"Siavy Platform" Privacy Policy

This Privacy Policy explains how " Siavy Platform" (hereinafter referred to as the “Platform”) collects, processes, and protects users’ personal data, the purposes for which such data is used, and the rights granted to users in accordance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA), in line with international best practices in privacy and cyber security.

Your use of, or registration on, the Platform constitutes your explicit consent to the terms of this Policy, which forms an integral part of the Terms of Use.

First: Definitions:

In addition to the statutory definitions, the following terms shall have the meanings set forth below:

• Platform: Any website, application, or system owned or operated by "Siavy Platform".
• User: Any individual who uses the Platform or benefits from its services.
• Personal Data: Any data relating to an identified individual or an individual who can be identified, directly or indirectly.
• Sensitive Data: Data relating to biometric identifiers, health status, financial information, beliefs, or any data of a similar nature.
• Data Protection Officer (DPO): The individual or entity responsible for overseeing the Platform’s compliance with applicable data protection laws.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, transfer, modification, or deletion.
• Third Party: Any external entity with whom the Platform may share data where necessary.
• Record of Processing Activities: A mandatory record maintained by the service provider documenting data collection and processing activities.

Second: Platform Commitment to Data Protection:

The Platform shall:

• Protect the privacy of Users and to treat such protection as a fundamental priority within the Platform’s systems.
• Process personal data in accordance with the principles of lawfulness, transparency, necessity, and proportionality, without unjustified expansion.
• Comply with the principle of data minimization.
• Not to disclose or share personal data except on a lawful or contractual basis or upon obtaining the User’s explicit consent.
• Implement appropriate compliance policies and procedures.
• Appoint a Data Protection Officer (DPO) and continuously monitor compliance with applicable data protection requirements.
• Document all activities related to personal data protection.

Third: Types of Data Collected:

The Platform collects the following data strictly within the limits necessary for the purposes of processing:

Identity Data:

a. Full name;
b. National ID or residency number;
c. Nationality;
d. Age and gender;
e. Passport number (for international bookings).

Contact Data:

a. Email address;
b. Mobile phone number;
c. Address (where required).

Transaction and Payment Data:

(The Platform does not store bank card details; such data is collected and processed through a licensed payment service provider.)
a. Payment records;
b. Invoices;
c. Booking details;
d. Services used.

Technical Data:

a. IP address;
b. Device and browser type;
c. Operating system;
d. Cookie identifiers.

Location Data:

The Platform does not collect location data without the User’s explicit consent, and such data shall be used only for the following purposes:
a. Tourism guidance services;
b. Transportation services;
c. Providing location-based offers.

User Activity Data (Usage Data):

a. Pages visited;
b. Session duration;
c. Search history within the Platform;
d. User preferences.

Data Provided Voluntarily by the User:

a. Reviews and ratings;
b. Inquiries;
c. Feedback.

Fourth: Purposes of Data Processing:

The Platform processes personal data strictly for the following purposes and shall not process such data beyond these purposes:

Provision of Services and Execution of Transactions:

a. Account creation;
b. Completion of bookings;
c. Processing of payments;
d. Sending confirmations and notifications;
e. Providing customer support.

Enhancement of User Experience:

a. Improving the performance of the Platform;
b. Providing personalized tourism recommendations;
c. Enhancing the quality of the interface and services.

Communication:

a. Booking notifications;
b. Service updates;
c. Responding to inquiries and requests.

Marketing (Subject to Explicit Consent Only):

a. Sending special offers;
b. Electronic marketing campaigns;
c. Newsletters.

Legal Compliance:

a. Compliance with applicable laws and regulatory requirements;
b. Investigation of cybercrimes and unlawful activities;
c. Retention of legally required records.

Risk Management and Fraud Prevention:

a. Monitoring suspicious activities;
b. Preventing misuse of the Platform;
c. Detecting unauthorized access attempts.

Training and Development (with Data Anonymization):

a. Training internal models;
b. Improving recommendation algorithms.

