Privacy Policy
CasaPasta ("we", "us", or "our"), operated by AFCO, respects your privacy and is committed to protecting your personal data in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its implementing regulations.
This Privacy Policy explains what personal data we collect, how we use it, the legal bases for processing, and the rights you have over your data.
Who we are
CasaPasta is a Saudi pasta restaurant brand operated by AFCO. AFCO acts as the data controller responsible for the personal data processed through this website. You can reach us through the channels listed on our Contact page.
Information we collect
- Information you provide directly, such as your name, contact details, and any message you send through our contact form.
- Technical and usage information collected automatically, such as device type, browser, approximate region, pages viewed, and interactions — gathered through our own first-party analytics.
- Cookie and consent preferences you set through our cookie banner.
We do not knowingly collect payment card data through this website, and we do not sell your personal data.
How we use your information
- To respond to your enquiries and provide customer support.
- To operate, maintain, and improve the website and our menu information.
- To understand, in aggregate, how the website is used so we can improve it.
- To comply with legal and regulatory obligations.
Legal basis for processing (PDPL)
We process your personal data on one or more of the following bases: your consent; the performance of a service you requested; our legitimate interests in operating and improving the website; and compliance with applicable laws.
Cookies and analytics
We use a first-party, privacy-respecting analytics system and a granular cookie-consent tool. Non-essential cookies and analytics are not activated until you give consent. For full detail, see our Cookie Policy.
Sharing and disclosure
We may share personal data with trusted service providers who process it on our behalf under appropriate safeguards, and with competent authorities where required by law. We do not share your data for third-party advertising without your consent.
Data retention
We keep personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law, after which it is securely deleted or anonymised.
Your rights under PDPL
Subject to applicable law, you have the right to:
- Be informed about how your personal data is processed.
- Access your personal data and request a copy.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data where permitted.
- Withdraw consent at any time, without affecting prior lawful processing.
To exercise any of these rights, contact us through our Contact page. You also have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia.
Data security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.
International transfers
Where personal data is transferred outside the Kingdom of Saudi Arabia, we do so only in accordance with the PDPL and its implementing regulations and with appropriate safeguards in place.
Children's privacy
This website is not directed at children, and we do not knowingly collect personal data from children without appropriate consent.
Changes to this policy
We may update this Privacy Policy from time to time. The effective date below indicates the latest version. Material changes will be reflected here.
Contact us
For any privacy questions or to exercise your rights, please reach us through our Contact page.