Ghada Tourism

Privacy Policy

Privacy Policy & Personal Data Protection

Ghada Tourism Agency is committed to the highest standards of personal data protection and confidentiality in accordance with the Personal Data Protection Law (PDPL) issued by Royal Decree No. M/147 and the executive regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

1. Legal Definitions and Scope

Personal Data: Any statement — regardless of its source or form — that may lead to the identification of an individual specifically, or makes identification possible directly or indirectly.

Processing: Any operation performed on personal data by any means, such as collection, recording, storage, modification, sharing, or destruction.

Controller: Ghada Tourism Agency, the entity that determines the purpose and manner of personal data processing.

2. Legal Basis and Lawfulness of Processing

The Agency bases its processing of customer personal data on clear and specific legal grounds under Article Six of the Personal Data Protection Law, namely:

Explicit Consent: The customer's consent granted through our platforms when creating an account or completing a booking.

Contractual Obligation: The necessity of processing data to issue bookings, tickets, and deliver the agreed services.

Regulatory Obligation: Compliance with tax regulations (Zakat, Tax and Customs Authority) and the security requirements of the Ministry of Tourism and security authorities.

3. Categories of Personal Data Collected

Identity Data: Full four-part name, nationality, national ID number for citizens, residency number for residents, and passport number with issue and expiry dates.

Contact Data: Verified mobile number, active email address, and actual residential address inside or outside the Kingdom.

Encrypted Financial Data: Credit card or bank account information (processed through a secure PCI-DSS-compliant payment gateway; PIN numbers are never stored on Agency servers).

Sensitive & Travel-Specific Data: Health-related data (e.g., wheelchair seat or special medical care requests), dietary requirements, and data of accompanying children and infants.

Automatic Technical Data: IP address, approximate geographic location, operating system and browser type, and browsing logs on the platform.

4. Exclusive Purposes of Data Processing

Personal data is collected and processed exclusively for the following specified purposes:

  • Executing bookings and issuing tickets, hotel vouchers and transport in cooperation with actual service providers.
  • Managing and following up tourist and international visa applications with embassies and consular authorities.
  • Identity verification and prevention of electronic financial fraud.
  • Immediate communication to notify customers of any modification, delay, or cancellation to their trip or booking.
  • Regulatory compliance, financial accounting, and issuance of electronic tax invoices compliant with the Kingdom's e-invoicing system.

5. Restrictions on Data Disclosure and Sharing with Third Parties

The Agency maintains data confidentiality and data is never sold or leaked. Disclosure and sharing is limited to the following regulatory cases:

Actual Service Providers: Airlines, hotels, transport companies, and domestic and international tour operators, solely to the extent strictly necessary to execute the booked service.

Government and Judicial Authorities: When a formal or judicial order requiring disclosure is received, or to comply with requirements of the Ministry of Tourism, Ministry of Interior, and Zakat, Tax and Customs Authority.

6. Data Security Measures and Storage Location

Ghada Tourism Agency stores customer data on secure, protected servers within the Kingdom of Saudi Arabia and applies advanced encryption protocols (SSL/TLS) with strict access restrictions so that only the employee responsible for processing the booking may access it. The Agency is committed to immediately notifying regulatory authorities (SDAIA) and the customer in the event of any security breach or data leak within the legally prescribed periods.

7. Data Subject Rights and Their Exercise

Under the law, the customer may exercise the following rights by contacting the Agency's Legal Department at the official data protection email address:

  • Right to Know: The legal basis and purpose of collecting and processing their data.
  • Right of Access: Obtaining a copy of their personal data stored with us in a clear and readable format.
  • Right to Rectification: Requesting the correction or update of any inaccurate or incomplete data immediately.
  • Right to Erasure: Requesting deletion of their personal data after the contractual purpose has ended, unless tax or tourism laws require the Agency to retain it for specified periods.
  • Right to Withdraw Consent: Revoking previous consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal.
Privacy Policy — Ghada Tourism | Ghada Tourism