Privacy and Data Protection Policy

1.1 Data Controller

Nahr Al Hada Resort — Al-Hada, Al-Tareeq Al-Awsat 9341, Taif Governorate. Email: info@nahralhada.com | Phone/WhatsApp: +966 12 754 4433

1.2 Data We Collect and Why

• National ID/Iqama or Passport: Required by law to register guests through the "Shomos" platform of the Ministry of Interior, mandatory for all tourism accommodation establishments.
• Contact details (mobile number and email): To confirm the booking and communicate about it.
• Financial transaction data: To secure the booking process, processed entirely through our approved online payment gateway, Tap (Tap Payments), without our storing full card details.
• Installment payment data: The "Pay in Installments" option (via Tabby) is one of the payment methods enabled within the Tap gateway itself, not a separate channel. Accordingly, transaction data related to an installment request is processed through Tap's integrated system with the installment service provider (Tabby) for the purpose of assessing and approving the request, and is subject to the privacy and security policies of both Tap and the installment provider.
• Technical usage data (IP address, cookies): To improve the website browsing experience; this can be controlled through browser settings.

1.3 Data Sharing and Security

The resort does not sell your data or share it with any commercial or marketing third party. This data is disclosed or shared only with:

• Authorized government entities as required by law (such as the Ministry of Interior via the Shomos platform, and the Ministry of Tourism), to the extent required by applicable regulations in the Kingdom;
• The approved payment gateway (Tap) and the payment methods enabled through it (including the installment service), limited to the data necessary to process and complete the transaction.

All financial transaction data is received, stored, and processed entirely by the payment gateway (Tap) as the licensed entity for this purpose; the resort does not retain any sensitive payment data on its own systems.

1.4 Your Data Rights

• Access to the data we hold about you, and the right to request correction if inaccurate.
• The right to request deletion of your data where permitted by law.
• The right to withdraw consent to any marketing processing at any time.
• The right to file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) in case of a breach of your rights.

1.5 Data Retention and Policy Updates

We retain your data for as long as necessary to fulfill the purpose for which it was collected, or for the period required by applicable regulations (such as guest records and receipts), after which it is securely deleted. This policy may be updated from time to time, and any update will be posted on this page.