Personal data means any information about an individual from which that person can be identified.

Website Visitors

Qiddiya may collect and obtain the following types of personal data directly or indirectly when you interact with our website or contact us by telephone, email or in writing:

• Personal identifiers: email, phone number, first name, last name, submit through our website contact us page.

• Location information: location information provided by a mobile or other device interacting with our website or associated with your IP address or other online or device identifier, where we are permitted by law to process this information.

• Essential browser data and trackers IP address and other website tracking information through “essential cookies”.

• Optional browser data and trackers: IP address, browser/device type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency, and other website tracking information through “optional cookies”.

• Applicants and Candidates - For Recruitment Activities, QIC may collect and process your information to manage your job application for the relevant role.

For Recruitment Activities, Qiddiya may collect and obtain the following types of personal data:

• Recruitment information: Personal identifiers (name, date of birth, nationality), contact information (address, email, phone), professional information (CVs, educational history, work experience, skills, references, compensation expectations), assessment data (interview notes, test results, background check results where lawful), immigration status, and any other information you elect to submit. Where lawful and relevant for a particular role, we may also collect sensitive or “special category” data, such as health data, strictly in accordance with applicable laws.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity.

Failure to collect the required personal data may result in the consequences or risks, including inability to process job applications, track Recruitment Activities, handle customer support requests submitted via our website, restrict our ability to engage effectively with website users or improve website services, inability to tailor services or communications to users’ needs, potentially reducing the effectiveness and relevance of our offerings.

We collect your personal data as follows:

• Information you give us: Directly from you when you:

a. request or purchase products, services or information from us, register with us, visit our physical properties, call our service numbers, or otherwise interact with us.

b. submit information by filling in online forms, or by corresponding with us, in each case, including via our interactive services.

• Information collected automatically: Indirectly via:

a. certain technologies, such as cookies, pixels, tags, APIs, including when you visit our websites and applications; or

b. use of analytics tools, including when you visit our sites or use our applications.

• Information from third parties: For Recruitment Activities, we may collect personal data from third parties, such as professional networking sites, recruiters, background check providers, public databases, and references you have authorized us to contact.

At Qiddiya, we may process the above types of personal data collected in connection with Qiddiya’s Website according to the lawful basis for processing personal data, and we rely on your consent for the following activities:

• Direct marketing and advertising: when we promote Qiddiya services to you based on your interests and behavior including marketing and promotional activities, targeted announcements relating to events, newsletters or alerts. You can ask us to stop sending you marketing communications at any time by contacting us or following the opt-out links in our marketing communications. If you opt-out of receiving marketing communications, you will still receive service-related communications that are necessary for customer service purposes.

• Customer retention and loyalty program: when we engage with you for our loyalty programs (Points and Rewards).

• Ride photos: your ride images in our advertisements, social media, and website.

• Recruitment activities: during administration, evaluation, and progressing in Recruitment Activities, including verifying information, assessing qualifications, extending offers, and, if successful, creating an employment record. Please note that personal data you submit during the job registration process, the jobs you view and apply for, and any messages exchanged through our third party are subject to the third party’s privacy notice. For further details on how your data is used by the third party, please visit the relevant privacy or cookie notices on their websites.

If any activity has relied on your consent, you may withdraw that consent at any time. If you decline to provide personal data, we may be unable to provide you with the relevant service or offering as described above.

We rely on performance of our contractual obligations to Manage our relationship with you including registering your account and managing our loyal programs, notifying you about changes to our terms or Privacy Notice, dealing with your requests, complaints and queries, replying to your messages or managing other submissions from you to communicate with you.

We rely on our legitimate interests to operate a successful business for the following activities:

• To administer and protect our business and our website.
• To deliver relevant website content to you and measure or understand the effectiveness of our content.
• To ensure site security, such as when we monitor traffic to identify whether the site is being used as expected.
• To operate, understand and enhance our services, maintaining our customer relationships and offer you a better guest experience.
• To engage with you on social media platforms to provide information, respond to inquiries, and promote our events.
• To detect, investigate and prevent activities that may violate our policies, pose safety issues or be fraudulent or illegal.
• In relation to Recruitment Activities, to evaluate and select candidates, verify information, maintain records of the recruitment process, and to improve our recruitment practices.

