The short version
- We collect only what the official Saudi eVisa application needs, plus your contact and payment details.
- We use it only to prepare, file and follow up on your application. We never sell it, and we never use it for advertising.
- Your passport data, photo and documents are deleted 30 days after the government's decision. If you don't finish your application, they are deleted 30 days after you stop.
- Your application is sent to the Saudi authorities through the official portal. They then handle it under their own privacy policy.
- No advertising or tracking cookies. You can access, correct or delete your data at any time.
1. Who we are
[Company legal name] ("Safar Assist", "we") is responsible for your personal data as the data controller. Our address is [Registered address]. For any privacy question or request, email privacy@safarassist.example. Our data protection contact is [Name / DPO, if appointed].
This policy explains what we collect when you use our website and service, why, who we share it with, how long we keep it, and your rights.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and passport | Full name, date and place of birth, sex, nationality, marital status, occupation, passport number, type, issue and expiry dates, place of issue | You |
| Photo and documents | Passport-style photo, scan of your passport photo page, and if relevant, your US, UK or Schengen visa or residence permit | You |
| Religion | Muslim or non-Muslim, because the official Saudi application asks for it | You, with your explicit consent |
| Contact | Email, mobile number, home address | You |
| Trip | Arrival date, length of stay, port of entry, where you will stay, countries visited in the last 5 years | You |
| Other travellers | The same details for anyone you apply for | You, with their authority |
| Payment | Amount, date, card brand, last 4 digits, billing country. We never see your full card number | Our payment provider |
| Support | Emails, WhatsApp or text messages, and notes from calls with us | You and us |
| Outcome | Application number, the decision, and your eVisa | The official portal |
| Technical | IP address, browser type, error and security logs | Your device |
We don't collect fingerprints or other biometric data. If the Saudi authorities need biometrics, they take them themselves, for example when you arrive. We don't ask for your social security number, bank statements or social media accounts.
3. How we use it, and our legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Checking your application and filing it with the Saudi authorities | Performing our contract with you |
| Entering your religion on the official form, and for nothing else | Your explicit consent, which you give in the application. You can withdraw it, but we then can't file your application |
| Taking payment, preventing fraud and keeping our systems secure | Our legitimate interests, and legal obligations |
| Keeping accounting and tax records | Legal obligation |
| Answering your questions and handling complaints and refunds | Performing our contract with you, and our legitimate interests |
| Sending you service messages about your order | Performing our contract with you |
| Sending you news or offers | Your consent, only if you opt in. You can opt out at any time |
We don't make automated decisions about you that have legal or similar effects. The visa decision is made by the Saudi authorities.
4. Who we share it with
- The Saudi authorities. We file your application on the official eVisa portal, which is run by the Ministry of Tourism, together with the health insurer the portal assigns. The Ministry then becomes an independent controller of your data. It handles it under Saudi law, including the Personal Data Protection Law (PDPL), and under its own privacy policy. That policy allows it to share data with other government bodies and partners, to store data inside and outside Saudi Arabia, and to use it for purposes including analytics and marketing. We have no control over this. It is the same as if you applied yourself. Please read their policy before you apply.
- Our service providers, who handle data only on our instructions and under contract:
- payment processing: [e.g. Stripe];
- website hosting and security: Cloudflare;
- email delivery: [provider];
- text messages: [provider];
- WhatsApp Business: Meta, only if you message us there; and
- encrypted document storage and customer support tools: [providers].
- Professional advisers, such as lawyers and accountants, when needed.
- Authorities or courts, if the law requires it.
- A buyer of our business, if we sell it. They would be bound by this policy.
We don't sell your personal data, and we don't share it for advertising, including targeted or "cross-context behavioural" advertising.
5. International transfers
To get you a Saudi eVisa, we must send your application to the Saudi authorities in Saudi Arabia. For travellers in the UK or EU, this transfer is necessary to perform the contract you asked us to carry out (UK/EU GDPR, Article 49(1)(b)).
Some of our service providers process data in other countries. Where they are outside the UK or EU, we use transfers approved by regulators, such as adequacy decisions or standard contractual clauses, together with extra safeguards where needed. Email us for details.
6. How long we keep it
| Data | How long |
|---|---|
| Passport details, photo, documents and religion | Deleted 30 days after the government's decision, so we can help with corrections |
| Applications you start but don't pay for | Deleted after 30 days. Never used for marketing |
| Cancelled orders | Deleted 30 days after cancellation |
| Order, invoice and payment records | As long as tax law requires, usually up to 7 years. These hold names and amounts, not passport data |
| Support messages | 2 years after your last contact with us |
| Security logs | 30 days |
| Marketing preferences | Until you opt out, then kept only as a do-not-contact record |
Your eVisa itself is issued to you by the Saudi authorities, so keep your own copy.
7. How we protect it
- All traffic uses HTTPS.
- Documents are encrypted at rest.
- Only the staff who process your application can see your data, and each access is logged.
- All staff accounts need two-factor authentication.
- Our service providers are chosen for their security standards.
If a data breach is likely to put you at risk, we will tell you and the relevant regulator, as the law requires.
8. Your rights
Depending on where you live, you may have the right to:
- access a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- receive it in a portable format; and
- withdraw your consent at any time. This doesn't affect anything we did before you withdrew it.
California and other US states: you can ask to know, delete or correct your personal information. We don't sell or share it, so there is nothing to opt out of. We honour Global Privacy Control signals, and we won't treat you differently for using your rights.
To use any right, email privacy@safarassist.example. We may need to check your identity first. We reply within 30 days. You can also complain to your data protection regulator, for example the ICO in the UK, your national authority in the EU, or the Saudi Data & AI Authority (SDAIA).
9. Cookies and similar technology
We use only what is strictly necessary for the website to work:
- a setting in your browser that remembers whether you chose light or dark mode; and
- while you fill in an application, any cookies needed to keep it secure and to process your payment.
We don't use advertising, social media or cross-site tracking cookies, and our fonts are served from our own website. If we add analytics, we will use a privacy-friendly tool that doesn't use cookies, and we will update this policy first.
10. Children
Children can't use our service themselves. A parent or legal guardian can apply for a child travelling with them. We then use the child's data only for that application, under the same rules as adult data.
11. Changes to this policy
If we change this policy, we'll update the date at the top. If the change is important, we'll tell customers whose data we hold by email before it takes effect.