Privacy Policy

1. Who we are

This Privacy Policy is issued by Ghatta Almaskan ("we", "the Platform"), a sole proprietorship licensed by the Ministry of Tourism of Saudi Arabia to market and manage bookings of tourist accommodation units (Accommodation Unit Reservation).

We operate akenna.sa and the Ghatta Almaskan applications. The trade name "Akenna" is pending trademark registration; until it completes, our legal name Ghatta Almaskan governs all public and contractual references.

2. Purpose

This Policy explains how we collect, use, store, disclose, and protect your personal data, in fulfilment of your right to be informed under Article 12 of the Personal Data Protection Law (PDPL) and Article 13 of its Implementing Regulations. It applies to guests, hosts, and visitors.

3. The data we collect

We collect only what is necessary for the purposes described, applying data minimisation and purpose limitation.

3.1 From guests

• •Identity and contact: name, email, mobile, and — where you verify your account — your national ID or Iqama number and the verified name returned by the verification process.
• •Booking data: dates, unit, order details, cancellations, refunds, and dispute records.
• •Payment data: we do not store your full card number. Payments are processed by a licensed gateway; we retain only the transaction reference, amount, status, and masked card details returned to us.
• •Technical data: device identifiers, IP address, operating system, app version, session logs, crash reports.
• •Location: approximate location for search and directions, only when enabled.
• •Support records: your messages to and from us, retained as required by MoT regulations (not less than one year).

We do not collect or store an image of any identity document. Account verification uses a Nafath-based electronic signature via a licensed provider, which returns verified attributes (name, ID number) without us holding the document.

3.2 From hosts

• •Identity and contact: name, email, mobile, national ID or Iqama number, address.
• •Listing data: your MoT permit number for each unit, the unit address and description, and the photographs you upload.
• •Payout data: bank account / IBAN details and payout records.

4. How we collect it

1. 1.Directly from you — on registration, editing your account, listing a unit, booking, verifying your account, or contacting support.
2. 2.Automatically — via cookies and similar technologies to run the service and understand usage.
3. 3.From third parties — the payment gateway (to confirm and secure payments) and, where you verify your account, the verification provider (to confirm your identity via official sources).

5. Why we use your data, and our lawful basis

6. Cookies

Our website and app use cookies and similar technologies to run the service, remember your preferences, and understand usage. You can manage non-essential cookies in your browser or device settings, and we ask consent before setting non-essential cookies where required.

7. Who we share your data with

We share data only where necessary to provide the service or meet a legal duty. We do not sell your personal data.

8. Verifying your account

If you choose to verify your account, we send you an agreement to sign electronically through a licensed Saudi e-signature provider using Nafath. When you sign, the provider confirms your identity via official sources and returns your verified name and ID number to us. We do not receive, ask for, or store a copy of your identity document. Verification is optional and does not prevent you from booking.

We share with this provider only what is needed to send you the agreement — your name and mobile number — after you ask to verify your account, and we obtain your consent before sharing.

9. Transfers outside the Kingdom

Some technology providers that operate the Platform on our behalf store data outside the Kingdom; specifically, our database infrastructure is currently located in the European Union (Frankfurt, Germany).

Where we transfer data outside the Kingdom, we comply with Article 29 of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom, and apply the safeguards required by SDAIA, which may include a transfer risk assessment and SDAIA-approved Standard Contractual Clauses.

10. Storage and retention

We store your data using reputable cloud providers under contractual confidentiality and security obligations, and keep it only as long as necessary for the purposes described and as required by law — including the MoT tourist-data retention period of not less than one year. When no longer needed, we securely delete or irreversibly anonymise it.

11. How we protect your data

We apply organisational, administrative, and technical measures — access controls, encryption in transit, and need-to-know internal access. If a breach occurs that poses a risk to you, we notify SDAIA within 72 hours of becoming aware, and notify you where required.

12. Your rights

Under the PDPL you have the right to be informed; to access your data and obtain a copy; to correct inaccurate data; to request deletion; to withdraw consent where processing is consent-based; and to complain to SDAIA. Exercising these rights is free; we respond within 30 days, extendable by 30 days for complex requests with notice.

13. Contact

For any privacy matter or to exercise your rights: support@akenna.sa

14. Complaints

If unsatisfied with our handling, or if we do not respond in time, you may complain to SDAIA — the competent authority — within 90 days of the incident, via the National Data Governance Platform (dgp.sdaia.gov.sa).

15. Changes

We may update this Policy, publishing the new version with a new effective date and taking reasonable steps to notify you of material changes.