Privacy Policy

Absolutely! Let’s dive deeper into each section of Sphinx Travel’s Privacy Policy and Terms of Use

Introduction: Welcome to Sphinx Travel! This Privacy Policy explains how we collect, use, disclose and protect your personal information when you interact with our website, book tours or use our services. By using our website or services, you consent to the collection and use of your personal information as described in this policy.

The information we collect:

Personal information: When you make a reservation or contact customer support, we may collect personal information such as your name, contact details (email address and phone number) and payment information (credit card details and billing address). Information collected automatically: We may also collect information automatically through cookies and similar technologies when you visit our website. This may include your IP address, browser type, device identifiers, and browsing behavior.

How we use your information:

We use your personal information for the following purposes To process and manage your reservations, including sending you booking confirmations and updates. To communicate with you about your bookings, respond to your inquiries and provide customer support. To personalize and improve our services, including customizing recommendations and offers based on your preferences. To send you promotional communications, newsletters and updates about our products and services, where you have opted in to receive such communications. To comply with legal obligations: Such as tax and regulatory requirements. Information Sharing: We may share your personal information with the following parties:

Service providers:

We may disclose your information to third-party service providers who help us provide our services, such as payment processors, IT service providers and marketing agencies.
Legal authorities:

We may disclose your information to legal authorities or government agencies when required by law or to protect our rights, property or safety or the rights, property or safety of others. Data Security: We take appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure or destruction. These measures include encryption, access controls, and regular security assessments.

Your rights: You have the following rights in relation to your personal information:

Right of access: You have the right to access and obtain a copy of the personal information we hold about you. Right to rectification: You have the right to request correction of any personal information that is inaccurate or incomplete. Right to erasure: You have the right to request that we delete your personal information, subject to certain exceptions. Right to object: You have the right to object to the processing of your personal information for direct marketing purposes or for reasons relating to your particular situation. Right to restrict processing: You have the right to request that we restrict the processing of your personal information in certain circumstances. Cookies: We use cookies and similar technologies to improve your browsing experience, analyze website traffic, and personalize content and advertising. By using our website, you consent to the use of cookies in accordance with this policy. You can manage your cookie preferences through your browser settings.

Policy updates:

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the “last updated” date at the top of the policy.

Terms of use:

Acceptance of Terms: By accessing or using our Site or Services, you agree to be bound by these Terms of Use. If you do not agree with any part of these Terms, please do not use our Site or Services.

Booking and payment: By making a reservation through our website, you represent and warrant that all information provided is accurate, complete and current. Payment for reservations is subject to our pricing and cancellation policies, which you agree to abide by when you make a reservation. Intellectual Property: All content on our website, including text, graphics, logos, images and software, is the property of Sphinx Travel or its licensors and is protected by copyright, trademark and other intellectual property laws. You may not reproduce, modify, distribute or publicly display any content without our prior written consent.

Limitation of Liability: To the fullest extent permitted by law, we disclaim liability for any direct, indirect, incidental, consequential or punitive damages arising from your use of our website or services, including but not limited to loss of profits, loss of data, or loss of goodwill.

governing law and dispute resolution: These Terms of Use are governed by the laws of [Jurisdiction]. Any disputes arising out of or relating to these Terms of Use shall be

shall be resolved exclusively through binding arbitration in [place of arbitration], conducted in accordance with the rules of the [arbitration organization].

Changes to the terms:

We reserve the right to update or modify these Terms of Use at any time without prior notice. Any changes will be effective immediately upon posting on our website. Your continued use of our website or services following any such changes constitutes your acceptance of the amended terms.

Please note that this is a comprehensive draft and may need to be customized or expanded based on the specific practices and legal requirements of Sphinx Travel and the jurisdiction in which it operates. It is recommended that you review this draft with your legal professionals to ensure compliance with applicable laws and regulations.

Who are we and what do we do?

Developing the tourism sector by building partnerships with relevant stakeholders and coordinating with destinations and attractions around the world to maximize targeted visits. We are also responsible for various types of consumer-level engagement in the tourism sector, including across consumer-facing digital platforms.

Sphinx Travel considers it important to protect your personal data and endeavors to process it in accordance with applicable data protection laws and regulations and for the purposes of applicable data protection law, Sphinx Travel is the controller (the person responsible for determining how your personal data is processed) and responsible for your personal data.

What is the purpose of this document?

• Sphinx Travel respects your privacy and is committed to protecting your personal data. Sphinx Travel has adopted this Privacy Notice to notify (“you”, “your”) of the personal data collected, used and processed about you, how you can expect your personal data to be used and for what purpose. It is important that you read this Privacy Notice so that you are aware of how and why we use this information and what your rights are under applicable data protection law.
• This notice:

(a) applies to anyone who visits or uses the digital platforms

(b) Specifies the types of personal data we collect about you.

(c) explains how and why we collect and use your personal data.

(d) Indicates how long we retain your personal data.

(e) Explains how we will share your personal data – when, why and with whom.

(f) Explains your rights as a data subject.

