1Introduction and Scope

Saudi International Travel Company “SITC” respects the privacy of its customers and is committed to protecting their Personal Data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Implementing Regulations.

This Privacy Policy explains how the Company collects, uses, stores, discloses, transfers, protects, and processes Personal Data when you visit or use the Company’s website, applications, or booking platforms, contact customer service, make a booking, purchase or use any of the travel and tourism services provided by the Company, or otherwise interact with the Company through any means.

This Policy applies to Personal Data processed by the Company in connection with the travel and tourism services it provides.

By using the Company’s website or services, you acknowledge that you have read and understood this Privacy Policy.

2 Personal Data We Collect

Depending on the service you request and the nature of your interaction with the Company, we may collect the following categories of Personal Data to the extent necessary to fulfill the relevant purpose, including:

• Full name and contact details, including telephone number, email address, and address.
• National ID, Iqama, passport, and any other identification information where required for travel, visa, security, or regulatory purposes.
• Date of birth, nationality, and other information necessary to arrange travel services.
• Travel and booking information, including destinations, travel dates, flight details, hotel bookings, transportation, and other travel arrangements.
• Information relating to accompanying passengers or persons included in a booking where provided by you.
• Payment and transaction information necessary to process or confirm a transaction.
• Information relating to invoices, refunds, cancellations, and other financial transactions.
• Customer service communications, inquiries, complaints, requests, and feedback.
• Travel preferences and information relevant to providing the requested services.
• Technical information, such as IP address, browser type, device information, and website usage information when collected through our systems.
• Cookie data and similar technologies. The Company seeks to collect only the Personal Data that is necessary and relevant to the purposes for which it is collected.

3How We Collect Personal Data

The Company may collect Personal Data directly from you or, where permitted by applicable laws and regulations, from other parties, including:

• When creating an account or user profile.
• When making or managing a booking.
• When purchasing or requesting a travel service.
• When contacting customer service.
• When communicating with us by telephone, email, website, social media, or any other communication channel.
• From airlines, hotels, transportation and car rental providers, visa service providers, insurance companies, booking systems, payment service providers, and other travel service providers involved in fulfilling your request.
• Through our website, applications, and booking platforms.
• Automatically through cookies and similar technologies when using our digital services.

4Purposes of Processing Personal Data

The Company may process your Personal Data for the following purposes, as applicable:

• Creating and managing your account.
• Processing, confirming, and managing bookings and travel arrangements.
• Providing airline, hotel, transportation, car rental, visa, insurance, and other travel-related services.
• Communicating with you regarding bookings, payments, changes, cancellations, and travel arrangements.
• Processing payments, refunds, invoices, and accounting records.
• Complying with legal, regulatory, governmental, immigration, customs, security, and other official requirements.
• Preventing fraud, misuse, unauthorized transactions, and other unlawful activities.
• Operating, maintaining, securing, and improving our website, systems, and services.
• Responding to inquiries, complaints, requests, and feedback.
• Conducting internal audits, compliance reviews, risk management, and quality assurance.
• Conducting statistical and analytical activities where permitted.
• Sending marketing communications, offers, promotional programs, and information relating to the Company’s services where permitted by law and where the required consent has been obtained.
• Establishing, exercising, or defending legal rights and claims.
• Carrying out any other purpose directly related to the purpose for which the Personal Data was collected and permitted under applicable laws and regulations.

5Legal Basis for Processing Personal Data

The Company processes Personal Data based on the applicable legal basis, which may include:

• Your consent, where consent is required.
• Performance of a contract or taking steps at your request prior to entering into a contract.
• Compliance with a legal or regulatory obligation.
• Legitimate purposes permitted under applicable laws and regulations.
• Any other legal basis permitted under the Personal Data Protection Law and its Implementing Regulations.

Where processing is based on your consent, you may withdraw your consent, subject to applicable legal requirements, contractual obligations, and any other legal basis that permits continued processing.

6Sharing and Disclosure of Personal Data

The Company may disclose or share Personal Data to the extent necessary and permitted under applicable laws and regulations with the following categories:

• Airlines and airline partners.
• Hotels and accommodation providers.
• Transportation and car rental service providers.
• Visa, immigration, and travel document service providers.
• Insurance companies.
• Payment service providers, banks, and financial institutions.
• Global Distribution Systems (GDS), booking systems, and technology providers.
• Company employees, authorized representatives, and service providers who require access to the data to perform their duties.
• Group companies or affiliated companies, where applicable.
• Government authorities, regulatory authorities, courts, law enforcement agencies, customs, and immigration authorities where disclosure is required or permitted by law.
• Professional advisers, auditors, and other service providers where necessary for legitimate business or legal purposes.

The Company does not sell your Personal Data to third parties.

7Transfer of Personal Data Outside the KSA

Due to the nature of the travel and tourism sector, it may be necessary to transfer certain Personal Data to or process it by service providers or entities located outside the Kingdom of Saudi Arabia.

These entities may include airlines, hotels, international travel service providers, booking systems, technology providers, payment service providers, and other entities involved in providing the requested services.

When transferring Personal Data outside the Kingdom, the Company complies with the applicable requirements under the Personal Data Protection Law, its Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom, including applicable conditions, safeguards, risk assessments, and contractual protections, as applicable.

The Company seeks to limit international transfers to the Personal Data necessary to provide the requested service or fulfill the relevant lawful purpose.

