Skip to content
Sign In Sign Up
Become a Guide

Privacy Policy

1. Introduction

LEGACY respects the privacy of its users and is committed to protecting their personal data and processing it in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia.

This Privacy Policy explains how LEGACY collects, uses, stores, shares, and protects personal data, as well as the rights of data subjects and how they may exercise those rights.

By using or registering on the LEGACY platform, you acknowledge that you have read this Privacy Policy.

2. Data Controller

Erth Al-Hayah Establishment (مؤسسة إرث الحياهـ) is the entity responsible for determining the purposes and methods of processing personal data collected through the LEGACY platform, depending on the nature of the processing activities.

Contact Information:

Email: xxx@legacy.sa

Phone: +966501107316

Address: Makkah, Kingdom of Saudi Arabia

If a Personal Data Protection Officer (DPO) is appointed, their contact details will be:

Data Protection Officer: ؟؟؟؟؟؟ ؟؟؟؟؟؟

Email: xxxxx@legacy.sa

3. Personal Data We May Collect

Depending on how you use the platform, we may collect the following information:

A. Account Information

  • Full name.
  • Email address.
  • Phone number.
  • Password or authentication credentials.
  • Language preferences and settings.

B. Tourist Information

  • Booking details.
  • Number of participants.
  • Contact information required to conduct the tour.
  • Information provided for the operational purposes of the booking.

C. Tour Guide Information

  • Name.
  • Profile picture.
  • Contact information.
  • Tourism license number.
  • Certifications and qualifications.
  • Languages spoken.
  • Areas of specialization.
  • Professional experience.
  • Bank account details required for financial settlements.
  • Photos, videos, and other content uploaded by the tour guide.

D. Payment Information

Payment-related data may be processed through an authorized payment service provider.

LEGACY does not intend to store complete payment card details when such information is processed directly by the payment service provider, depending on the technical infrastructure used.

E. Technical Information

This may include:

  • IP address.
  • Device type.
  • Operating system.
  • Browser type.
  • Login records.
  • Platform usage data.
  • Technical information related to performance and security.

4. Why We Collect Personal Data

We use personal data for purposes necessary to operate the LEGACY platform, including:

  • Creating and managing user accounts.
  • Verifying tour guides’ identities and licenses.
  • Displaying tour guide profiles.
  • Managing and fulfilling bookings.
  • Processing payments.
  • Settling payments owed to tour guides.
  • Communicating regarding bookings.
  • Providing customer support.
  • Handling complaints.
  • Evaluating and improving the platform.
  • Protecting the platform against fraud and misuse.
  • Complying with legal and regulatory requirements.
  • Sending promotional offers and direct marketing communications when legally permitted and supported by an appropriate legal basis.

LEGACY adheres to the principles of purpose limitation and data minimization and does not collect personal data that is unnecessary for achieving the specified purpose, in accordance with the principles outlined by the Saudi Data and Artificial Intelligence Authority (SDAIA).

Reference: National Open Data Portal

5. Legal Basis for Processing Personal Data

Depending on the nature of the processing activity, LEGACY may rely on one of the legally permitted bases for processing personal data, including:

  • Performing a contract or taking steps at the request of the data subject before entering into a contract.
  • Compliance with legal obligations.
  • Consent of the data subject, where consent is the appropriate legal basis.
  • Pursuing legitimate interests in accordance with applicable legal requirements.
  • Other circumstances permitted under applicable laws and regulations.

Withdrawal of consent does not invalidate processing activities carried out on another lawful basis.

6. Sharing Personal Data

LEGACY may share personal data, to the extent necessary, with:

  • Tour guides, for the purpose of fulfilling bookings.
  • Payment service providers.
  • Hosting and cloud computing service providers.
  • Messaging and email service providers.
  • Technical support providers.
  • Verification service providers.
  • Government or regulatory authorities when legally justified.

Personal data is not shared without a specific purpose. Any disclosure is limited to what is necessary and must be supported by an appropriate legal basis.