Fifth: Legal Basis for Processing:

Personal data shall not be processed except on the basis of one or more of the following legal grounds:

• The User’s explicit consent;
• The performance of a contract, including bookings and related transactions;
• Compliance with a legal obligation or pursuant to a judicial or governmental order;
• The legitimate interests of the Platform, provided that such interests do not override the rights and interests of the User.

Sixth: Data Sharing with Third Parties:

The Platform may share personal data with the following parties:

Tourism Service Providers:

a. Hotels;
b. Airlines;
c. Car rental companies;
d. Tour operators;
e. Tour guides.

Technical Service Providers:

a. Payment service providers;
b. Cloud storage service providers;
c. Cyber security service providers;
d. Messaging and communication service providers.

Government Authorities:

In accordance with applicable laws and regulations, including but not limited to:
a. Ministry of Interior;
b. Ministry of Tourism;
c. General Authority of Civil Aviation;
d. Judicial authorities.

Marketing Partners (Subject to Explicit Consent Only):

Data Sharing Controls:

a. Only the minimum necessary data shall be shared;
b. Non-disclosure agreements (NDAs) shall be executed;
c. The sale or commercial exploitation of personal data is strictly prohibited;
d. Personal data shall not be used for purposes other than those agreed upon;
e. Third parties shall comply with the requirements of the Personal Data Protection Law (PDPL).

Seventh: Cross-Border Data Transfers:

Personal data may be transferred outside the Kingdom of Saudi Arabia only where the following conditions are met:

• An adequate level of data protection is ensured in the receiving jurisdiction, equivalent to or higher than that required under applicable laws;
• There is a clear operational necessity for such transfer (such as international payment gateways);
• The User’s consent is obtained where required.

The Platform shall comply with the following:
a. Retaining a copy of the data within the Kingdom, where reasonably practicable;
b. Monitoring the compliance of the foreign recipient with applicable data protection requirements;
c. Implementing additional safeguards.

Eighth: Data Protection:

The Platform implements advanced technical and organizational measures to ensure the protection of personal data, including technical measures and organizational measures.

Ninth: Data Retention:

The Platform shall:

• Retain Personal data only for the period necessary to fulfill the purposes for which it was collected;
• Delete Personal data upon fulfillment of the purpose or upon the User’s request, in accordance with applicable laws and regulations;
• Retain Records relating to invoices and transactions for the period required under applicable financial and regulatory requirements;
• May retain Personal data for a longer period where necessary in connection with an active legal dispute.

Tenth: User Rights:

In accordance with the Personal Data Protection Law (PDPL), the User shall have the following rights:

• The right to be informed prior to the collection of personal data;
• The right to access personal data and request a copy thereof;
• The right to request correction or updating of personal data;
• The right to request erasure of personal data, except where retention is required by law;
• The right to request restriction of processing;
• The right to object to processing, including for direct marketing purposes;
• The right to withdraw consent at any time;
• The right to data portability, where technically feasible;
• The right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

Such requests may be submitted through the Platform’s official communication channels.

Eleventh: Cookies

The Platform uses the following types of cookies:

• Essential Cookies: These are necessary for the operation of the Platform;
• Analytical Cookies: These are used to analyze performance and improve the Platform and user experience;
• Marketing Cookies: These are used for marketing purposes and shall only be activated with the User’s prior consent.

The User may manage or delete cookies through their browser settings.

Twelfth: Governance and Compliance Management:

The Platform implements a comprehensive governance framework, which includes the following:

• Maintaining a Record of Processing Activities;
• Conducting periodic or annual compliance reviews;
• Performing Data Protection Impact Assessments (DPIA), where required;
• Conducting regular security testing;
• Implementing documented data protection policies;
• Carrying out internal audits to ensure ongoing compliance.

Thirteenth: Data Protection Officer (DPO):

For any inquiries relating to privacy or personal data, you may contact the Data Protection Officer using the details below:

• Data Protection Officer:
• Email:
• Phone:

Fourteenth: Amendments to the Policy:

The Platform reserves the right to amend this Privacy Policy at any time. In the event of any material changes, the User shall be notified through:
a. Email;
b. Notifications within the Platform.

Continued use of the Platform following such amendments shall constitute the User’s explicit acceptance of the updated Policy.