Privacy policy

• Account data — names, business email addresses, phone numbers, job titles and roles of the people your company adds to its team.
• Company data — company name, delivery addresses, trade licence, TRN and the documents you submit when applying for a trade account or credit terms.
• Transaction data — orders, invoices, credit usage and payment history.
• Payment data — held by our payment provider, Stripe. We store only a reference to the saved card (brand, last four digits, expiry); full card numbers never reach our systems.
• Usage data — first-party telemetry from the Platform: page events, performance measurements and error reports, tied to your session. We do not use third-party advertising trackers.

• To run the service — process orders, arrange delivery, invoice, manage credit and respond to support requests.
• To keep accounts secure — authentication, session management, and audit logs of security-relevant actions (sign-ins, role changes, order approvals).
• To improve the Platform — aggregated, first-party analytics on how it is used and where it fails.
• To meet legal obligations — UAE tax and commercial record-keeping.

We do not sell data. We share it only with service providers who process it for us — payment processing (Stripe), hosting and delivery of the website (Vercel), and our business management system (Odoo) — and with authorities where the law requires. Each provider is bound to use the data only to provide its service.

Signing in sets one strictly-necessary session cookie. It keeps you signed in and is removed when your session ends or is revoked. We use no third-party advertising or cross-site tracking cookies.

Transaction records (orders, invoices, credit history) are kept for as long as UAE tax and commercial law requires. Account data is kept while your company’s account is active; suspended or closed accounts are retained only as needed for audit and legal purposes.

Data is encrypted in transit. Access inside Suma Gourmet is role-based and each company’s data is isolated — your team can only ever see your own company’s records. Sessions are individually revocable, and security-relevant actions are logged.

Your company administrator can view and correct most account data directly. For anything else — access, correction, or deletion requests (subject to the retention rules above) — contact your account manager or customercare@sumagourmet.com. We answer within a reasonable time and in line with applicable UAE data protection law.

We may update this policy from time to time. The date above shows the current version; material changes will be notified through the Platform or by email.