Introduction

This Privacy Notice outlines how SELA ("we," "us," or "our") collects, uses, discloses, and protects your personal data when you visit or interact with our digital platforms, Bader Application and Bader Website (collectively referred to as "the Platforms"). Your privacy is important to us, and we are committed to safeguarding your personal information.

Information We Collect

Personal data is all and any kind of data that, directly or indirectly, can be used to identify a natural person.

Without affecting the foregoing, we collect personal data from you:

  • Personal data you give us directly when you use our services
  • Personal data collected automatically through cookies and tracking technologies, server logs, analytics to enhance customer experience
  • Personal data collected through other sources if you engage with a third-party that integrates with the Services and transfers your personal data to us

Purpose of Data Processing

Your personal data may be processed for the following purposes:

1User Identification and Account Information

Personal Data:

  • Contact information (name, email address, phone number)
  • Account details (username, preferences, settings)

Purpose of Processing:

  • Manage user accounts and profiles
  • Offer personalized recommendations, including journeys, experiences, and dining options
  • Manage user inquiries and feedback through customer relationship management (CRM) systems
2Technical, Device, and Location Information

Personal Data:

  • Online identifiers (IP address, device ID, operating system, app version)
  • Approximate location data, where enabled by the user

Purpose of Processing:

  • Provide AR-based and map-based experiences tailored to user location
  • Support visitor navigation through Bader Old City and Al Bared
  • Improve app performance, AR functionality, diagnostics, and bug prevention
  • Ensure platform security and system integrity
3Usage and Interaction Data

Personal Data:

  • Interaction analytics (screens viewed, clicks, session behavior, usage patterns)

Purpose of Processing:

  • Analyze user engagement with stories, routes, and experiences
  • Improve content relevance, navigation flows, and feature performance
  • Support continuous optimization of AR and interactive experiences
4Interest and Engagement Data

Personal Data:

  • Interest data for events, programs, or services (when engaging with features or subscribing)

Purpose of Processing:

  • Deliver personalized content and recommendations
  • Support discovery of relevant experiences and offerings
  • Enable redirection to Webook for package booking
5Notifications and Communications Data

Personal Data:

  • Push notification tokens and preferences (if enabled by the user)

Purpose of Processing:

  • Send relevant updates, experience reminders, or service notifications
  • Communicate important information related to user activities or interests

Third-Party Data Sharing and Cross-Border Personal Data Transfer

We may share Personal Data with third party providers so they can provide you with certain services through the App. Achieving this may require sharing Personal Data with external third party providers, as required for one of the purposes set out in the sections above. We will require these third party providers to take steps to ensure that your Personal Data is kept secure and used in accordance with this Privacy Notice. However, we shall not be liable for any unauthorised use of your Personal Data by a third-party provider.

We may share your data with:

  • Third-Party Service Providers: Including CRM systems (e.g., Zoho), analytics providers (e.g., Google Analytics), and ticketing partners (Webook)
  • Legal Authorities: When required to comply with a legal obligation or to protect our rights
Cross-Border Transfers: We may also subcontract processing to, or share your personal data with, third parties located in countries other than your home country. Personal data collected within the KSA may be transferred to and processed by third parties located in a country outside of KSA. We will ensure that the transfer of your personal data is carried out in conformity with applicable law and that all appropriate contractual, technical, and organisational measures are in place such as the Standard Contractual Clauses approved by the SDAIA.

Third-Party Providers Include:

  • CRM system handlers (Zoho)
  • Webook (for booking redirection)
  • Hosting and app backend providers
  • Analytics and AR performance service providers
  • Map/wayfinding providers (location data handled as per device permissions)

Children's Data or Individual Lacking Legal Capacity

We understand the importance of taking extra precautions to protect the privacy and safety of children using SELA products and services.

SELA websites are designed and intended for use by adults. Where one of our websites is intended for use by a younger audience, we will obtain consent from the person with parental responsibility before we collect personal data where it is required by applicable laws and regulations.

Important Notice for Children: If you are a child under the age where parental consent is required under KSA Personal Data Protection Law, you should review the terms of this Privacy Notice with your parent or guardian to make sure you understand and accept them. If we discover that we have collected personal data from a child without consent from a parent or guardian where such consent should have been obtained, we will delete that personal data as soon as practical.

Data Storage

Personal data is stored securely on Microsoft Azure data centers located in UAE North, adhering to strict security guidelines. Your Personal Data will be stored on the servers available to SELA or to the persons in charge located in Kingdom of Saudi Arabia.

Should it become necessary for technical and/or operational reasons to use subjects located outside the Kingdom of Saudi Arabia, or should it become necessary to transfer some of the collected Personal Data to technical systems and services managed in the cloud and located outside the Kingdom of Saudi Arabia, the processing will be regulated in compliance with the provisions of the Applicable Laws regarding data transfers.

Data Retention

Your personal data will be retained only for as long as necessary to fulfill the purposes outlined in this Privacy Notice or as required by law except in case of extraordinary necessity of SELA to keep the Personal Data further in order to defend its rights, also in relation to disputes existing at the time of the request or upon indication of public authorities or as otherwise permitted by the Applicable Laws.

The above shall be retained until the withdrawal of the relevant consent or until you expressly request the deletion of such Personal Data, which shall be deleted or anonymized in accordance with our internal policies, part of which is requesting third party providers to provide destruction confirmation, which confirms that Personal Data has been securely and permanently destroyed in accordance with agreed standards.

User Rights

Under applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL), you have the following rights:

You can request information about the legal basis and the purpose of the collection of your Personal Data.

You can request access to the personal data we hold about you.

You can request correction of any inaccurate or incomplete data.

You can request your information held by us in a readable and clear format, in accordance with the controls and procedures specified by the Regulations.

You can request the deletion of your personal data when no longer necessary for the purpose for which it was collected or lapse of the period except case under consideration before a judicial or regulatory authority.

You can withdraw your consent for us to process your data.

You can object to the processing of your data under specific circumstances.
Exercise Your Rights: To exercise these rights, please contact us at DPO@sela.sa

Complaints

If you believe your rights have been violated or if you have concerns about our data processing practices, you have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA) by emailing Suggestions@sdaia.gov.sa.

Changes to this Notice

We may update this Privacy Notice from time to time. Any changes will be effective immediately upon posting the revised notice on our Platforms, and your continued use of the Platforms will signify your acceptance of such changes.

Contact Us

Get in Touch

For any privacy-related inquiries or to exercise your rights, please contact our Data Protection Officer:

Email: DPO@sela.sa