1. Who we are and scope
Asfar Albayt Office for Travel and Tourism (ARM Trips) is the controller of personal data collected through armtrips.com, including subscription request forms and communication with prospective and existing customers.
For data our customers enter in their workspaces (such as traveler and booking data), the customer is the controller and we process it on their behalf under the Data Processing Agreement.
This policy follows the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, and its Implementing Regulations.
2. Data we collect
Data you give us:
- Subscription requests: company name, contact person, work email, mobile number, preferred workspace address, notes and your consent record.
- Payment and communication: transfer receipts, the online payment result from Paymob (transaction number, amount, payment method type and the card’s last digits), and messages you send us by email or WhatsApp.
Data collected automatically:
- IP address, browser type and request time in server logs, for security and operating the website.
- A one-way hash of your IP address, kept briefly to prevent abuse and limit requests.
- One strictly necessary cookie, only when you use online signup. See the Cookie Policy.
We do not collect sensitive data, ID numbers or payment card details through the website (cards are handled directly by a licensed payment gateway).
3. Purposes and legal basis
- Reviewing your subscription request, setting up your workspace and providing the service — to perform a contract or take steps at your request before one.
- Issuing tax invoices and keeping accounting records — to meet legal obligations, including the VAT Law.
- Protecting the website and systems and preventing fraud and abuse — our legitimate interest, without overriding your rights.
- Sending service messages about your request or subscription — to perform the contract.
- Marketing messages — only with your consent, which you can withdraw at any time.
We do not sell your personal data or use it for automated decisions that affect you.
5. Transfers outside the Kingdom
Our website servers and some service providers are located outside Saudi Arabia (in the European Union and the United States), so your personal data may be transferred or processed outside the Kingdom.
We make these transfers in line with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, limited to what the purpose requires, with appropriate contractual and technical safeguards, and without prejudice to national security or the Kingdom’s vital interests.
6. Retention
- Subscription requests that do not become subscriptions: deleted or anonymized 24 months after submission.
- Customer, invoice and financial records: for the relationship and then for the periods required by law, such as tax and commercial-records rules.
- IP hashes used to prevent abuse: deleted automatically when they expire (usually after one hour).
- Server logs: kept for a limited period for security and troubleshooting.
When a retention period ends, we securely destroy the data or make it no longer identify you.
7. Security
We use encrypted connections (HTTPS), limit data access to authorized team members, keep service keys on the server only, and store no more data than needed.
If a breach affects your personal data, we notify the Saudi Data and AI Authority within 72 hours of becoming aware of it, and notify you where harm is likely, as the law requires.
8. Your rights
Under the Personal Data Protection Law you have the right:
- To be informed how and why your data is collected and processed, as this policy explains.
- To access your data and obtain a copy in a clear format.
- To ask us to correct, complete or update your data.
- To ask us to destroy your data when it is no longer needed, unless the law requires us to keep it.
- To withdraw consent where processing is based on consent.
To exercise a right, email support@armtrips.com with “Privacy request” in the subject. We may ask you to verify your identity and will respond within 30 days, in line with statutory timeframes.
You may file a complaint with the Saudi Data and AI Authority (SDAIA) if you believe your data is processed unlawfully.
9. Minors
Our services are for businesses and not directed at anyone under 18. We do not knowingly collect their data through the website.
10. Updates and contact
We may update this policy and will publish the new version here with its effective date, notifying customers of material changes.
Privacy questions: support@armtrips.com · Phone: +966569004259.