Privacy Policy
Touracos respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, process, store, disclose, and protect personal data when you use the Touracos website, create an account, make a booking, contact us, or participate in our services and experiences.
Personal data is processed in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations.
1. Scope of This Policy
This Policy applies to personal data processed through the Touracos website and in connection with accounts, bookings, communications, services, and experiences offered by Touracos.
Touracos acts as the Data Controller where it determines the purposes and means of processing personal data, to the extent provided under applicable law.
2. Personal Data We May Collect
Depending on how you use our website and services, we may collect the following categories of personal data:
- Identification and contact information, such as your name, telephone number, email address, and other identifying information you provide to us.
- Account information, including login information, preferences, and account settings.
- Booking information, including the selected experience, date, number of participants, requested services, and booking status.
- Transaction information, such as booking value, payment status, and transaction or payment reference numbers. Where payments are processed by an independent payment provider, payment information is handled in accordance with applicable laws and the provider's own privacy practices.
- Information relating to special, dietary, mobility, or health requirements where necessary to provide a particular experience or protect participant safety.
- Communications data, including enquiries, feedback, complaints, and correspondence with the Touracos team.
- Technical and usage information, such as IP address, device type, browser, operating system, pages visited, and dates and times of access.
- Communication and marketing preferences.
- Approximate location information derived from technical data. More precise location information may only be collected where a service feature requires it and the necessary permission has been obtained.
3. How We Collect Personal Data
We may collect personal data:
- Directly from you when you create an account, make a booking, complete a form, or contact us.
- Automatically when you use the website through cookies and similar technologies.
- From service providers or partners involved in processing payments, fulfilling bookings, or delivering an experience, where permitted by applicable law.
4. How We Use Your Personal Data
We may process your personal data to:
- Create and manage your account and verify your identity where necessary.
- Receive, confirm, manage, amend, or cancel bookings.
- Deliver booked experiences and services.
- Process payments, refunds, and transactions.
- Communicate with you about bookings, operational changes, instructions, or information relating to an experience.
- Provide customer support and respond to enquiries and complaints.
- Personalize and improve your website and service experience.
- Protect the website and user accounts and detect fraud, misuse, and security risks.
- Analyse website performance and improve our services and experiences.
- Meet legal, regulatory, accounting, and compliance obligations.
- Send offers, news, or marketing communications where we have an appropriate lawful basis, including obtaining consent where required.
We will not process your personal data for a purpose that is incompatible with the purpose for which it was collected unless such processing is permitted by applicable law.
5. Lawful Basis for Processing
Depending on the processing activity, Touracos may rely on one or more lawful bases permitted under applicable law, including:
- Performing a contract or taking steps in connection with a booking or service you have requested.
- Your consent, where consent is required.
- Compliance with a legal or regulatory obligation.
- Touracos' legitimate interests where permitted by law and after appropriately considering your rights and interests.
- Protecting an actual interest of the Data Subject where permitted by applicable law.
Where processing is based on your consent, you may withdraw that consent in accordance with applicable law.
6. Sensitive Data and Safety Information
Certain experiences may require limited information concerning health conditions, allergies, mobility, or other special requirements in order to protect Guest safety or determine whether an experience is suitable.
Such information will only be requested where necessary and will be processed in accordance with the additional legal requirements applicable to sensitive personal data, including obtaining explicit consent where required.
7. Sharing and Disclosure of Personal Data
Touracos does not sell or rent your personal data.
We may disclose the minimum amount of personal data necessary to:
- Payment service providers.
- Hosting, technology, and cybersecurity providers.
- Communication and customer support providers.
- Operational partners, guides, transportation providers, and other parties involved in delivering your experience.
- Analytics service providers, subject to applicable legal requirements.
- Professional advisers where necessary.
- Governmental, regulatory, judicial, or law-enforcement authorities where disclosure is required or permitted by law.
- A party involved in a merger, acquisition, restructuring, or transfer of the business, subject to applicable data protection requirements.
We seek to limit any disclosure to the personal data reasonably necessary for the relevant purpose.
8. Cookies and Similar Technologies
The website may use cookies and similar technologies to operate essential features, maintain user sessions, remember preferences, enhance security, understand how the website is used, and improve its performance.
Non-essential cookies may require your consent depending on their purpose and applicable legal requirements. You may also be able to manage certain cookies through your browser settings or any consent management tools made available on the website.
Disabling essential cookies may affect the availability or proper functioning of certain website features.
9. Data Retention and Destruction
We retain personal data for as long as necessary to fulfil the purpose for which it was collected or for any period required by applicable legal, regulatory, accounting, or contractual obligations.
Once personal data is no longer required and there is no lawful basis for retaining it, we will securely destroy or anonymize it in a manner designed to prevent its recovery or association with the Data Subject, in accordance with applicable requirements.
10. Data Security
Touracos implements appropriate administrative, organizational, and technical measures designed to protect personal data against unauthorized access, use, disclosure, alteration, loss, or destruction.
However, no method of electronic transmission or storage can be guaranteed to be completely secure. We therefore review and enhance our safeguards in a manner appropriate to the nature of the data and the risks associated with its processing.
11. Your Personal Data Rights
Subject to the Personal Data Protection Law and other applicable requirements, you may have the right to:
- Be informed of the lawful basis and purpose for the collection and processing of your personal data.
- Access the personal data held about you by Touracos.
- Request a copy of your personal data in a readable and clear format, subject to applicable legal requirements.
- Request the correction of inaccurate data, completion of incomplete data, or updating of outdated data.
- Request the destruction of your personal data where the applicable legal conditions are met.
- Withdraw consent where consent is the lawful basis for processing.
Certain rights may be subject to exceptions or limitations provided by applicable law.
Requests relating to these rights may be submitted through the official Touracos contact channels published on the website. We may request reasonable information to verify the identity of the person making the request before acting upon it.
12. Marketing Communications
We may send you information about Touracos offers, experiences, or services where permitted by applicable law.
You may opt out of marketing communications at any time using the unsubscribe method provided or by contacting us.
Opting out of marketing communications will not prevent us from sending essential operational communications relating to an existing booking, transaction, or service you have requested.
13. Children and Minors
The website is not intended to enable minors or persons without the required legal capacity to make bookings independently.
Where an experience includes minors, any personal data relating to them should be provided by a parent, legal guardian, or other legally authorized person and will be processed in accordance with the applicable requirements governing personal data relating to persons with limited or no legal capacity.
14. Third-Party Links and Services
The website may contain links to, or integrate services provided by, third parties such as payment gateways, mapping services, and social media platforms.
Personal data processed directly by such third parties is subject to their respective privacy policies. We encourage you to review those policies before using third-party services.
15. Changes to This Privacy Policy
Touracos may update this Privacy Policy from time to time to reflect changes in our services, applicable laws and regulations, or our data processing practices.
The updated version will be published on the website together with a revised “Last Updated” date. Additional notice may be provided where a change is material or where required by applicable law.
16. Contact and Privacy Requests
For questions, concerns, or requests relating to your personal data, this Privacy Policy, or the exercise of your privacy rights, please contact Touracos through the official contact details published on the website.
Where applicable, Data Subjects may also submit a complaint to the competent personal data protection authority in the Kingdom of Saudi Arabia in accordance with applicable procedures and regulations.
17. Language
This Privacy Policy is available in Arabic and English. In the event of any inconsistency or conflict between the Arabic version and any translation of it, the Arabic version shall prevail to the extent permitted by applicable law.