In addition, we may use your personal data as follows:

• To comply with our applicable legal obligations.
• If the Processing serves your actual interests and communicating with you is impossible or difficult.

Qiddiya will retain your personal data and store it using cloud service providers or on premises servers for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations.

When personal data is no longer required, we securely dispose of, anonymize or de-identify it. If we anonymise or deidentify your personal data, we may use this data indefinitely without further notice to you. When disposing of your personal data we use digital or physical deletion methods such as shredding or secure deletion program to ensure that the data cannot be accessed, reconstructed, or recovered.

We have in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We may disclose your personal data to third parties for the purposes set out above, including to the following third parties:

• With our subsidiaries and affiliates, and entities within the Qiddiya corporate family.

• With our service providers performing services on our behalf. These companies are prohibited from using your personal data for purposes other than those requested by us or as required by law.

• With third parties when you direct us to share your personal data with third party sites or platforms, such as social networking sites.

• With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

• With third parties to ensure the safety and security of our customers and third parties, to protect our rights and property and the rights and property of our customers and third parties, to comply with legal processes, or in other cases if we believe in good faith that disclosure is required by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. 

The data that we collect from you may be accessed from, transferred to, and stored and used in countries outside the Kingdom, by us and by our third party service providers or partners. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice.

Where legally required under the KSA PDPL and Regulations, transfers of personal data outside the Kingdom will take place to jurisdictions deemed to provide an adequate level of protection for personal data by the relevant competent authority in the Kingdom or alternatively will take place on the basis of an appropriate safeguard or exception.

Subject to applicable privacy laws, you may be able to exercise certain rights in relation to your personal data, including:

• The right to be informed: You have the right to be provided with information about how we use your personal data, and about your rights.

• The right to access: You have the right to access your personal data held by us.

• The right to obtain a copy: You have the right to obtain a copy of your personal data held by us.

• The right to request rectification: You can request the correction or update of any incomplete, inaccurate, or outdated personal data that Qiddiya has collected.

• The right to request destruction of personal data: You have the right to request the deletion of your personal data collected by Qiddiya, including any data shared with third parties. However, please note that Qiddiya may retain such information in accordance with applicable laws and regulations.

• The right to withdraw consent: Where we rely on consent to process your personal data, you have the right to withdraw this consent at any time. You can withdraw consent by filling out the Data Subject Request Form online or or by emailing  DataOffice@qiddiya.com with the same information requested in the Data Subject Request Form.

• The right to file a complaint: You have the right to file complaint with us or to the competent authority when you feel that your rights have not been met.

Unless required by law, you will not incur any fees for exercising this right.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We will respond to all legitimate requests within 30 days of receiving it, however, it may take us longer if your request is particularly complex.

You may submit a request to exercise your rights by filling out the Data Subject Request Form online or by emailing  DataOffice@qiddiya.com with the same information requested in the Data Subject Request Form.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. Your rights may also depend on the jurisdiction in which you reside. 

While we take reasonable steps to protect your personal data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access to your personal data you may be aware of.

We recognise the need to provide further privacy protection with respect to personal data we may collect from children on our website. If we collect personal data of a child under the age of 18 through our website, we would only process this data to directly respond to user’s request without using their personal data for any other purposes.

The child’s data will not be processed without notifying the child’s parent or guardian of the request except if there is a legal justification for Qiddiya to process the data specified by applicable law, regulations, or for security reasons.

Our website may contain links to third-party websites or services that are not operated or controlled by us. This Privacy Notice does not apply to such third-party websites or services, and we are not responsible for their privacy practices, content or their use of your information. We encourage you to review the privacy notices of those third parties before providing any personal data to them.

We take our responsibility to protect your personal data very seriously. Although we do our best to protect your personal data, we cannot guarantee the security of your information transmitted through the Website, over email or any other digital channel; any transmission is at your own risk.

From time to time, we may modify or update this Privacy Notice, including to reflect changes in our privacy practices and legal obligations or in accordance with applicable data protection laws and regulations. Please check the Website for the current version of our Privacy Policy.

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Policy, the English language version will prevail.