Privacy Policy

Who are we?

Riyadh Airports Company was established in 2016 as part of the privatization program for the aviation sector in the Kingdom of Saudi Arabia. The company manages and operates King Khalid International Airport in the capital city, Riyadh, while developing the airport's infrastructure and undertaking expansion projects for new services and facilities, in addition to existing facilities. Riyadh Airports is committed to working closely with partners and stakeholders at both local and global levels to ensure customer satisfaction with all services and products provided.

Riyadh Airports Company or "we" have formulated our privacy notice to ensure that you can clearly understand our data and security practices and policies while using the Riyadh Airports Company website ("the Sites"). This privacy notice describes the types of information we collect, how we use the information, with whom we share it, and the choices you can make regarding the collection, use, and disclosure of your information.

Definitions:

Personal Data: Any statement - regardless of its source or form - that would lead to identifying an individual specifically or make it possible to identify them directly or indirectly, including: name, personal identification number, addresses, contact numbers, license and registration numbers, personal property, bank account and credit card numbers, still or moving images of the individual, and other data of a personal nature.
Processing: Any operation performed on personal data by any means, whether manual or automated, including: collection, recording, storage, indexing, arranging, coordination, storage, modification, updating, merging, retrieval, use, disclosure, transfer, publication, sharing of data or interconnection, blocking, erasure, or destruction.
Collection: The controller obtaining personal data in accordance with the provisions of the regulation, whether directly from the data owner, their representative, their legal guardian, or from another party.
Destruction: Any action that leads to the removal of personal data and makes it impossible to access or retrieve it again.
Disclosure: Enabling any person - other than the controller - to obtain, use, or access personal data by any means and for any purpose.
Personal Data Owner: The individual to whom the personal data relates, or their representative, or their legal guardian.
Public Entity: Any ministry, department, public institution, public authority, or any independent public entity in the Kingdom, or any of its affiliated entities.
Controller: Any public entity, and any natural or private legal person; that determines the purpose and means of processing personal data, whether they process the data themselves or through a processor.
Processor: Any public entity, and any natural or private legal person; that processes personal data on behalf of and for the benefit of the controller.
Data Owner: The natural person to whom the personal data relates, or their representative, or their legal guardian.
Explicit Consent: Verbal or written consent that is explicit, specific, and given freely and unconditionally by the data owner, indicating their acceptance of the processing of personal data.
Implied Consent: Consent that is not explicitly granted by the data owner, but is implicitly given through the person's actions, facts, and circumstances of the situation - such as signing contracts or agreeing to terms and conditions.
Legal Basis: The legal basis or actual need - based on the tasks and competencies of the entity - to process personal data in a legal manner and within a framework of fairness and integrity.
Third Parties: Any governmental entity or independent public legal entity in the Kingdom, and any natural or private legal person other than the data owner, controller, processor, and authorized persons, concerned with the processing of personal data.
Personal Data Protection Officer: The person responsible for preparing and monitoring the implementation of policies and procedures related to the protection of personal data.
Regulatory Authority: Any governmental entity or independent public legal entity that assumes regulatory or supervisory tasks and responsibilities for a specific sector in the Kingdom of Saudi Arabia based on a legal document.

What information do we collect?

In order to use the provided services, we may ask you to disclose the following information:

full legal name, your phone number, a valid email address, or any similar data required by the services provided by Riyadh Airports Company.

Data Collection Methods

The information and notifications related to your activity that you provide when you visit our website or use our service, you can provide us with two types of information:

Data that the personal data owner provides to the website through registration or use of the services provided by Riyadh Airports Company.
Your personal data is collected indirectly through cookies that are collected when visiting the website (Cookies).

The legal basis for processing your personal data is:

Contractual: Where we use your personal data to execute a contract or take steps to enter a contract with you.
Legitimate Interest: Where we use your personal data to achieve our legitimate interests as an organization (or those of any other party) and these interests outweigh any infringement on your data protection rights.
Consent: For other activities such as information, employment, competitions, and other services provided by Riyadh Airports Company.
Legal Obligation: Where we need to use your personal data to comply with relevant legal or regulatory obligations.
Public Interest: For processing that is carried out based on requests from public entities or for purposes of public interest, for example: awareness messages sent by entities of a legal nature such as government agencies, ministries, regulatory bodies, and others...

Data Collection

Riyadh Airports Company may collect personal data related to candidates for business opportunities, prospective employees or job applicants, or services provided by Riyadh Airports Company or other third parties.

This may include name, contact information, employment history, education, resumes, professional certifications, criminal records, or any similar data required by the services provided by Riyadh Airports Company.

Non-interactive usage-related information collected

Our website and service use a standard technology called cookies to collect information about how our website and service are used. This may include, but is not limited to, the date and time of visits, the pages of the website that were viewed, the amount of time spent on our website, and the recording of activities and sites visited immediately before and after our website. In addition, when visiting our websites, we may collect certain information by automated means, such as cookies and web beacons, as further detailed below. The information we may collect by automated means includes:

Information about the devices used by our visitors to access the Internet (such as IP address, device, browser, and operating system type).
The pages and URLs that refer visitors to our websites, as well as the pages and URLs that visitors leave to once they depart our websites.
Dates and times of visits to our websites.
Information about actions taken on our websites (such as page views, website navigation patterns, or application activity).
General geographic location (such as country and city) from which a visitor enters our websites.
Search terms used by visitors to reach our websites.

How we use the information we collect

We may use the information we obtain about you, which is permitted by Riyadh Airports Company under the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443 AH, in order to:

Create, manage, and maintain your account on the websites.
Provide you with the services you request.
Notify you regarding website activities (such as new job requests) based on notification preferences.
Respond to your questions and comments and provide customer support.
Operate, evaluate, and improve our business and the products and services we offer.
Analyse trends and statistics related to visitors' use of our websites, mobile applications, social media programs, and the jobs that are displayed or applied for on our websites.
Protect against and prevent fraud, unauthorized transactions, claims, and other liabilities, and manage risk exposure, including by identifying potential intruders and other unauthorized users.
Notify you from time to time about relevant products and services managed by Riyadh Airports Company.
Enforce the terms of use of our websites.
Comply with the policies and requirements of the laws of the Kingdom of Saudi Arabia, including but not limited to the Saudi Personal Data Protection Law and (GDPR).

How long we retain your personal data:

Your personal data is stored as long as necessary, in accordance with specified retention periods, for the purposes for which it was collected and to meet any legal or regulatory requirements or reporting.

Rights of the personal data owner:

Right to know: The personal data owner has the right to know how we collect their data, the legal basis for collecting and processing it, how it is processed, stored, and destroyed, and with whom it will be shared. You can access all the details through this privacy notice, or you can contact us using the information provided in section thirteen, and you will be informed within (30) days, via email.
Right to access personal data: The personal data owner has the right to request a copy of their personal data, by emailing the address specified in section thirteen, and it will be provided to them - free of charge - within (30) days, via email.
Right to correct personal data: The personal data owner has the right to request the correction of their personal data that they believe is inaccurate, incorrect, or incomplete, by emailing the address specified in section nine, and it will be reviewed and updated within (30) days, and the personal data owner will be notified of this via email.
Right to destroy personal data: The personal data owner has the right to request the destruction of their personal data under certain circumstances, unless there is a legal provision specifying a certain retention period or contractual requirements, by emailing the address specified in section nine, and it will be reviewed and updated within (30) days, and the personal data owner will be notified of this via email.

Data protection and disclosure:

We take the protection of your data seriously and will use appropriate organizational and technical security measures to protect and safeguard your data - including internal and external audits, training employees and contractors on privacy, and reporting to our audit and data management steering committees and the regulatory authority - to protect your data from any unauthorized disclosure or processing.

Riyadh Airports Company always maintains the privacy and confidentiality of all personal data collected. This data may only be disclosed or shared when it complies with the law, is requested by law, or when we believe that such action is necessary or desirable to provide services or technical support and in accordance with the section on why we collect and use your personal data.

We will not use any of your personal data for commercial purposes or share it with any third party other than Riyadh Airports Company or governmental or semi-governmental entities and partner companies without your consent unless it is collected without identifiers on an aggregate basis for analytical purposes, studies, and reports while complying with personal data protection regulations in the Kingdom of Saudi Arabia.

Except in cases of extreme necessity to preserve the life, health, or vital interests of an individual, or to prevent, investigate, or treat infection, Riyadh Airports Company may not transfer personal data outside the Kingdom of Saudi Arabia or disclose it to a party outside the Kingdom of Saudi Arabia, unless it is in execution of an obligation under an agreement to which the Kingdom of Saudi Arabia is a party or to serve its interests.

Riyadh Airports Company will not disclose your personal data to external parties without your consent except under the following circumstances where the entity requesting disclosure is a public entity, and in this case, data will be shared in accordance with the controls and procedures stipulated in the personal data protection law in force in the Kingdom of Saudi Arabia:

For security purposes.
If such disclosure is required by relevant regulations or rules, or by order of a competent regulatory authority to protect public health or safety.
To protect the life or health of an individual.

Privacy Notice Updates:

In order to ensure that we continue to provide the best possible experience and the highest level of protection for you, we reserve the right to update our privacy notice when necessary and appropriate. For example, in accordance with new laws. Any update to this privacy notice will be available here. Therefore, we recommend that you check it periodically. This notice was last updated on Monday June 24, 2024.

Contact Us:

If you have any questions, concerns, or complaints regarding our compliance with this privacy notice and data protection regulations, or if you wish to exercise your rights, please contact us as follows: ([email protected]).

We will investigate and attempt to resolve complaints and disputes and will make every effort to fulfil your wish to exercise your rights as soon as possible, in any case, within the timelines provided for in the applicable data protection laws.