SDAIA emphasizes that the disclosure of personal data must be associated with a specific purpose, limited to the minimum information necessary, and carried out with due consideration for the privacy of other individuals.

Reference: National Open Data Portal

7. Sharing Tourist Information with Tour Guides

When a booking is made, the tour guide may receive the information necessary to conduct the tour, such as:

  • Tourist’s name.
  • Required contact information.
  • Booking details.
  • Number of participants.
  • Information needed by the tour guide to deliver the service.

Tour guides are not permitted to use this information for independent or unauthorized purposes.

8. Publicly Displayed Tour Guide Information

LEGACY may display certain tour guide information to platform visitors, including:

  • Name.
  • Profile picture.
  • Biography.
  • Professional experience.
  • Languages spoken.
  • Areas of specialization.
  • Ratings and reviews.
  • Tour photos.

This information is displayed to help tourists select suitable services and tour guides.

9. Marketing Communications

LEGACY may use contact information to send:

  • Service updates.
  • Booking notifications.
  • Operational alerts.
  • Promotional offers.
  • Platform-related news.

Direct marketing activities are conducted in accordance with applicable legal and regulatory requirements.

The Implementing Regulations define direct marketing as direct communication with a data subject for the purpose of delivering marketing materials.

Reference: National Open Data Portal

10. Data Retention Period

LEGACY retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or for the period required by applicable laws, contractual obligations, and financial requirements.

Once the purpose of collection has been fulfilled, personal data will be securely deleted or anonymized, unless there is a lawful reason to retain it.

SDAIA explains that privacy policies should specify data retention periods or the criteria used to determine them, as well as the methods of data disposal.

Reference: National Open Data Portal

11. Information Security

LEGACY implements appropriate technical and organizational measures to protect personal data against:

  • Unauthorized access.
  • Unlawful use.
  • Loss.
  • Alteration.
  • Unauthorized disclosure.
  • Damage or destruction.

Although no electronic system can be guaranteed to be 100% secure, LEGACY works to implement appropriate security measures based on the nature of the data and the associated risks.

12. Data Subject Rights

Under applicable laws and regulations, data subjects may have the following rights:

  • The right to be informed.
  • The right to access their personal data.
  • The right to request a copy of their personal data, subject to applicable regulations.
  • The right to request correction of inaccurate data.
  • The right to request completion or updating of personal data.
  • The right to request deletion or destruction of personal data in legally permitted circumstances.
  • The right to withdraw consent when processing is based on consent.

SDAIA clarifies that these rights are not absolute and are subject to the exceptions and conditions specified in applicable laws and regulations.

Reference: National Open Data Portal

13. How to Exercise Your Rights

Data subjects may submit requests to:

Email: privacy@legacy.sa

Requests should include:

  • Full name.
  • Contact information.
  • Type of request.
  • Any information necessary to verify the requester’s identity.

Under the Implementing Regulations, requests to exercise data subject rights must be handled within a period not exceeding 30 days, with extensions permitted in certain circumstances and subject to applicable legal requirements.

Reference: National Open Data Portal

14. Cookies

LEGACY may use cookies and similar technologies to improve:

  • Website performance.
  • User experience.
  • Security.
  • Analytics.
  • Remembering user preferences.

The types of cookies used and the available options for managing them will be explained through the website settings when this functionality is enabled.

15. Transfer of Personal Data Outside the Kingdom

LEGACY may use cloud-based or technology service providers whose services could involve transferring or processing personal data outside the Kingdom of Saudi Arabia.

In such cases, LEGACY will comply with the applicable legal and regulatory requirements governing international transfers of personal data, including any safeguards relevant to the specific circumstances.

16. Updates to This Privacy Policy

LEGACY may update this Privacy Policy from time to time.

The updated version will be published on the platform, along with the date of the most recent update.

17. Contact Us

For privacy-related questions or inquiries, please contact:

Email: privacy@legacy.sa

Phone: +966501107316