Privacy Policy

Last updated: 2026-11-02

Summary of changes in this version: section 13 now describes the analytics and advertising cookies that our website uses only with your consent, and sections 5, 7, 8 and 9 add the data they collect, their legal basis, who receives it and where it may be processed. Since they run only after you accept them, this change applies from the day you do.

Summary of changes in the previous version (2026-10-25): the policy now covers the bookings and card payments made on our website; names the companies that process data for us and states that this data is processed outside the Kingdom of Saudi Arabia (the Kingdom); corrects the company's legal name, its registration numbers and the contact details; replaces the cookie section; and removes statements that no longer apply to the new website, among them the references to the EU General Data Protection Regulation. Two changes take effect on 2026-11-25: the two sentences of section 12 that allow us to extend the period for answering a request once and to decline a request repeated without justification. Until that date, the previous version applies on these points.

1. Introduction

Ara Travel, the trade name of Ara Aljazeera Company For Travel and Tourism (“Ara Travel”, “we”, “us”, “our”), protects the privacy and security of the personal data it processes when it provides travel and tourism services. This policy sets out the data we collect and why, who receives it, where it is held and for how long, and how you can use your rights.

2. Definitions

Personal Data: any information relating to an identified or identifiable natural person.

Sensitive Data: personal data that the Personal Data Protection Law classes as sensitive, such as health information or religious belief.

Controller: Ara Aljazeera Company For Travel and Tourism (trade name Ara Travel), CR 4030549385, Unified national number 7035963649, License number: 73105688, which determines the purposes and means of processing personal data.

Processor: a party that processes personal data on behalf of Ara Travel under contract.

3. Legal Framework

We process personal data in accordance with:

1. the Personal Data Protection Law, its Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom;
2. the E-Commerce Law and its Implementing Regulation;
3. the Travel and Tourism Services Regulation.

4. Scope

This policy applies to the website aratravel.sa and its booking pages, to the emails we send about requests and bookings, to communications with us by telephone, WhatsApp or email, and to all booking, visa-facilitation and tour-coordination activities.

5. Categories of Personal Data

We collect the following:

1. Contact data: your name, email address, phone number and preferred language.
2. Request data: the trip you ask about, your preferred date, the number of guests and your note; on the contact form, your message and the option you choose under “I am”.
3. Booking data: the trip, its date and time, the number of adults and children, any add-ons, the amounts and any VAT they include, the booking reference and status, the cancellation policy that applies, the record of your acceptance of the Terms and Conditions (the version, the language shown, the date and time), and your consent to share the booking with the provider who delivers the service.
4. Payment data: the payment reference that Tap Payments returns, the payment status, the card brand with its last four digits, and the records of any refund. We never receive or store your full card number or its security code. Where our staff record a payment or refund made by bank transfer, cash or card terminal, we keep its method, amount and date. A refund goes only to the payment method you used, so we ask for bank account details only to refund a payment you made by bank transfer, or to pay an amount we owe you beyond what you paid, which goes to an account in your name; we then keep the account holder's name, the bank and the account number (IBAN) you send us.
5. Correspondence: the emails we send you about your request or booking, and the messages you exchange with us by email, WhatsApp or telephone.
6. Technical data: the IP address of each visit, which our code uses only to limit repeated requests from the same address and keeps out of our database, though Cloudflare's service logs for our account may hold it for up to 7 days; the check described in section 13; and, only with your consent, the data that analytics and advertising cookies collect (section 13).
7. Identity documents for a trip: where the provider of a service or a visa application requires it, and only then, our staff ask you for a copy of your passport by WhatsApp or email and send you a link to this policy with the request. The copy is kept in one protected folder on a company device, never on a personal phone; it is deleted from the chat and the mailbox once saved, and from the folder after the trip.

Our website forms do not ask for passport numbers, dates of birth, nationality, postal addresses or health information; item 7 describes the passport copy our staff may ask for outside the website. Please do not include health details or other sensitive information in a note or message.

6. Methods of Collection

• Directly from you: through the request, contact and checkout forms on our website and the payment page we send you for a booking our staff prepare, and when you contact us by email, WhatsApp or telephone.
• From you, at our staff's request outside the website: a copy of your passport, where a provider or a visa requires it (section 5, item 7).
• From Tap Payments: the outcome of your payment, its reference, and the card brand with its last four digits.
• From our previous website: the records of bookings made there that we move into this website.
• From your browser: the technical data described in section 13.