(g) sets out the legal bases we have for using your personal data.

(h) Explains the impact of refusing to provide the requested personal data.

(c) Explains the different rights and options you have as a data subject when it comes to your personal data.

(j) Explain how we use automated decision-making and/or characterization – when and why.

The Digital Platforms are not intended for children under the age of 18, and we do not knowingly collect personal data from children.

Adherence to data protection principles

We will implement measures designed to comply with applicable data protection law, including measures designed to ensure that the personal data we hold about you is:

(a) Use them legally, fairly and in a transparent manner.

(b) is collected only for the valid purposes that we have clearly explained to you and is not used in any way that is inconsistent with those purposes.

(c) Relevant to the purposes we have told you about and limited only to those purposes.

(d) Accurate and up-to-date.

(e) Retained only for as long as necessary for the purposes we have told you about.

(f) Securely stored.

(g) continue to use appropriate measures and records in a manner that allows us to demonstrate compliance with applicable data protection law.

Changes to this privacy notice

We may change/update this notice at any time in the future, at our sole discretion. Any changes will be effective immediately upon posting the revised notice. If the changes are material, we will provide you with additional notice, for example through a banner on our website or by sending an updated version of this Notice in writing to you, including electronically where appropriate, unless you request a different delivery format. (You can request it in a different format by contacting us through this form).

What personal data do we collect about you?

• We collect your personal data for the purposes listed below in the tables. (The specific purposes vary according to the digital platform.)
• “Personal Data” means any data, regardless of its source or form, that may lead to the specific identification of an individual, or may directly or indirectly enable the identification of an individual, including name, personal identification number, addresses, contact numbers. License numbers, records, personal assets, bank and credit card numbers, photos and videos of the individual, and any other data of a personal nature, Personal Data does not include data containing identity that has been completely removed (e.g., completely anonymized or aggregated data), however, it may still include pseudonymized data. Under applicable data protection law, there may be certain types of personal data that are more sensitive and require a higher level of protection (“Sensitive Data”). Sensitive Data may include details about your race or ethnic origin, your religious or philosophical beliefs, information about your health, and your genetic and biometric data. Information about criminal convictions and offenses may also be considered sensitive and warrant this higher level of protection.
• We do not normally collect or process sensitive data. These categories of personal data usually require stricter security measures (technical and organizational measures) during processing under applicable data protection law. In the exceptional case where we may be required to collect and process such personal data, we will only collect it from you, and also obtain your explicit consent to process such data, where permitted by law, such as where one of the legal conditions applies to the processing of sensitive data detailed in Table 2. Where required by applicable data protection law, we will collect separate consent from you before processing your sensitive data.
• We may also collect, use and share “Aggregated Data” (as defined in applicable data protection law) for any purpose to the extent permitted by applicable data protection law. Aggregate Data may be derived from your Personal Data but is generally not considered personal data under applicable data protection law because such data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data in accordance with applicable data protection law to calculate the percentage of users who access a particular feature of the digital platform. However, if we combine or link the aggregated data with your personal data so that it can directly or indirectly identify you, we treat the aggregated data as personal data, which will be used in accordance with this Privacy Notice.

What happens if you do not provide us with the personal data we request or ask us to stop processing your personal data?

If you do not provide us with the necessary personal data, or ask us not to process your personal data, we may not be able to perform the activities you expect from us (for example, providing you with information, goods or services) or we may be prevented from complying with our legal obligations. In this case, we may have to refuse your request or not meet your expectations – in which case we will endeavor to notify you.

Where do we collect personal data about you?

Below are the different sources from which we may collect personal data about you:

• From you directly. This is personal data that you provide to us, such as by visiting our digital platforms or through direct correspondence with us, or through other direct interactions with us such as completing a form on our digital platform, applying for our products or services, applying to work with us on our digital platform, creating an account on our digital platform, subscribing to our service or publications, requesting that we send you marketing, entering a contest or prize draw, promotion or survey, providing feedback, contacting us by any means to make a complaint or inquiry, etc.
• From an agent/third party acting on your behalf.
• From publicly available sources. We may use the following public sources:

(a) Social media.

(b) Events (e.g. conferences).

(c) Evidence.

• from analytics providers, ad networks, search information providers, technical service providers, payment services (i.e., third-party payment gateways) and delivery services.
• through any marketing communications that we may send to you, or through email communications sent by us or received by us. You may opt out of receiving promotional emails from us at any time by following the instructions in the emails to click on the unsubscribe link or email us at the email address shown in Section 19 below with the word unsubscribe in the subject field of the email. Please note that you cannot unsubscribe from non-promotional emails, such as those related to transactional relationships.
• Through automated technologies or interactions. As you interact with our digital platform or download/install our app(s), we will automatically collect technical data about your devices, browsing actions and patterns. We collect this personal data using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other digital platforms that use tracking technologies, including cookies. Please see our Cookie Policy for more details.

How and why do we use your personal data (legal basis for processing and purposes of collecting and processing personal data)?