8Data Retention and Destruction

The Company retains Personal Data only for the period necessary to fulfill the purposes for which it was collected, unless a longer period is required or permitted under applicable laws and regulations, contractual obligations, financial and accounting requirements, dispute resolution requirements, or other legitimate purposes.

When Personal Data is no longer required, the Company will securely destroy, anonymize, or otherwise dispose of it in accordance with applicable legal requirements and internal data retention procedures.

9Data Security

The Company implements appropriate organizational, administrative, and technical measures designed to protect Personal Data against unauthorized access, use, disclosure, modification, loss, destruction, or any other unlawful processing.

Access to Personal Data is restricted to authorized persons whose duties require access to such data for legitimate business or service purposes.

However, no electronic system or method of data transmission can be guaranteed to be completely secure.

10Personal Data Breaches

The Company maintains procedures for identifying, assessing, managing, and responding to Personal Data breaches.

Where a Personal Data breach is subject to notification requirements under applicable laws and regulations, the Company will notify the competent authority or affected Data Subjects in accordance with the applicable legal requirements and timelines.

11Cookies and Similar Technologies

The Company may use cookies and similar technologies for the following purposes:

• Operating and securing the website.
• Remembering user preferences.
• Improving website functionality.
• Understanding website usage and performance.
• Analyzing traffic and user interactions.
• Supporting marketing activities where applicable and permitted.

Cookies may include:

• Strictly necessary cookies.
• Functional cookies.
• Analytics cookies.
• Marketing or advertising cookies, where used.

You may manage or disable cookies through your browser settings or available cookie-management tools. Disabling certain cookies may affect the functionality of certain features of the website.

Third-party cookies may also be subject to the privacy policies of the relevant third parties.

12Marketing Communications

The Company may send information about its services, offers, promotional programs, and travel products where permitted by applicable laws and regulations.

Where consent is required, the Company will obtain the necessary consent before sending marketing communications.

You may unsubscribe from marketing communications at any time by using the unsubscribe option included in the communication or by contacting us through the privacy or customer service channels specified in this Privacy Policy.

Unsubscribing from marketing communications will not prevent the Company from sending service-related communications necessary for your bookings, transactions, or requested services.

13Your Rights Regarding the Protection of Your Personal Data

Subject to applicable laws and regulations, you may have certain rights regarding your Personal Data, including the right to:

• Be informed of the legal or practical justification for collecting your Personal Data and the purpose of collecting it.
• Request access to your Personal Data.
• Request correction, completion, or updating of inaccurate or incomplete Personal Data.
• Request the destruction of Personal Data in cases permitted by law.
• Withdraw consent where processing is based on consent, subject to applicable requirements and exceptions.
• Exercise any other rights granted to Data Subjects under the Personal Data Protection Law and its Implementing Regulations.

These rights are subject to applicable legal exceptions and requirements, including circumstances where the Company is required or permitted to retain or process certain Personal Data.

14How to Exercise Your Rights

To exercise your Personal Data rights or submit a privacy-related request, please contact us through:

Customer Service: +966 920003000

Postal Address: 6837 King Abdulaziz Rd, King Salman Dist. 12432 Riyadh, Kingdom of Saudi Arabia.

Your request should include sufficient information to enable the Company to verify your identity and understand the nature of your request.

The Company may request additional information where necessary to verify your identity and protect your Personal Data from unauthorized disclosure.

The Company will review and respond to requests in accordance with applicable legal and regulatory requirements.

15Account and Data Deletion

You may request the deletion of your account or Personal Data by contacting the Company through the channels specified in this Privacy Policy.

The Company may verify your identity before processing a deletion request. Deletion requests are subject to applicable legal, regulatory, contractual, and legitimate retention requirements.

Accordingly, certain Personal Data may need to be retained for a specified period, including data required for legal compliance, accounting and financial records, fraud prevention, dispute resolution, or the establishment, exercise, or defense of legal claims.

Where Personal Data is retained, the Company will continue to protect it and process it only for the relevant lawful purpose.

16Third-Party Websites and Services

Our website or digital services may contain links to websites, applications, or services operated by third parties, including airlines, hotels, travel service providers, and other service providers.

These entities may have their own privacy policies and practices.

The Company is not responsible for the privacy practices of third-party websites or services that are outside our control.

We recommend that you review the privacy policies of third parties before providing them with your Personal Data.

17Children's Personal Data

The Company’s services may include travel arrangements for children or minors.

Where Personal Data relating to a child is necessary to provide a travel service, such data will be processed only to the extent necessary to fulfill the relevant lawful purpose and in accordance with applicable legal requirements.

18Changes to the Privacy Policy

The Company may update this Privacy Policy from time to time to reflect changes in its services, technologies, legal requirements, or data processing practices.

Any updated version will be published on the Company’s website with the “Last Updated” date amended accordingly.

Where required by law, the Company will provide additional notice or obtain the necessary consent regarding material changes.

19Privacy Contact and Data Protection Officer

For privacy-related inquiries, requests, or complaints, please contact:

+966 920003000

20Complaints and Inquiries

If you have any comments, complaints, or inquiries regarding this Privacy Policy or the processing of your Personal Data, you may contact the Company through the privacy contact details provided above.

The Company will review and address privacy-related complaints in accordance with its internal procedures and applicable laws and regulations.

21Governing Law

This Privacy Policy shall be interpreted and applied in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations, as amended from time to time.

Saudi International Travel Company (SITC)

Website: www.sitc.sa

Customer Service: +966 920003000