Entry SA Privacy Policy

**Version:** 1.0

**Effective date:** 10 October 2026

**Controller:** Gulf Entries limited company (شركة مداخل الخليج المحدودة)

**Privacy contact:** support@entrysa.com

This Policy explains how Entry SA collects, uses, discloses, stores and protects personal data when you use the Platform. It is intended to operate with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations, the Saudi E-Commerce Law and other applicable requirements. The Arabic version controls for Saudi users where required.

1. Personal data we process

Depending on how you use the Platform, we may process identity and account data (name, email, phone, account identifiers, role, verification status); booking and transaction data (activity, participants, dates, amounts, invoices, refunds and payment references); owner data (commercial registration, licences, permits, insurance and payout details); communications and content (messages, reviews, reports, images and listing data); technical data (device, app version, IP address, logs, identifiers, language, approximate location and security events); and support, consent and preference records. We do not request payment-card credentials when the licensed payment provider can process them directly.

Do not submit another person's personal data unless you have authority and a lawful basis. Do not place sensitive identity, health, financial or contact information in a public listing, review or message unless the Platform expressly requests it for a stated purpose.

2. Purposes and legal bases

We use personal data only for specified, clear purposes and the minimum necessary data for each purpose, including to:

• create and secure accounts, authenticate users, prevent fraud and protect the Platform;
• publish and search listings, match Renters and Owners, process bookings, payments, refunds, invoices and payouts;
• communicate booking, safety, service, legal and account notices;
• provide support, investigate complaints, incidents, fraud, abuse and disputes, and enforce the Terms;
• maintain, troubleshoot, measure and improve the Platform and its security;
• comply with Saudi law, lawful requests, tax, accounting, payment, court and regulatory obligations; and
• send marketing only where permitted and with any consent or opt-out required by law.

The applicable legal basis may be performance of a contract or requested steps, compliance with a legal obligation, a legitimate interest balanced against your rights, protection of vital interests, or consent where required. We do not use consent where another lawful basis is appropriate, and you may withdraw consent for consent-based processing without affecting prior lawful processing.

3. Sharing and disclosure

We disclose the minimum necessary data to the Owner and Renter for a booking; payment processors, banks and fraud-prevention providers; hosting, analytics, messaging, identity-verification, customer-support and security providers acting under our instructions; insurers, professional advisers and auditors; group companies where necessary; and competent authorities or other parties where required or permitted by law. We do not sell personal data. Recipients may process data only for the disclosed purpose and must apply appropriate safeguards.

An Owner is independently responsible for personal data it receives to perform the activity. The Owner must use it only for the booking and legal obligations, protect it, and delete or return it when no longer needed. Contact the Owner for its separate privacy practices where applicable.

4. Transfers and hosting

We aim to host and process data in appropriate locations and apply the PDPL rules for transfers outside the Kingdom. Where a transfer is necessary, we use a lawful transfer basis, contractual and technical safeguards, and the minimum data needed. The final published version must identify material transfer locations or categories of recipients where required by the Implementing Regulations.

5. Retention and deletion

We keep data only for as long as needed for the stated purpose, a confirmed booking, support or dispute handling, security, accounting, tax, legal claims, or a mandatory retention period. When the purpose ends and no legal exception applies, we securely delete, anonymise or irreversibly de-identify the data. Backup copies are protected and deleted or overwritten under our retention schedule.

6. Your rights

Subject to statutory conditions and exceptions, you may request notice and information about processing, access and a clear copy of your data, correction/completion/update, deletion when retention is no longer required, and withdrawal of consent. Send a request to support@entrysa.com from your registered contact and include enough information to verify your identity. We will respond within the period required by the PDPL and Implementing Regulations; identity verification and lawful exemptions may apply. You may complain to the competent Saudi authority if you believe your rights were not respected.

7. Security and incidents

We use administrative, technical and organisational safeguards proportionate to risk, including access controls, encryption where appropriate, logging, secure development, vendor controls and incident response. No service is risk-free. Do not reuse passwords or share one-time codes. If you suspect unauthorised access or a data incident, contact support@entrysa.com immediately. We will assess and notify authorities and affected individuals when required by law.

8. Cookies and similar technologies

The website and apps may use essential storage, session technologies, security tokens, preferences and analytics or performance tools. Non-essential technologies will be used only with the consent or choices required by applicable law. Browser or device settings may restrict them, but essential features may stop working. The final published version must list the actual providers and retention periods used in production.

9. Children and capacity

The Platform is not directed to children who cannot lawfully contract. Where an activity or registration involves a child, the lawful guardian is responsible for the consent, information and safety requirements. We will handle a child's data under the PDPL and any additional applicable rules.

10. Changes and contact

We may update this Policy to reflect changes in processing, law or the Platform by publishing a numbered new version. Where applicable law permits, publication alone is sufficient and no individual notice is required; otherwise we will provide any notice or obtain any consent required. The effective date appears at the top. Questions and rights requests should be sent to support@entrysa.com.

Compliance note

This Policy must be reconciled with the actual data inventory, processing records, consent logs, vendor agreements, cross-border transfer assessment, retention schedule, breach-response plan, cookie configuration, payment-provider terms and registered legal entity before publication. It is not legal advice and requires review by Saudi-qualified privacy counsel.