• We want to give you the best of both worlds

A user/customer-friendly experience while fulfilling our role as a tourism authority. To do this, we need to paint an accurate picture of who you are and what your preferences are, by combining different types of personal data we have collected about you.

• We will only use your personal data when we are permitted to do so by law, including applicable data protection law. Under applicable data protection law, it may be necessary to justify the use of personal data under one of the legal grounds (legal basis for processing). This means that we will only collect personal data for specific, explicit and legitimate purposes, and must only process personal data in a matter incompatible with those purposes in limited circumstances. We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.
• We may use your Identity Data, Contact Data, Technical Data, Usage Data and Profile Data to form a view about what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant to you. You will receive such marketing communications from us if you have requested information from us or purchased/received goods or services from us and have opted in to receive such marketing. You can ask us or our affiliates to stop sending you marketing messages at any time – by logging into the Digital Platform and adjusting your marketing preferences, by following the unsubscribe links in any marketing message sent to you, or by contacting us at any time. (Opting out of receiving marketing messages will not affect any transactional or service messages we need to send to you in the context of transactions or services).
• In short, we use your personal data to allow us to fulfill our contract with you, provide you with the best possible customer experience in line with our legitimate interests, and enable us to comply with all our legal obligations. The specific purposes for which we will process your personal data and the corresponding legal basis for the processing are listed in the tables. Please note that we may process your personal data without your knowledge or consent, in accordance with the above rules, where this is required or permitted by law.

How long do we keep your personal data?

• We will retain your Personal Data only for as long as is reasonably necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe that there is a prospect of litigation in relation to our relationship with you.
• We take into account the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means and applicable legal, regulatory, tax, accounting, accounting or other requirements – to determine the appropriate retention period for the personal data.
• In some circumstances, we may anonymize your personal data so that it cannot be linked to you, in which case we may retain and use this information without further notice to you. Once you are no longer (as applicable) our customer, user or employee, we will retain and securely destroy your personal data in accordance with applicable data protection law.

Who do we share your personal data with?

• Our employees have access to your personal data to perform their duties. We may share your personal data with other relevant entities to perform our role in the Saudi tourism ecosystem, in the context of evaluating or reporting on activities or our performance, in the context of reorganizing Sphinx Travel, to support system maintenance and data hosting, and for other operational reasons of this nature.
• We may also share your Personal Data with our service providers (known as “Trusted Third Parties”) involved in providing the information or services you have requested from us via our digital platforms for legitimate purposes in order to help us run our business. We rely on these Trusted Third Parties for a range of our business processes and service delivery. We have agreements in place with these service providers to protect the confidentiality of your personal data. We do not share your personal data with third parties for their marketing purposes, except with your specific consent.
• If we share your personal data with trusted third parties, we:

(a) We will only provide them with the information necessary for their specific services/purpose.

(b) enter into appropriate contractual arrangements designed to ensure that they may only use your personal data for the specific purposes we have specified in our contract with them.

(c) Collaborate closely with our trusted third parties to ensure the protection of your privacy and personal data.

(d) When we stop using our trusted third-party services, we ensure that any data they hold is securely deleted or put out of use.

• In short, our trusted third parties include:

(a) Third-party payment gateway providers.

(b) Suppliers/Service Providers (such as delivery companies, e-commerce service providers, technicians involved in complaint handling or fraud management, IT companies and service providers that support our digital platform).

(c) Professional advisors (such as bankers, auditors, and lawyers).

(d) Insurance (e.g. insurance brokers).

(e) Direct marketing companies that assist us in our electronic communications with our customers.

(f) Outsourcing certain business functions. For example, we may use our outsourced service centers for functions such as document and information management, office support, technology, IT services, word processing, transcription, and translation services (we have agreements in place with these service providers to protect the confidentiality and security of information (including Personal Data) shared with them).

• We may also share your Personal Data with vendors and other parties for analytics and advertising purposes. These parties may act as our service providers or, in certain contexts, independently decide how to process your Personal Data. These third parties may include the following:

(a) Social media channels (such as Instagram and Facebook) to show you interesting products as you browse the internet, depending on whether you accept cookies on our digital platform (see our Cookie Policy) or consent to direct marketing.

(b) Data analytics/insights companies to help us ensure that your details are kept accurate and up-to-date.

• We may, from time to time, be required to disclose your Personal Data to authorities, such as police, law enforcement, regulatory and/or government agencies, in connection with investigations or legal proceedings conducted anywhere in the world, if required to do so by applicable law or regulation, or if we reasonably believe it is necessary to protect STA, other customers or the public. We will normally notify you before responding to such inquiries, unless circumstances prevent us from doing so. We take your privacy seriously and handle such requests on a case-by-case basis.

What happens if there is a change in control?

If there is a change in the organization of Sphinx Travel, or a restructuring of governmental authorities responsible for tourism, the new “successor” entity may use your Personal Data in the same manner as set forth in this Privacy Notice and your Personal Data may be transferred to that new entity in accordance with the terms of this Notice.