Fandaqah Information Technology Company (“Fandaqah”, “we”, “our”, or “the Company”) acknowledges the critical importance of protecting the privacy of personal data collected from users of its Property Management System (PMS), visitors to its digital platforms, and all other parties interacting with the Company. This Privacy Policy sets forth the principles and practices governing the collection, processing, and safeguarding of such data, as well as the rights associated therewith, in accordance with applicable laws and regulations in the Kingdom of Saudi Arabia—most notably those issued by the National Cybersecurity Authority and the Saudi Data and Artificial Intelligence Authority (SDAIA)—and in line with recognized international standards.

By accessing or using any of our services or platforms, you provide your explicit and unconditional consent to be bound by this Policy in full. You bear sole responsibility for reviewing, understanding, and complying with its terms. The Company shall not be held liable for any failure on your part to do so.

Fandaqah reserves the right to amend, update, or replace this Privacy Policy at its sole discretion and at any time without prior notice. Continued use of the Company’s services or platforms following any such changes shall constitute your acceptance of the revised Policy.

This Privacy Policy applies exclusively to personal data collected or processed through the following channels:

• Use of the Fandaqah PMS by hospitality entities, including hotels, serviced apartments, resorts, and guest houses.
• Access to the Company’s official website or affiliated mobile applications.
• Communication with the Company via email, telephone, or any other direct or indirect means.

This Policy covers all end users, clients, employees, and legal representatives of entities engaging with the Company, whether located within or outside the Kingdom of Saudi Arabia.

The Company shall not be held responsible for any data collected or processed outside the channels, nor should it be for the privacy practices of third parties. Inclusion within the scope of this Policy does not constitute a guarantee of service or data handling beyond what is explicitly stated herein.

Fandaqah processes personal data based on one or more of the following legal grounds, as applicable:

• Contractual Necessity: Where processing is required for the performance of a contract entered between the Company and the client or user.
• Legal Obligation: Where processing is mandated by applicable local or international laws and regulations, including collection, retention, or disclosure of specific data.
• Legitimate Interest: Where processing is necessary to pursue a lawful interest of the Company—such as service enhancement, fraud prevention, or system security—provided that such interest does not override the rights and freedoms of the data subject.
• Explicit Consent: Where prior consent is legally required, such as for sending marketing communications or utilizing non-essential cookies. Refusal to provide such consent may limit the availability or functionality of certain services.

Fandaqah reserves the right to process personal data without prior notice to the data subject, provided such processing is based on one or more of the above legal grounds. The Company disclaims any liability for damages arising from the user’s failure to review or adhere to this Policy.

Fandaqah Information Technology Company collects and processes specific categories of personal data in accordance with the principle of data minimization, and solely to the extent necessary for service delivery and in compliance with applicable regulations. The client expressly acknowledges that the provision of such data is voluntary and assumes full legal responsibility for its accuracy, validity, and timely updates.

4.1. Personal Identification Data

• Full name
• National ID or residency number
• Nationality
• Date of birth

4.2. Contact Information

• Mobile phone number
• Email address
• Business or residential address

4.3. Payment and Billing Information

• Electronic payment details (e.g., bank card or digital wallet)
• Invoice and transaction records
• Payment history and outstanding balances

4.4. Technical Usage Data

• Internet Protocol (IP) address
• Device type, operating system, and browser type
• System login and logout records
• Cookies and tracking technologies

4.5. Geolocation Data (if applicable)

Approximate or precise location when using the system or application, if location services are enabled

4.6. Voluntarily Provided Data

Any additional information voluntarily submitted by the client or user during interactions with the Company or while using the system, such as feedback, inquiries, or reviews

4.7. Sensitive Data (if applicable)

The Company does not collect or process any data classified as “sensitive” under applicable regulations—such as health, religious, or biometric data—unless strictly necessary for service provision and only after obtaining the data subject’s explicit and written consent.

Fandaqah Information Technology Company collects personal data from clients and users through various channels, in accordance with applicable regulations and in pursuit of its operational and regulatory interests. Use of any of the following methods constitutes the client’s explicit consent to the collection and processing of data as outlined in this Policy.

5.1. Direct Collection

Data is collected directly from the client or user in the following cases:

• Registering on the system or creating a user account
• Filling out electronic or paper forms
• Communicating with the Company via email, phone, or any other means
• Submitting support requests, inquiries, complaints, or feedback

5.2. Indirect and Automated Collection

Certain data is collected automatically without human intervention when using the website or system, including:

• Internet Protocol (IP) address
• Device type, operating system, and browser type
• Browsing and usage logs
• Cookies and tracking technologies
• Geolocation data (if enabled by the user)

5.3. Collection from Third Parties

The Company may receive data from trusted third-party sources, such as:

• Electronic payment gateways
• Booking platforms or integration systems
• Providers of technical support, hosting, or analytics services

The client acknowledges that such third parties may operate independently of the Company and are subject to their own privacy policies. Fandaqah assumes no responsibility for their practices or the accuracy of the data received from them, unless governed by a direct agreement.

Fandaqah Information Technology Company uses personal data collected from clients and users for specific and lawful purposes, in accordance with applicable regulations in the Kingdom of Saudi Arabia. Use of any of the Company’s services or platforms constitutes the client’s explicit consent to the use of their data as outlined below.

