Privacy Policy
Last updated: 26 June 2026
1. Who we are (data controller)
This website, explore-saudi.com, is operated by EXPLORE SAUDI ARABIA LTD, a private limited company registered in England and Wales under company number 16902019, with registered office at 128 City Road, London EC1V 2NX, United Kingdom ("we", "us", "our" or "Explore Saudi"). We are the data controller for the personal data described in this policy. For all privacy and data-protection matters you can reach us at privacy@explore-saudi.com. We are not legally required to appoint a Data Protection Officer.
EU representative (Art. 27 GDPR): we currently process personal data of EU individuals only on a small scale, without special categories of data or ad-targeting. We therefore rely on the exemption in Art. 27(2)(a) GDPR and have not appointed an EU representative. We review this assessment regularly and will appoint a representative as soon as the scope or nature of our processing requires it.
2. What this policy covers
This policy explains how we collect and use personal data when you visit explore-saudi.com, subscribe to our newsletter or contact us, interact with our partner listings, or are contacted by us as part of our hotel-partner outreach. We comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018; the EU GDPR where applicable to visitors from the European Economic Area; and the Saudi Personal Data Protection Law (Royal Decree M/19) and its Implementing Regulations ("PDPL").
3. What personal data we collect
| Category | Examples | When collected |
|---|---|---|
| Website usage data | IP address, browser type, pages visited, referrer | Automatically, on every visit |
| Newsletter data | Email address, language preference | When you subscribe |
| Contact form data | Name, email, message content | When you submit a form |
| Partner enquiry data | Hotel name, contact name, role, business email/phone | When a hotel requests information |
| Hotel outreach data | Business contact name, role, business phone/email, public-source business information | When we prepare outreach or you interact with us |
| Booking-widget interaction | Click events to partner hotels' booking pages | When you use our booking widget |
We do not intentionally collect special-category data (health, religion, political opinion, biometric data) or children’s data. The site is intended for users aged 18 and above.
4. Why we process your data, and our lawful basis
| Purpose | UK/EU GDPR lawful basis | PDPL basis |
|---|---|---|
| Operating the website (logs, security) | Legitimate interest (Art 6(1)(f)) | Legitimate purpose |
| Sending the newsletter | Consent (Art 6(1)(a)) | Consent |
| Responding to contact / partner enquiry | Legitimate interest / pre-contract (Art 6(1)(b)) | Contractual necessity |
| Hotel-partner outreach (B2B) | Legitimate interest (Art 6(1)(f)) | Legitimate purpose |
| Analytics (non-essential cookies) | Consent | Consent |
| Legal, accounting, tax obligations | Legal obligation (Art 6(1)(c)) | Legal obligation |
Where we rely on legitimate interest, we weigh our interest against your rights and freedoms (a balancing test) before processing your data.
5. How long we keep your data (retention periods)
- Website server logs: 90 days.
- Newsletter subscription: until you unsubscribe, or up to 3 years of inactivity.
- Contact-form submissions: 24 months from last correspondence.
- Partner / CRM data: 24 months from last substantive contact, or until opt-out.
- Signed Hotel Partnership Agreement data: term of agreement + 7 years (UK records).
- Analytics (cookie-based): 26 months.
- Financial / invoice records: 7 years (UK statutory).
6. Who we share your data with
We share personal data only with the processors and recipients below, each under data processing terms (in most cases the processor’s standard Data Processing Agreement, which forms part of our agreement with them). We do not sell personal data.
- Supabase, Inc. — database and authentication (primary data store; EU region eu-central-1, Frankfurt).
- Vercel, Inc. — website hosting and edge network (US entity with EU edge presence).
- Resend, Inc. — transactional and newsletter email delivery.
- Google LLC (Google Workspace, and Google Analytics via Google Tag Manager, only after consent) — email operation and analytics.
- Travelpayouts / Booking.com — affiliate tracking, only after consent to the "Marketing/Affiliate" cookie category.
- Our professional advisors (accountants, auditors, lawyers) under confidentiality, and law-enforcement or regulators only where required by law.
7. International transfers
Personal data may be transferred between the UK, the EEA, Saudi Arabia, and the United States. UK–EEA transfers rely on the respective adequacy decisions. UK–Saudi Arabia and UK/EEA–US transfers rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus supplementary measures and, under PDPL Article 29, your explicit consent where applicable. Where these transfer mechanisms require it, we carry out and document a Transfer Impact Assessment.
8. Your rights
- Access — a copy of the personal data we hold about you.
- Rectification — correction of inaccurate data.
- Erasure — deletion, subject to legal retention obligations.
- Restriction — limit our processing while a request is reviewed.
- Portability — a machine-readable copy of data you provided under consent or contract.
- Objection — object to processing based on legitimate interest, including direct marketing (we stop immediately).
- Withdraw consent — at any time, without affecting past lawful processing.
- Automated decisions — not to be subject to solely automated decisions with legal or similarly significant effects. We do not currently perform such processing.
You may lodge a complaint with a supervisory authority: UK users with the Information Commissioner’s Office (ICO), ico.org.uk; EEA users with their national Data Protection Authority; Saudi Arabia users with the Saudi Data & AI Authority (SDAIA), sdaia.gov.sa. To exercise any right, email privacy@explore-saudi.com. We respond within 30 calendar days of a valid request.
9. Hotel-partner outreach
If a member of our team contacts you as part of our Saudi hotel-outreach programme, we process your business contact details (name, role, business phone and email) published on your hotel’s website or corporate LinkedIn profile, under the legitimate interest of identifying potential hotel partners. We do not record calls unless we tell you at the start and you agree; we log brief notes in our CRM and send a written follow-up within 24 hours. You can ask us to stop contacting you at any time — on the call, by reply, or at privacy@explore-saudi.com — and we honour it immediately. We retain the record for 24 months from last substantive contact unless you ask us to delete sooner.
10. Cookies
Necessary cookies and local storage (e.g. to remember your cookie choice, or for security) are set without consent under § 25(2) TTDSG. We set all non-essential cookies (statistics, marketing/affiliate) only after you consent through our banner, where rejecting is as easy as accepting and no boxes are pre-ticked. You can change or withdraw cookie consent at any time via the "Cookie settings" link in the footer. Full detail is in our Cookie Policy.
11. Security
We protect personal data with TLS 1.2+ in transit, encryption at rest, role-based access control, secure coding and code review, regular dependency updates, and incident-response playbooks. No online service is 100% secure. If a breach affecting your data occurs, we notify the supervisory authority within 72 hours (UK GDPR Art 33) and you without undue delay where the law requires (Art 34).
12. Changes and contact
We update this policy when our processing or the law changes; the "Last updated" date reflects the most recent change, and we notify active subscribers and signed partners of material changes by email. Data-protection queries: Explore Saudi Arabia Ltd, company number 16902019 (England & Wales), 128 City Road, London EC1V 2NX — privacy@explore-saudi.com.