Privacy Policy

Contact details

This policy in one minute

1. Personal data we collect

We collect the minimum needed for each service, and our forms distinguish mandatory fields from optional ones. The data falls into the following categories:

Sensitive data: We do not request sensitive data within the statutory meaning (such as health, religious, credit or biometric data). If a Partner includes in a special request something that reveals a guest's health need (such as an accessible room), it is processed solely to fulfil that request with the hotel, and the Partner is responsible for obtaining the guest's explicit consent before entering it.

Minors: Children's ages are collected only for occupancy and pricing. No account is created for anyone under 18; a child's details are entered by a parent, guardian or the authorised Partner.

2. How we collect your data

Directly from you: through registration forms, account settings, the booking interface, the API, and contact and support forms.

Indirectly:

• From the Partner: guest details entered to complete a booking, and details of anyone booking on a Partner's behalf.
• From hotels and suppliers: booking confirmations and amendments, and arrival or no-show status.
• From the payment gateway: the result and reference of a payment or refund.
• From official registers: to verify a Partner's commercial registration and tourism licence.
• Automatically: through cookies and technical logs when you use the platform (Section 8).

When booking for others, the person entering the data must ensure they are authorised to provide it and must inform its owners of this policy.

3. Purposes and legal bases

We tie every processing activity to its specific purpose and to a legal basis set out in Article 6 of the Law, and we do not later process your data in a way incompatible with the purpose for which it was collected.

Legitimate interest: We rely on it only after a documented assessment of necessity, proportionality and your reasonable expectations, without overriding your rights, and never for sensitive data.

Consent: We do not make marketing consent a condition of any service, and neither reading this policy nor completing a booking constitutes marketing consent. You may withdraw consent from your account preferences or by email without affecting processing carried out before withdrawal or processing based on another legal basis.

Automated decisions: Automated rules may be used to detect fraud or abuse; any outcome affecting your account is reviewed by a person before final action is taken.

4. How we process your data

• Collection: through the interfaces and channels described in Section 2, limited to the minimum needed for the purpose.
• Storage: in the platform's databases and their backups inside the Kingdom (Section 6), with encryption and restricted access.
• Use: only for the stated purpose, by authorised staff and systems according to role and task.
• Sharing: with the recipients listed in Section 5, to the extent each recipient needs.
• Destruction: when the purpose and retention period end, by permanent deletion or anonymisation (Section 7).

5. Who we share your data with

We do not sell your data and do not disclose it to any party for direct-marketing purposes. Disclosure is limited to what is needed to deliver the service or meet a legal obligation, and to the data each recipient needs. No Partner can see another Partner's data or guests.

Service providers that process data on our behalf are bound by processing contracts that limit them to the purpose, impose confidentiality and security measures, and prohibit use of the data for their own purposes.

6. Processing location and transfers outside the Kingdom

Your data and its backups are stored inside the Kingdom on cloud servers of a licensed provider, in the Riyadh region.

A transfer outside the Kingdom occurs in two cases: when the hotel or accommodation supplier is outside the Kingdom, the guest details needed for the booking are transferred to it in its country; and when a service provider (such as notifications or payment networks) uses infrastructure outside the Kingdom.

Transfers are limited to the minimum necessary and are made in accordance with Article 29 of the Law and the Regulation on Personal Data Transfer outside the Kingdom: on a recognised transfer basis, after verifying the level of protection in the receiving country or applying appropriate safeguards (such as standard contractual clauses), and with a risk assessment where required. You may request the recipient and country for a specific booking using the contact details above.

7. Storage, retention and destruction

Method of destruction: Permanent, unrecoverable deletion from our systems and, in line with the rotation cycle, from backups, or anonymisation so that you can no longer be identified. Destruction may be delayed where there is an ongoing dispute, a request from a competent authority or a legal retention obligation, in which case use is restricted to that purpose. A quote or hold expiry is not a record-destruction date. You may request the period and basis applying to a specific record.

Security measures: Encryption in transit and at rest, passwords stored as derived values, two-factor authentication, role-based access with isolation of each Partner's data, revocable API keys, audit logs, regular backups, periodic security testing, staff confidentiality undertakings, and processing contracts with service providers. Do not send passwords, verification codes or card details through a support ticket. These measures do not guarantee the absence of risk.

Data incidents: In the event of a leak, damage or unlawful access, we assess the incident, notify the Saudi Data and AI Authority within 72 hours of becoming aware of it where the notification conditions apply, and notify affected individuals without delay where the incident may cause them harm.

8. Cookies and browser storage

The platform uses storage needed for the functions you request; marketing consent is not a condition of using them:

• Session cookie: identifies your signed-in session and ends when you sign out, the session expires, or an account administrator revokes it.
• Security cookies: protect forms against forged requests and verify session integrity.
• Functional storage: keeps your language, currency, recent searches and selections on your device, and merges them into your account when you sign in.

The platform does not use advertising cookies or third-party tracking tools. If optional analytics tools are added in future, they will be activated only with your consent and this policy will be updated beforehand.

You can set your browser to block or clear storage; your sign-in session and saved selections may be affected. Clearing browser data does not destroy the records held in your account.

9. Your rights and how to exercise them

Identity verification: We may require proportionate verification of your identity or your representative's authority before disclosing any data; do not send a full identity document image initially.

Timeframe: We respond within 30 days of receiving a complete request, extendable by a further 30 days in the cases set out in the Implementing Regulations, with notice of the reasons.

Fees: No fee is charged for exercising your rights, except as the Law permits for repetitive or disproportionate requests.

Limitations: A request may not be fulfilled in whole or in part where it conflicts with a legal obligation or the rights of others, such as confirmed-booking data tied to a financial record; in that case we will explain the reason and how to object.

10. Complaints and objections

If you object to the processing of your data, or we have not enabled you to exercise your rights within the stated period, submit your complaint to the Privacy and Data Protection Team at Info@BedBank.SA or on the unified number 920035522, describing the matter and quoting any earlier request reference. We acknowledge receipt and decide on the complaint within 30 days.

If you are not satisfied with the outcome, or we do not respond within that period, you may complain to the Saudi Data and AI Authority (SDAIA) through the National Data Governance Platform.

11. Availability of this policy and updates

This policy is published on BedBank.SA and in the partner portal, and a short privacy notice is shown when an account is created and when guest details are entered. Partners are bound to make this policy available to the guests they book for.

We review the policy whenever services, processing purposes or recipients change, and at least annually. We notify you of any material change through the partner portal or by email before it takes effect, and obtain fresh consent where required before the related processing.

In the event of any conflict between the Arabic and English versions, the Arabic version prevails.