Privacy Policy
Effective Date: October 2026 | Governed by the Saudi Personal Data Protection Law (PDPL)
1. Regulatory Compliance
Danah Travel & Tourism operates in strict adherence to the Saudi Personal Data Protection Law (PDPL), overseen by the Saudi Data & AI Authority (SDAIA). We are committed to transparency, necessity, and accountability in handling your personal data.
2. Data Collection & Minimization
In accordance with SDAIA’s data minimization principle, we collect only the minimum amount of personal data required to process your bookings, manage your Danah Points, and verify your identity. This includes your name, contact information, and travel preferences. We establish a clear lawful basis (such as contractual necessity or explicit consent) prior to processing any data.
3. Technical Safeguards & Data Storage
Your personal information is classified and protected according to SDAIA's Data Classification Framework. We utilize Google Cloud Platform and Firebase security rules to enforce robust technical and organizational safeguards. All cross-border data transfers are restricted and only conducted when absolutely necessary for international flight/hotel bookings, adhering to National Data Governance Platform standards.
4. Data Subject Rights
Under the KSA PDPL, you possess the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Withdraw your consent at any time.
- Request the deletion of your personal data when it is no longer required for its lawful purpose.
5. Breach Notification
In the highly unlikely event of a data breach that poses a risk to your privacy, our appointed Data Protection Officer (DPO) will notify you and SDAIA within 72 hours, as mandated by KSA law, outlining the incident and the mitigation steps taken.