Cartfinch Back to site

Legal

Privacy Policy

Last updated: 7 November 2026

This Privacy Policy explains how Cartfinch (“Cartfinch”, “we”, “us”) collects, uses and protects personal data when you visit cartfinch.com, contact us, or use the Cartfinch grocery platform. We aim to comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, other GCC data-protection laws and the GDPR.

1. Two different roles

We handle personal data in two ways, and it matters which one applies to you:

  • Website visitors and prospects. When you browse our website or contact us, we decide why and how your data is used. We are the “controller” of that data. Sections 2 to 9 cover this.
  • Customers of grocery businesses using Cartfinch. When a grocery business uses our platform, its shoppers’ data belongs to that business. We process it only on the business’s behalf as its “processor”. Section 10 covers this.

2. What we collect

Information you give us

When you submit our contact form or message us, we collect your name, work email, company name, phone number (optional), number of branches, interested plan, and anything you write in your message. If you contact us on WhatsApp, we receive your phone number, profile name and the content of your messages.

Information collected automatically

Our hosting provider and the services that deliver our pages may process technical data such as your IP address, browser type, device, pages requested and timestamps. We do not currently use analytics tools, advertising trackers or marketing cookies on this website. If that changes, we will update this policy and ask for consent where the law requires it.

3. How we use your information

  • To respond to your enquiry, arrange a demo and provide a quote.
  • To manage the business relationship if you become a customer.
  • To keep our website secure, prevent spam and abuse, and fix technical problems.
  • To meet legal, accounting and regulatory obligations.

Our legal bases are your consent (for example when you send us a message), steps taken at your request before entering into a contract, our legitimate interests in running and securing our business, and compliance with legal obligations. We do not sell your personal data and we do not use it for automated decision-making.

4. Who we share it with

We share personal data only with service providers that help us operate, under appropriate confidentiality and data-protection terms:

  • Web3Forms receives and forwards contact-form submissions to our email.
  • Our email and communication providers, including WhatsApp (Meta), if you contact us through them.
  • GitHub Pages hosts this website and may process technical request data.
  • Google Fonts serves the typefaces used on this site, which means your IP address is sent to Google when the page loads.
  • Professional advisers, regulators or authorities where we are legally required to disclose information.

5. International transfers

Some of the providers above are based outside the UAE and the GCC, so your data may be processed in other countries. Where we transfer personal data abroad, we take steps to ensure it remains protected as required by applicable law.

6. How long we keep it

We keep enquiry details for as long as needed to respond and for up to 24 months after our last contact, unless you become a customer, in which case we keep records for the duration of the relationship and as long as the law requires afterwards. We then delete or anonymise them.

7. Security

We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and limiting access to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to our use of it, receive a copy in a portable format, and withdraw consent at any time. To exercise any of these rights, email ceo@cartfinch.com. We will respond within the time required by law. You can also complain to your local data-protection authority.

9. Cookies

This website does not set advertising or analytics cookies. Your browser may store technical data needed to display the page. You can control or clear stored data in your browser settings.

10. Customer data on the Cartfinch platform

If you run a grocery business on Cartfinch, you own all of your customer data: your shoppers’ accounts, orders, addresses, delivery details and sales records. We act as your processor and:

  • process that data only to provide, secure and support the platform, following your documented instructions;
  • never sell it, use it for advertising, or use it to market to your customers;
  • keep it confidential and limit access to authorised staff;
  • use sub-processors (such as hosting and infrastructure providers) under written data-protection terms, and tell you about material changes on request;
  • help you respond to requests from your customers about their data;
  • notify you without undue delay if we become aware of a personal-data breach affecting your data;
  • return or delete your data when your agreement ends, as set out in your agreement with us.

You are responsible for your own privacy notice to your shoppers and for having a lawful basis to process their data. A separate data-processing agreement can be provided on request.

11. Children

Our website and services are intended for businesses. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date above shows when it last changed, and we will take reasonable steps to tell you about significant changes.

13. Contact us

Questions about this policy or your data? Email ceo@cartfinch.com or message us on WhatsApp at +971 58 109 3258.