Privacy Policy for Alma Travel App

1. Introduction

Alma Travel (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Alma Travel mobile application (the “App”).

Alma Travel acts as the Data Controller for your personal data in accordance with the Saudi Personal Data Protection Law (PDPL).

By using the App, you provide explicit consent to the processing of your personal data where required.

2. Legal basis for processing

We process personal data based on:

• Consent – where you explicitly agree
• Contractual necessity – to provide bookings and services
• Legal obligations – to comply with regulations
• Legitimate interests – to improve services and prevent fraud

3. Data minimization

We collect only the minimum personal data necessary to provide our services.

4. Information we collect

4.1 Personal data

• Full name, email, phone number
• Date of birth, nationality
• Passport / national ID details

4.2 Travel data

• Booking details (flights, hotels, transport)
• Passenger information
• Preferences and history

4.3 Financial data

• Payment details (processed securely via third parties)
• Billing information

4.4 Device & usage data

Device information, IP address, app usage, and logs.

4.5 Location data

Used only with your permission for maps and related services.

4.6 Sensitive personal data

We process sensitive data (e.g., passport, ID, payment-related data) with:

• Enhanced encryption
• Strict access control
• Limited processing scope

4.7 Camera and media files

With your permission, we may access:

• Camera – to capture profile pictures, passport/ID photos, and document uploads
• Photo gallery – to select and upload images from your device
• Media files – to attach documents and images to support requests

Permissions may include:

• CAMERA – camera access for photo capture
• READ_MEDIA_IMAGES – access to photos and images
• READ_MEDIA_VIDEO – access to videos (if applicable)
• READ_MEDIA_AUDIO – access to audio files (if applicable)
• READ_EXTERNAL_STORAGE – read files from device storage (Android 12 and below)
• WRITE_EXTERNAL_STORAGE – save files to device storage (Android 12 and below)
• READ_MEDIA_VISUAL_USER_SELECTED – access to user-selected media (Android 14+)

5. Purpose of processing

We use your data to:

• Provide and manage bookings
• Process payments
• Communicate updates and notifications
• Improve app performance and experience
• Prevent fraud and ensure security

6. Data sharing

We may share your data with:

• Airlines, hotels, and travel providers
• Payment gateways
• Cloud and analytics providers

All third parties are bound by data protection agreements.

7. Cross-border data transfers

Your data may be transferred outside the Kingdom of Saudi Arabia (خارج المملكة العربية السعودية) only when:

• It is necessary for service delivery
• Adequate safeguards are implemented
• Transfers comply with PDPL and SDAIA regulations

8. Data retention

We retain data as follows:

• Active accounts: for the duration of use
• Financial / booking data: up to 7 years
• Inactive accounts: up to 3 years

9. Data security

We implement:

• Encryption (in transit and at rest)
• Secure authentication
• Access control policies
• Monitoring and security audits

10. Your rights

Under PDPL, you have the right to:

• Access your data
• Correct inaccurate data
• Request deletion
• Withdraw consent (without affecting prior lawful processing)
• Object to processing

To exercise your rights, contact us using the details in Section 16.

11. Complaints

You may file a complaint with the Saudi Data & AI Authority (SDAIA) if you believe your data is processed unlawfully.

12. Data breach notification

In case of a data breach, we will:

• Notify affected users within 72 hours where applicable
• Notify relevant authorities as required
• Take immediate corrective actions

13. Third-party services

We use third-party services (e.g., Firebase, payment providers) for app functionality. These providers process data in accordance with their privacy policies and applicable laws.

14. Children’s privacy

The App is not intended for children under 13. We do not knowingly collect data from children.

15. Changes to this policy

We may update this policy. Updates will be posted in the App with an updated revision date (داخل التطبيق مع تحديث تاريخ التعديل).

16. Contact us

17. Consent

By using the App, you confirm that you:

• Have read and understood this Privacy Policy
• Agree to the collection and processing of your data as described