7. Purposes and Legal Bases

Articles cited below are of the Personal Data Protection Law unless stated otherwise.

If you withdraw your consent to sharing before the provider has received the details it needs, we cannot deliver that service, so the withdrawal counts as your request to cancel it, received when it reaches us. The Terms and Conditions (Article 6) then set any refund, the statutory right to rescind included where it applies.

We send no marketing messages. If we offer them in future, we will ask for your explicit prior consent.

8. Data Sharing

We do not sell personal data. We share it only as follows:

1. Processors acting for us: Cloudflare, which hosts and protects our website and its database; and Microsoft, whose Microsoft 365 service sends and holds our email.
2. Tap Payments, which receives your card details directly on its own card page, together with the amount, our booking reference, and the name and email address that Tap Payments requires to create the payment.
3. The provider who delivers the service you booked, such as a tour operator, a transport company or a dive centre, only with the consent you give when you accept the booking on our website (or, for a booking made on our previous website, give our staff in writing), and only the details that provider needs.
4. Public bodies where a law requires it, such as the Ministry of Tourism under the Travel and Tourism Services Regulation, the Zakat, Tax and Customs Authority for the tax invoices we issue, and courts and other competent authorities.
5. WhatsApp, the messaging service of Meta, which carries and stores the messages we exchange with you on WhatsApp.
6. The hosting provider of our previous website, which holds the records of bookings made on it until we close that website.
7. Analytics and advertising providers, only if you accept analytics and advertising cookies (section 13): they receive data about your visit to our website and use it under their own policies.

Within Ara Travel, staff see personal data in our control panel according to their role.

9. International Transfers

Our website and its database are hosted by Cloudflare outside the Kingdom. Cloudflare's database service offers no location inside the Kingdom today; we request a European location, which Cloudflare does not guarantee. Cloudflare also handles the technical data of each visit, such as the IP address, and may keep records of it outside the Kingdom. Our email runs on Microsoft 365, which gives no commitment to keep data inside the Kingdom, so the messages we send and receive may be processed outside it. Therefore all the personal data our website holds, including your requests, bookings and payment records, is processed outside the Kingdom.

When you book a service delivered outside the Kingdom, we give the provider of that service the booking details it needs to deliver it, so those details are transferred outside the Kingdom. The messages we exchange with you on WhatsApp are processed by WhatsApp LLC on Meta's global infrastructure, in the United States and other countries; WhatsApp encrypts them end to end, deletes each message from its servers once it is delivered and keeps an undelivered one there for up to 30 days, and the chats are kept in our WhatsApp Business app.

If you accept analytics and advertising cookies, the providers that set them may process the data of your visit outside the Kingdom.

Cloudflare acts as our processor under its data processing addendum, and Microsoft acts as our processor for our email. Our database is encrypted at rest. If we move personal data to storage inside the Kingdom, we will update this section.

10. Data Retention

We keep personal data only as long as its purpose or a legal duty requires, then erase it or remove what identifies you from it:

• Requests and messages sent through our website's forms: three years after the last activity on your requests, whether your message or our handling of it; while you hold a booking with us, your requests are kept as long as the booking. Your name, email address, phone number and note are then erased.
• Bookings: the booking records, the booking document, the payment records, the tax invoices and the record of your acceptance of the Terms and Conditions are kept for ten years, the period the Commercial Books Law sets for the documents of a trade. Your contact details stay with a booking for as long as it is kept.
• Correspondence: emails and WhatsApp messages about a booking are kept with the booking for ten years, as correspondence of the trade; those about a request that leads to no booking are kept for one year from the date of each message, as the Travel and Tourism Services Regulation requires, then deleted. Whatever the channel, a request to cancel, refund, amend or rescind a booking is noted on the booking with the time we received it, and that note is kept with the booking.
• Passport copies: deleted from the chat and the mailbox once saved, and from the protected folder after the trip; they are never kept with a booking's correspondence.
• Records of the emails our website sends: one year.
• Privacy requests: our log of your request (its reference, dates and outcome), five years after we close it; the emails themselves follow the correspondence period above.
• IP addresses: kept out of our database; section 5 describes Cloudflare's logs.

