Privacy Policy

1Introduction

This Privacy Policy explains how Fayaliyat Hayak Company for Information Technology (“Hayak”, “we”, “us”) collects, uses, shares and protects personal data when you use the Hayak guest management and ticketing platform, our website at hayakevents.sa, our mobile and web applications, and related services (together, the “Services”).

Legal entity

Fayaliyat Hayak Company for Information Technology — شركة فعاليات حياك لتقنية المعلومات

Commercial Registration (CR)

4030554855

Unified National Number

7039042598

Registered city

Jeddah, Kingdom of Saudi Arabia

Privacy contact

privacy@hayakevents.sa

We process personal data in accordance with the Saudi Personal Data Protection Law (issued by Royal Decree No. M/19 of 1443H, as amended) and its Implementing Regulations (together, the “PDPL”), supervised by the Saudi Data & Artificial Intelligence Authority (SDAIA), as well as the Saudi E-Commerce Law and its regulations.

By using the Services you acknowledge that you have read this Policy. Where the PDPL requires consent for a specific use of your data, we will ask for it separately.

2Our role: controller or processor

Hayak serves both event organizers (businesses) and individuals, so our role under the PDPL depends on how your data reaches us.

• create a Hayak account as an organizer or team member;
• buy a ticket or register for an event directly through Hayak;
• visit our website or apps, or contact our support;
• receive marketing communications from Hayak.

3Personal data we collect

We collect the following categories of personal data:

• Account dataname, email address, phone number, company/organization name, login credentials. Source: you, when registering or managing an account.
• Guest & event dataguest names, phone numbers, email addresses, invitation status, RSVP responses, seating/category, photos used for badges or guest profiles. Source: event organizers, or you when responding to an invitation.
• Ticketing & payment dataticket type, order details, billing name, payment confirmation. Card payments are processed by Tap Payments; we do not store full card numbers. Source: you, via our payment provider.
• Check-in & attendance dataQR code scans, check-in time, badge printing records. Generated when you attend an event.
• Device & usage dataIP address, device and browser type, pages viewed, approximate region, interaction with invitations. Collected automatically, including via Google Analytics.
• CommunicationsWhatsApp and email invitation delivery status, and messages you send to support. Source: you, and our messaging provider (Wati).

We do not collect national ID or Iqama numbers, and we do not collect precise location data.

4Why we use your data and our legal bases

We process personal data for the following purposes:

• Provide the Servicesaccounts, invitations, RSVPs, ticketing, check-in and badge printing, using account, guest & event and check-in data. Legal basis: performance of a contract with you or the organizer.
• Process payments and issue e-tickets and receipts. Legal basis: performance of a contract; legal obligation (tax and invoicing).
• Send transactional messages (invitations, tickets, reminders) via WhatsApp and email. Legal basis: performance of a contract; actual (legitimate) interest.
• Provide customer supportLegal basis: performance of a contract; actual interest.
• Analyze and improve the Services through aggregated analytics of device and usage data. Legal basis: actual interest; consent for non-essential cookies.
• Send marketing communications and run advertising on Meta, Google Ads, Snapchat and TikTok. Legal basis: consent — you may withdraw it at any time.
• Security, fraud prevention and record-keepingLegal basis: actual interest; legal obligation.
• Comply with Saudi law and respond to lawful requests from authorities. Legal basis: legal obligation.

We collect only the data needed for these purposes and do not use it in ways incompatible with them without informing you or obtaining consent where required.

5Who we share data with

We never sell personal data. We share it only with the parties below, and only to the extent needed:

• Event organizersguest responses, ticket sales and attendance for their own events. The organizer is the controller of its event data.
• Tap Paymentspayment processing for ticket sales and packages. Hayak does not store full card details.
• Watidelivery of WhatsApp invitations and notifications (official WhatsApp Business solution provider).
• Amazon Web Services (AWS)cloud hosting and storage of platform data, in the AWS Europe (Ireland) region (see Section 6).
• Google (Google Analytics)usage analytics to improve the Services, subject to your cookie choices.
• Advertising platforms (Meta, Google Ads, Snapchat, TikTok)measuring and delivering Hayak advertising, only with your consent; you may opt out at any time.
• Professional advisers and auditorslegal, accounting and compliance support, bound by confidentiality.
• Saudi authoritieswhere disclosure is required by law or a lawful order (e.g. SDAIA, Ministry of Commerce, ZATCA).

Each service provider acting on our behalf is bound by a contract requiring it to protect personal data and process it only on our instructions, as the PDPL requires.

6International data transfers

Our platform is hosted on Amazon Web Services in the Europe (Ireland) region, so personal data processed through Hayak is stored and processed outside the Kingdom of Saudi Arabia. Some of our service providers (such as Google, Wati and advertising platforms) may also process data outside the Kingdom.

When transferring personal data outside Saudi Arabia, we comply with Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom. In particular, we:

• transfer only the minimum personal data necessary for the stated purposes;
• rely on appropriate safeguards, including standard contractual clauses consistent with SDAIA’s requirements, in our agreements with providers outside the Kingdom;
• assess the risks of transfers involving sensitive or large-scale data before they take place; and
• ensure the transfer does not prejudice national interests or the privacy of data subjects.

If you would like more information about the safeguards we apply, contact us at privacy@hayakevents.sa.

7How long we keep your data

We keep personal data only as long as needed for the purposes above or as Saudi law requires, then delete or anonymize it:

• Account datalife of the account plus 12 months after closure (service continuity, dispute resolution).
• Guest & event data processed for organizersper the organizer’s instructions; by default 12 months after the event ends.
• Billing records, invoices and tax data10 years (Zakat, Tax and Customs Authority requirements).
• Payment transaction recordsas required by Tap Payments and applicable payment regulations (fraud prevention, chargebacks).
• Analytics dataup to 26 months.
• Marketing preferences and consentsuntil you withdraw consent, plus a record of the withdrawal.
• Support correspondence24 months after the ticket is closed.

8Your rights under the PDPL

As a data subject under the PDPL, you have the right to:

• Be informedknow how and why your data is processed (this Policy serves that purpose).
• Accessask whether we process your data and request a copy of it in a readable format.
• Correctionask us to correct, complete or update inaccurate data.
• Destructionask us to delete your data when it is no longer needed for the purpose it was collected for, subject to legal retention obligations.
• Withdraw consentwithdraw any consent you gave (for example, marketing) at any time, without affecting processing that happened before withdrawal.

If your data was collected by an event organizer, we will forward your request to them or direct you to them, as they control that data.

9Cookies, analytics and marketing choices

10How we protect your data

We apply technical and organizational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest;
• role-based access controls and the principle of least privilege for staff and organizer accounts;
• logging and monitoring of access to production systems;
• vendor due diligence and data protection terms with our service providers;
• regular backups and tested recovery procedures.

No system is completely secure, but we work continuously to protect your data. If a personal data breach occurs that may harm you or your data, we will notify SDAIA and, where required, affected individuals in accordance with the PDPL and its regulations.

11Children, changes and contact

• Email: privacy@hayakevents.sa
• Fayaliyat Hayak Company for Information Technology, Jeddah, Kingdom of Saudi Arabia (CR 4030554855)

You may also contact the Saudi Data & Artificial Intelligence Authority (SDAIA) regarding your personal data rights.