Privacy Policy

Aligned with the principles of the Personal Data Protection Law (PDPL) and its regulations in Saudi Arabia. We review it periodically; it is subject to legal review before final adoption.

Who is responsible for your data

Masar Rahlati (Riyadh, Saudi Arabia), a business verified by the Saudi Business Center. Privacy contact: info@masar-rahlati.com.

What we collect

• Contact details: name, mobile, email.
• Request data: destination, number of travelers, nationality, and service details.
• Documents you upload: national ID/iqama, passport, and attachments needed to deliver the service.
• Basic technical data to run the site (session cookies only — see our Cookie Policy).

Why we collect it (purpose & legal basis)

We process your data solely to fulfill the service you requested (performance of a contract), or based on the explicit consent you give when submitting a request and uploading documents. We do not use your data for marketing without your permission, and we make no automated decisions that significantly affect you without human involvement.

Sensitive documents

Encrypted, accessed via temporary signed links, seen only by authorized staff as needed, and deleted automatically 90 days after the request is closed.

Sharing & disclosure

We share only the minimum necessary with embassies, visa centers and booking partners to complete your service, or where required by applicable law. We never sell your data and do not share it for advertising.

Cross-border transfer

Some data may be processed or stored with trusted infrastructure providers whose servers may be located outside the Kingdom, within the controls permitted by the PDPL and while maintaining the required level of protection.

Retention

We keep your data for as long as needed to provide the service and as required by law; documents are deleted 90 days after the request is closed.

Data security & breach notification

We apply technical and organizational measures — including encryption, temporary links and access control. If a breach affecting your data occurs, we notify the competent authority and affected individuals within the statutory timeframes.

Your rights

You have the right to access, correct and delete your data, obtain a copy of it, withdraw consent at any time (without retroactive effect), object to processing, and lodge a complaint with the competent authority. Exercise these from your dashboard or by contacting us; we respond within the statutory timeframes.

Minors

Our services are intended for adults; minors' data is submitted by a guardian and only for the service purpose.