PRIVACY POLICY

1 Personal Data We Collect

Depending on the nature of the services provided, we may collect and process the following categories of personal data:

1.1 Personal Identification Information

• Full name.
• National ID, residency permit (Iqama), or passport number.
• Nationality and date of birth, where required.
• Identification details required for guest registration and accommodation procedures.

1.2 Contact Information

• Mobile phone number.
• Email address.
• Residential or national address, where necessary.

1.3 Reservation and Accommodation Information

• Booking reference and arrival and departure dates.
• Room category and number of guests.
• Accommodation preferences and special requests.
• Reservation, accommodation, and service usage history.
• Customer service notes, complaints, and requests.

1.4 Financial and Payment Information

• Billing and payment information.
• Payment method used.
• Transaction details and reference numbers.
• Payment information required to complete transactions, subject to applicable security controls.

We do not store complete bank card details or confidential card verification codes on our systems where payments are processed through external payment service providers.

1.5 Technical and Website Information

• Internet Protocol (IP) address.
• Device type, browser, and operating system.
• Website usage information.
• Cookies and similar technologies.
• Website access, browsing, and interaction information.

1.6 Images and Security Recordings

Images or video recordings may be captured through CCTV cameras installed in designated public and common areas of the Hotel for security, safety, and the protection of guests and property, in accordance with applicable laws and regulations.

2 How We Collect Personal Data

We collect personal data through the following channels:

• The Hotel’s official website.
• Online reservation forms.
• Direct reservations made by telephone or email.
• Authorized online booking platforms and travel agencies.
• Guest check-in and check-out procedures.
• Communication with Hotel employees or customer service.
• Payment systems and authorized service providers.
• CCTV cameras installed in designated areas.

We may also receive certain personal data from third parties, such as booking platforms and travel agencies, in accordance with contractual arrangements and applicable regulations.

3 Purposes of Collecting and Using Personal Data

We use personal data for the following purposes:

• Processing, confirming, and managing reservations.
• Managing guest check-in and check-out.
• Providing accommodation, hospitality, and hotel services.
• Processing payments and issuing invoices.
• Communicating with customers regarding reservations, requests, and modifications.
• Handling complaints and inquiries and providing customer support.
• Improving service quality and guest experience.
• Managing promotional offers, discounts, and marketing activities where a valid legal basis and required consent exist.
• Protecting the security of the Hotel, its guests, employees, and property.
• Fulfilling legal, regulatory, and governmental requirements.
• Preventing fraud, misuse of services, and suspicious transactions.

4 Legal Basis for Processing Personal Data

Personal data is processed based on one or more lawful grounds, depending on the nature of the processing, including:

• The consent of the Personal Data Subject, where consent is legally required.
• The performance of a contract or taking steps necessary to enter into a contract, such as completing reservations and providing hotel services.
• Compliance with applicable legal and regulatory obligations.
• Legitimate interests, where permitted under applicable regulations and subject to the rights of Personal Data Subjects.
• Any other lawful basis permitted under the Personal Data Protection Law and its Implementing Regulations.

5 Sharing Personal Data with Third Parties

We may share personal data, where necessary and for specified purposes, with the following parties:

• Relevant government authorities and regulatory bodies, where legally required.
• Online booking platforms and travel agencies through which reservations are made.
• Banks and electronic payment service providers for payment processing.
• Hotel management, reservation, and information technology system providers.
• Authorized technical support, maintenance, and operational service providers.
• Marketing and communication service providers, where a valid legal basis and required consent exist.
• Relevant authorities where necessary to protect legal rights, prevent fraud, or address violations.

We seek to ensure that personal data is shared only to the extent necessary for the specified purpose and that appropriate measures are taken to protect its confidentiality.

We do not sell customers’ or guests’ personal data to third parties for commercial purposes.

6 Data Storage, Retention, and Destruction

• Personal data is stored in electronic systems and secure storage methods appropriate to the nature of the data and the purpose of its collection.
• We retain personal data for as long as necessary to fulfill the purposes for which it was collected.
• Certain information may be retained for longer periods to comply with accounting, tax, contractual, regulatory, and legal requirements.
• Once the purpose of collection has been fulfilled and any mandatory legal retention period has expired, personal data will be securely destroyed or anonymized in accordance with applicable regulations.
• Appropriate measures are taken to prevent unauthorized access, use, or disclosure of personal data.

7 Transfer of Personal Data Outside the Kingdom

Certain technical services, booking platforms, or service providers may require personal data to be processed or transferred to entities located outside the Kingdom of Saudi Arabia.

Where such transfers or disclosures take place, they will be carried out in accordance with the Personal Data Protection Law and the regulations governing the transfer of personal data outside the Kingdom, with appropriate legal safeguards and measures implemented to protect personal data and the rights of Personal Data Subjects.

8 Cookies

Our website may use cookies and similar technologies to improve the user experience, operate website features, and analyze website usage.

These cookies may include:

• Essential cookies required for the website’s basic operation and functionality.
• Analytics cookies used to evaluate website performance and improve services.
• Preference cookies used to remember user settings.
• Marketing or advertising cookies, if used, subject to obtaining the required consent where applicable.

Users may manage cookies through their browser settings or the consent management tools available on the website. Disabling certain cookies may affect some website functionalities.

9 Personal Data Security

We are committed to implementing appropriate organizational and technical measures to protect personal data against loss, damage, unauthorized access, alteration, misuse, or unlawful disclosure.

Depending on the nature of the systems and data, these measures may include:

• Restricting access to authorized employees only.
• Using appropriate technical security measures.
• Maintaining the confidentiality of customer and guest information.
• Monitoring systems and technical services and addressing identified security risks.
• Handling personal data breaches in accordance with applicable regulatory requirements.

10 Rights of Personal Data Subjects

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, Personal Data Subjects may exercise the following rights, subject to applicable legal requirements and exceptions:

10.1 Right to Be Informed

The right to know the legal basis and purpose for collecting and processing personal data.

10.2 Right to Access Personal Data

The right to request access to personal data held by the Hotel, subject to applicable regulatory requirements.

10.3 Right to Obtain Personal Data

The right to request a copy of personal data in a clear and readable format, in accordance with applicable requirements.

10.4 Right to Request Correction

The right to request the correction of inaccurate personal data, completion of incomplete information, or updating of outdated information.

10.5 Right to Request Destruction

The right to request the destruction of personal data in circumstances permitted by law, unless there is a lawful basis for retaining such data.

10.6 Right to Withdraw Consent

The right to withdraw previously provided consent for the processing of personal data where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

11 Exercising Your Rights and Submitting Complaints

Personal Data Subjects may submit requests to access, correct, update, or destroy their personal data, withdraw consent, or raise privacy-related inquiries and complaints through our channels.

Requests should include sufficient information to verify the identity of the applicant and identify the relevant personal data or right being exercised.

All requests will be reviewed and handled in accordance with the timelines and procedures established under applicable laws and regulations.

12 External Links

The Hotel’s website may contain links to external websites or platforms, including booking platforms and service providers.

The Hotel is not responsible for the privacy policies or data protection practices of external websites. Users are encouraged to review the privacy policies of such websites before providing their personal information.

13 Changes to This Privacy Policy

The Hotel reserves the right to update or amend this Privacy Policy from time to time to reflect legal, regulatory, operational, or technological changes.

The updated version will be published on the Hotel’s website together with the latest revision date. Users are encouraged to review this policy periodically.

14 Contact and Inquiries

For any inquiries, comments, or concerns regarding this Privacy Policy or the processing of personal data, please contact Shirvan City Yard Hotel Management through the official communication channels.