Legal

Privacy policy

Last updated: 21 October 2026

This policy explains what personal data Shdad Tourism collects, why we collect it and the choices you have. Items in [square brackets] are placeholders to be confirmed before this page is final.

Who we are

Shdad Tourism (“Shdad”, “we”, “us”) is a licensed tour operator based in Riyadh, Saudi Arabia (License No: 73101445, CR: 7003334484). We are responsible for the personal data described in this policy and operate the website shdad.sa.

Questions about this policy can be sent to info@shdad.sa.

Information we collect

We collect only what we need to answer your questions, organise your trip and run this website. Depending on how you use the site, this may include:

  • Contact details: your name, email address and phone number when you send an enquiry or make a booking.
  • Booking details: the trip, dates and number of travellers, and the names of the people travelling.
  • Travel documents: [nationality, passport or ID details, only where needed for a booking, visa or permit — confirm what is actually requested].
  • Messages: what you write in our contact form, by email or on WhatsApp.
  • Payment information: payments are handled by [payment provider name]. [We do not store full card numbers on our servers — confirm.]
  • Technical data: your IP address, browser, device and pages visited, collected through cookies and similar technologies.

How we use your information

  • To reply to your enquiries and provide quotes.
  • To confirm, manage and deliver your booking, including arranging guides, transport and accommodation.
  • To take payment and send confirmations, receipts and itineraries.
  • To keep you informed about your trip, such as changes or safety information.
  • To keep the website secure, understand how it is used and improve it.
  • To meet our legal and licensing obligations.
  • [To send news or offers, only if you have agreed — confirm whether marketing emails are used.]

Legal basis

We process personal data under the Saudi Personal Data Protection Law (PDPL) and its regulations. Our bases are your consent, the need to carry out the contract you have with us, our legitimate interests in running the business, and our legal obligations. [Confirm the wording with your legal adviser.]

Who we share it with

We share personal data only where it is needed to deliver your trip or run our business, and only with:

  • Local partners who provide your trip, such as guides, drivers, hotels and activity providers.
  • Our payment provider: [name].
  • Our website, hosting and email providers.
  • Government or licensing authorities, where the law requires it.

[We do not sell your personal data — confirm.]

Transfers outside Saudi Arabia

Some of our service providers may process data outside the Kingdom. Where this happens we take steps to protect your data as required by the PDPL. [List the countries or providers if known.]

Cookies

We use cookies that are needed for the site to work, such as keeping your booking and chosen currency. [We also use analytics or marketing cookies: list them, or remove this line if none are used.] You can block or delete cookies in your browser settings, but parts of the site may then stop working.

How long we keep it

We keep personal data only as long as we need it for the purposes above, and for as long as the law requires us to keep booking and accounting records. [State retention periods, for example: enquiries for X months, bookings for X years.]

Your rights

Under the PDPL you have the right to:

  • know what personal data we hold about you and ask for a copy;
  • ask us to correct data that is wrong or incomplete;
  • ask us to delete your data, where the law allows;
  • withdraw your consent at any time, where we rely on it;
  • complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

To use any of these rights, email info@shdad.sa. We may need to confirm who you are before we act on a request.

Security

We use reasonable technical and organisational measures to protect your data. No method of sending or storing data is completely secure, so we cannot guarantee absolute security.

Children

Our website is not aimed at children. Where a booking includes travellers under 18, the booking must be made by a parent or guardian.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

Contact us

Shdad Tourism, [street address], Al Mouroj District, Riyadh, Saudi Arabia
info@shdad.sa