Privacy and Protection of Personal Data
What we process and why, how long we keep it, and your rights.
Who is the data controller
The travel agency providing your service is the data controller. The software vendor acts as a data processor on the agency's behalf and accesses data only for technical support, on the agency's instruction.
What data is processed
Identity data (name, national ID number, date and place of birth, parents' names), contact data (phone, e-mail, address), travel documents (passport details and scans, photograph), accommodation and transport preferences, and payment and invoice records. Gender and kinship are held where required for room allocation.
For what purpose
To create your tour registration, allocate accommodation and transport, carry out visa and official procedures, keep invoice and collection records, and communicate with you. Data is not sold to third parties for marketing.
Legal basis
Processing relies on performance of a contract, compliance with legal obligations (tax legislation and the reporting requirements of religious affairs and Saudi authorities) and legitimate interest. Special categories such as passport and health data are processed only with your explicit consent or where legislation requires it.
Who it is shared with
Your data may be shared with the hotels you will stay at, transport companies, Saudi authorities and portals for visa processing, the religious affairs directorate, the e-invoice integrator and the SMS provider. Sharing is limited to the data the relevant process requires.
How long it is kept
Financial documents (invoices, vouchers, collection records) are kept for ten years as required by tax legislation. On your erasure request, identity and contact data are anonymised while the link to the financial record is preserved; your name, ID number, passport details and photographs are deleted. Records with no financial trace are deleted entirely.
How it is protected
Data is isolated per agency at the database level; a user of one agency cannot reach another's records by any route. Integration passwords are stored encrypted and account passwords are hashed irreversibly. Every change to a record is logged with who made it and when.
Your rights
You have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing, to know the third parties it is transferred to at home or abroad, to request correction if it is incomplete or inaccurate, to request erasure where the conditions are met, and to object where the outcome is to your detriment.
How to apply
You may submit your request in writing to the agency providing your service, or to the e-mail address the agency has published. The agency concludes your request within thirty days at the latest. For an access request, all records held about you are provided to you as a single file.
This software is developed as Rota by Rota. This text describes what the product actually does; your agency's own registrations and contracts may add further obligations.