After erasure, a request or booking reference stays in our records, and copies of emails that carry it stay in our mailboxes until the correspondence period above ends. Our database's recovery copies can still restore erased data for up to 30 days; once that period ends, our database can no longer restore it. Where data is needed for a case before a court, we keep it until the case ends.

11. Data Security

We protect personal data with technical and administrative measures, among them:

• encrypted connections (HTTPS) to our website and our control panel;
• encryption of our database at rest (AES-256);
• staff access to the control panel only after a Cloudflare Access check and a one-time code sent to the staff member's registered email, with permissions limited by role and a record of every change made in the control panel;
• limits on repeated requests from the same address;
• card details entered only on the card page of Tap Payments;
• booking links stored only as fingerprints (hashes), so our database holds no usable link.

If a breach affects your personal data, we notify the competent authorities within the periods the law sets, including the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it. Where the breach may harm you or your rights, we tell you without undue delay; where you dealt with us as a consumer, we tell you within three days of becoming aware of it.

12. Data Subject Rights

You have the right to:

1. know the legal basis and the purpose of collecting your data, as this policy and the notice beside each form set out;
2. access the personal data we hold about you, and receive a clear copy of it in a common electronic format;
3. ask us to correct, complete or update it, and to restrict its use while we check data you say is inaccurate;
4. ask us to destroy data we no longer need; we keep what a law requires us to keep, and tell you what we kept and why;
5. withdraw your consent at any time where we rely on it;
6. ask us to restrict or object to a use of your data, or to give you your data in a form you can take to another provider; we honour these requests within the period below;
7. ask us to stop electronic marketing; we send none today.

To make a request, email info@aratravel.sa, send a WhatsApp message to or call +966 57 081 8008, or write to P.O. Box 11221, Jeddah 23617. We confirm your identity with a one-time code sent to the email address we hold, or by calling back the number we hold, and we send our answer there. Either check is the only proof of identity we ask for. A person who lacks full legal capacity exercises these rights through their legal guardian.

We answer within ten business days (Sunday to Thursday) of receiving your request. Where a request needs unusual effort, or where you send several requests, we may extend the period once, telling you the reason before it ends; the extended period ends no later than 60 days after we received the request. We may decline a request repeated without justification, and we tell you why.

You may also complain to the Saudi Data and Artificial Intelligence Authority about how the Personal Data Protection Law is applied.

13. Cookies and Browser Storage

Our website uses cookies and similar technologies of two kinds. Those it needs to work, described in the rest of this section, run without consent. Analytics and advertising cookies, which measure visits to our pages and the performance of our advertising, run only after you accept them in the cookie notice; they are set by us or by analytics and advertising providers, who receive data about your visit, such as the pages you visit, your device and browser details, your IP address and the advertisement that brought you to us, and who may process it outside the Kingdom. You may accept or decline them, and change your choice at any time from Cookie settings at the bottom of our pages. We keep your choice in one item, ara-consent, in your browser's local storage (localStorage). The website also keeps an item, ara-theme, in your browser's local storage (localStorage), and only when you choose a light or dark appearance; it holds that choice alone and stays on your device. While you book, pay or open your booking, it keeps the trip you chose, the progress of your checkout, the code in the payment link or the booking link you opened or in the address you return to after paying, and the reference of the booking you are paying for, in your browser's session storage (sessionStorage), so that reloading the page still finds them; all of it is removed when you close the tab. On the checkout page, Cloudflare Turnstile reads technical signals from your browser to confirm that a person is making the booking. The card page of Tap Payments, which opens from our payment page, is run by Tap Payments under its own policy.

14. Children

The person who books must have the legal capacity to enter into the contract (Terms and Conditions, Article 3). Our request and contact forms are for adults. A person who lacks full legal capacity contacts us through their legal guardian. Our booking form asks only for the number of children travelling.

15. Changes to This Policy

We publish any material change to this policy on this page at least 30 days before it takes effect and, where appropriate, tell you by email. The date at the top of this page shows when the policy last changed, and a summary of each change appears beneath it.

16. Contact

Privacy contact: Ara Aljazeera Company For Travel and Tourism (Ara Travel), Al-Olaya Tower, Prince Sultan St. - Jeddah. Email: info@aratravel.sa. WhatsApp and phone: +966 57 081 8008. Postal address: P.O. Box 11221, Jeddah 23617.