Privacy Policy for Menu & Directory Visitors

1. Who we are

• BidLX is a restaurant management platform owned and operated by BIDLX SOLUTIONS SDN. BHD., a private limited company registered in Malaysia ("BidLX", "we", "us").
• We are the data controller (Data User under the Malaysian PDPA / Controller under the Saudi PDPL) for the data described in this policy.
• Data Protection Officer: reachable at support@bidlx.com with the subject "Data Protection".

2. Our role and the restaurant's role

• The menu, prices, photos and contact details you see are owned and managed by the restaurant, which is responsible for their accuracy. We provide the technical platform they are displayed on.
• If you order, book or pay a deposit with the restaurant, it may record your name and phone number in its system. The restaurant is then the controller of that data and we process it on its behalf only. You may exercise your rights over it with the restaurant or through us.

3. Accuracy of information and our liability

• Prices and items are shown as provided by the restaurant or taken from publicly available sources, and may change at any time without notice. The price that applies is the restaurant's price at the time of ordering. We recommend contacting the restaurant directly by the phone or WhatsApp number on its page to confirm the current price and availability before ordering.
• Photos are for illustration only; the actual dish may differ in appearance or portion size.
• Calories and ingredients shown are estimates based on what the restaurant provides. Anyone with a food allergy or special health condition should confirm with the restaurant directly before ordering.
• Opening hours shown are indicative and may change during holidays and special occasions; please confirm with the restaurant.
• BidLX is a menu display platform only and is not a party to any order or sale between the customer and the restaurant. BidLX is not responsible for prices, food quality or service; the restaurant is the reference for these.

4. Data we collect and its source

• We do not ask for any personal data to browse menus or the directory, and you do not need an account.
• A random anonymous identifier generated and stored in your browser. It contains no name or number and does not identify you.
• Browsing events on a restaurant page: opening the page, viewing an item, tapping the phone, map, website or social links, and sharing, with the time and branch concerned.
• Technical data logged automatically by our hosting provider: IP address, browser and device type, request time and requested page.
• This data comes directly from your browser and device. You are not required to provide it actively, and you can block the anonymous identifier by clearing local storage in your browser settings without affecting browsing.

5. Purposes and legal basis

• Displaying menus and directory pages, running the site and protecting it from abuse and attacks — based on our legitimate interest in providing a secure service.
• Giving the restaurant aggregated statistics on its page visits and clicks, with nothing that identifies you — based on the legitimate interest of the restaurant and us in improving the service.
• We do not use this data for advertising or to build a profile about you.

6. Disclosure

• Restaurants see aggregated figures only. Hosting providers process technical data on our behalf. We disclose data to no one else unless required by law or by order of a competent authority.
• Map, social media and WhatsApp links on restaurant pages take you to external services governed by their own policies.

7. Retention

We keep browsing events while the restaurant page exists in order to show its statistics, and delete them when the restaurant is deleted. Technical logs are kept by the hosting provider for a limited period for security and then deleted automatically.

8. Your rights

• Right to be informed: to know what we collect about you and why, as set out in this policy.
• Right of access and to obtain a copy of your data.
• Right to correct or update inaccurate or incomplete data.
• Right to request deletion or destruction of your data once it is no longer needed, unless the law requires us to keep it.
• Right to data portability: to receive your data in a structured, commonly used format, or have it transmitted to another party where technically feasible.
• Right to withdraw consent at any time where processing is based on consent, without affecting prior processing.
• Right to object to or restrict processing, and to prevent processing for direct marketing.
• We respond within the statutory periods: 21 days under Malaysian law and 30 days under Saudi law, and may verify your identity first. Requests are free; we may decline repetitive or manifestly unreasonable requests where the law allows.

9. Complaints to the regulator

Please contact us first at support@bidlx.com so we can resolve any concern. You may in any case lodge a complaint with the competent regulator: the Personal Data Protection Commissioner of Malaysia (JPDP), the Saudi Data & AI Authority (SDAIA) if you are in Saudi Arabia, or the competent authority in your country.

10. International transfers

• We host the service with technical providers whose servers may be located outside Malaysia, Saudi Arabia or your country. We transfer data only to parties offering an adequate level of protection, under binding contractual safeguards, and only as necessary to provide the service, in compliance with the transfer requirements of Malaysian law, the Saudi PDPL and its regulation on transferring data outside the Kingdom.
• Our main providers are currently Supabase Inc. (database, authentication and file storage), Vercel Inc. (website hosting) and Stripe (payment processing for restaurant subscriptions). We update this list when it changes.

11. Security and breach notification

• We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including encryption in transit, irreversible password hashing, isolating each restaurant's data through database security rules, limiting each user to their permissions, and restricting our staff's access to what each task requires.
• No system is absolutely secure. If a breach likely to cause harm occurs, we notify the competent regulator within 72 hours of becoming aware of it and notify affected individuals without undue delay where the law requires, explaining what happened, the measures taken and what they can do to protect themselves.

12. Children

BidLX account services (restaurants, staff and jobs) are intended for people aged 18 or over. We do not knowingly collect personal data from anyone younger, and will delete it if we become aware of it.

13. No sale of data, no automated decisions

We do not sell, rent or share personal data with advertisers, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

14. Changes to this document

We may update this document as our services evolve or laws change, and show the last-updated date at the top of the page. For material changes we notify account holders by email or in the system a reasonable time before they take effect, and ask for fresh consent where the law requires.

15. Language

This document is available in Arabic and English. In case of any difference in interpretation the English version prevails, unless a mandatory law requires otherwise.

16. Contact us

BIDLX SOLUTIONS SDN. BHD. — Email: support@bidlx.com, for any question or request about your data or this document.