, the free privacy policy generator builds a policy from a short wizard: your store's details, the data you collect, your payment, shipping, marketing and analytics providers, and an email for rights requests. It writes the policy in Arabic, English or both, and gives you a hosted link, kept for 90 days, plus HTML you can copy. On Salla, paste the text into your privacy page (or the HTML, if your plan includes the HTML Code page type), then check it against the sections above.

Start here: a privacy policy template for your store, free and bilingual.

If you would rather have an app inside your Salla dashboard handle the banner side, see Arqam360 for Salla.

Sources