6.1. Service Delivery and System Operation

• Account creation and activation
• Subscription and contract management
• Booking execution, payment processing, and invoice issuance
• Provision of technical and customer support

6.2. Client Communication

• Sending account- or system-related notifications
• Responding to inquiries and complaints
• Sending technical updates or changes to terms of service or policies

6.3. Improvement and Development

• Analyzing system usage to enhance performance and functionality
• Testing and developing new features
• Collecting feedback to improve user experience

6.4. Legal and Regulatory Compliance

• Complying with applicable local and international regulations
• Responding to official requests from competent authorities
• Maintaining records for auditing, investigation, or compliance purposes

6.5. Security Purposes

• Detecting and preventing fraudulent or unlawful activities
• Monitoring unauthorized access and usage
• Protecting user data and digital infrastructure

6.6. Marketing (with prior consent)

• Sending promotional offers or service-related updates
• Personalizing content based on user preferences

6.7. Internal Business Purposes

• Preparing performance reports and trend analysis
• Evaluating service quality and making strategic decisions
• Using data for operational studies without linking it to user identity

Fandaqah Information Technology Company is committed to not selling, renting, or sharing personal data collected from clients or users with any third party for independent commercial purposes, except in the specific cases outlined below and in accordance with applicable regulations in the Kingdom of Saudi Arabia.

7.1. Disclosure to Third-Party Service Providers

Personal data may be disclosed to external parties that provide direct services to the Company, strictly to the minimum extent necessary for service delivery. These parties may include:

• Cloud hosting providers
• Electronic payment gateways
• Technical support and customer service platforms
• Analytics and performance monitoring tools

Such parties are bound by strict contractual agreements that ensure data protection and prohibit the use of data for any purpose beyond the services provided to the Company. Disclosure does not constitute a transfer of data ownership or impose any additional obligations on the Company toward these parties.

7.2. Disclosure to Regulatory or Legal Authorities

Personal data may be disclosed in the following circumstances:

• Compliance with court orders or official requests from competent authorities
• Fulfillment of legal or regulatory obligations
• Protection of the Company’s rights, property, or the safety of system users

Such disclosures may occur without prior notice to the client, provided they are conducted in accordance with applicable laws and regulations.

7.3. Disclosure in Case of Merger or Acquisition

In the event of a merger, sale, or partial or full transfer of ownership of the Company, data may be transferred to the new owning entity, subject to the implementation of necessary legal and regulatory safeguards to ensure continued data protection. Such transfer does not impose any additional obligations on the Company toward the client.

Fandaqah Information Technology Company is committed to not transferring personal data outside the Kingdom of Saudi Arabia except where operational or contractual necessity requires it, and only in full compliance with applicable laws and regulations, including the Personal Data Transfer Regulation issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

8.1. Conditions for Transfer

Personal data may be transferred outside the Kingdom only under the following conditions:

• An operational or contractual necessity exists, such as the use of international cloud hosting services or performance analytics tools hosted outside the Kingdom.
• Adequate safeguards are in place to protect the data in the receiving country, without compromising the rights of data subjects.
• The transfer does not adversely affect national security or the vital interests of the Kingdom.

8.2. Required Safeguards

Prior to any data transfer, the Company shall implement one or more of the following safeguards:

• Binding contractual agreements with the receiving entity
• Adoption of recognized codes of conduct or certification mechanisms
• Assessment of the data protection level in the receiving country to ensure equivalence with local standards
• Obtaining explicit consent from the data subject, where required

8.3. Periodic Review

All data transfer operations are subject to periodic review to ensure continued compliance with regulatory requirements and to update procedures as necessary.

8.4. User Rights

Users retain all legal rights related to their personal data, including:

• The right to withdraw consent for data transfer
• The right to report any breach or data leakage
• The right to request data deletion or restriction of use following transfer

8.5. Company Responsibility

• The Company shall document all data transfer operations and associated safeguards.
• The Company shall not be held liable for any use of the data by the receiving entity beyond the agreed scope, provided the transfer was conducted in accordance with regulatory requirements.
• The Company reserves the right to refuse or suspend any data transfer if risks to data security or user rights are identified.

Fandaqah Information Technology Company is committed to implementing appropriate technical and organizational measures to safeguard personal data, defined as any information relating to an identified or identifiable natural person, such as name, ID number, contact details, or location data. These measures aim to prevent unauthorized access, alteration, disclosure, or destruction, in accordance with recognized security best practices and within commercially reasonable limits. This commitment does not constitute a guarantee of absolute protection.

9.1. Technical Measures

• Use of encryption technologies in line with international standards (e.g., TLS 1.2+ and AES-256) to protect data during transmission and, where applicable, during storage.
• Hosting infrastructure on secure servers equipped with firewalls and intrusion detection systems (IDS).
• Implementation of strict access controls to ensure data is accessible only to authorized personnel, following the principle of least privilege.

9.2. Organizational Measures

• Conduct regular security audits to assess risks and update procedures.
• Training employees in data protection and privacy policies, including incident response protocols.
• Enforcing internal policies to prevent unauthorized access or misuse of data.

9.3. Security Incident Management

The Company maintains a security incident response plan that includes procedures for investigation, containment, and recovery to minimize potential damage from any breach.

9.4. Client Responsibility for Access Credentials

The client is solely responsible for safeguarding their access credentials, including username and password, and assumes full liability for any unauthorized use resulting from negligence or misuse.

9.5. Limitations of Security Liability

• The Company makes commercially reasonable efforts to secure data; however, the client acknowledges that the internet is not a fully secure environment, and absolute protection cannot be guaranteed.
• The Company shall not be held liable for damages resulting from factors beyond its control, such as advanced cyberattacks or client negligence, unless caused by gross negligence or direct misconduct by the Company.
• The Company is not obliged to recover any data lost due to circumstances beyond its control. Clients are responsible for maintaining their own data backups as needed.

9.6. Reporting Security Incidents

In the event of suspected unauthorized activity or a security breach, the client must immediately notify the Company via the following official channels: