Privacy policy
Last updated: September 11, 2026
1. Introduction
Diriyah Company is a closed joint stock company established under the laws of the Kingdom of Saudi Arabia. The Company is responsible for the development and management of urban, heritage, and tourism destinations, as well as providing services related to real estate development, and destination operations, contributing to the achievement of national development objectives.
The Company’s services target individuals, investors, third-parties partners, visitors, and beneficiaries of its digital platforms and services, including users of its website and associated applications.
The Company is committed to protecting personal data and processing it in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. You may contact us through the communication channels provided below for any inquiries or requests related to data privacy.
Contact information
- Responsible Department: Data Privacy Department
- Address: 8500 Prince Sattam Ibn Abdulaziz St. - Al Shohda Dist. AD Diriyah - Riyadh 12572 – 4000
- Phone Number: +966 92 0021 727
- Email Address: [email protected]
- License / Commercial Registration: Diriyah Company, Commercial Registration No. (1010648801)
2. Privacy Notice Updates
This Privacy Notice was last updated in May 2026.
Diriyah Company reserves the right to update or amend this Privacy Notice at any time to ensure ongoing compliance with applicable laws and regulatory requirements, including the Saudi Personal Data Protection Law (PDPL).
In the event of material changes affecting the processing of personal data, the Company will provide appropriate notice to data subjects through this page.
A record of updates to this Privacy Notice is available at
3. What Personal Data We Collect, When and Why
In this privacy notice, personal data means any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature. Below, we describe what personal data we collect, how we use it, and, where required, the legal bases for each type of processing. We do not process your personal data in a way that is inconsistent with these purposes or with applicable laws and regulations. If you choose not to provide certain personal data, our ability to provide some services and your ability to use some parts of our websites may be affected.
Purchasing tickets or other products
Personal Data Collected
Identification and contact details (name, date of birth, address, phone number, email address). Billing and payment information. Basic profile information such as gender, nationality and city. Information about how you navigate our websites.
How is Data Collected?
Directly from you via website forms during purchase. Automatically via website tracking (cookies, logs). We may also collect certain sensitive personal data, with your explicit consent, to enhance your visitor experience (for example, accessibility needs such as wheelchair use, or dietary requirements).
Purpose of Processing
To process and manage purchases, deliver products/services, enhance visitor experience, and fulfill contractual and operational obligations.
Legal Basis
Contract performance. Legitimate interests (to operate our business and perform our obligations). Explicit consent (for sensitive personal data, where required).
Customer support and online services
Personal Data Collected
Identification details (name, date of birth, gender, city, nationality). Contact details (email address, telephone number). Details of your request or enquiry.
How is Data Collected?
Directly from user via email, live chat, WhatsApp, phone calls.
Purpose of Processing
Recorded interactions where applicable. To respond to enquiries, provide customer support, improve service quality, and comply with legal obligations.
Legal Basis
Contract performance. Legitimate interests (to provide and improve our services and support). Legal obligations (where applicable).
Creating registered accounts on websites
Personal Data Collected
Identification data (name, age, gender, country of residence). Contact details (email address, phone number, address). Optional professional information and a photo.
How is Data Collected?
Directly from user during account registration. Via third-party identity providers (Google, Apple) upon user authorization.
Purpose of Processing
To create and manage user accounts, enable access to services, verify identity, and facilitate transactions and account-related communications.
Legal Basis
Contract performance. Legitimate interests (to provide and manage your account and perform our obligations). Legal obligations (where applicable).
Marketing and promotional communications
Personal Data Collected
Contact details (email, phone, address). Marketing preferences. Interaction data (participation in events/promotions).
How is Data Collected?
Directly from user via consent forms or preferences. Indirectly from prior interactions/relationship. Digital engagement channels.
Purpose of Processing
To send marketing communications, promote products/services, manage event participation, and engage users in campaigns.
Legal Basis
Consent (for direct marketing). Legitimate interests (for certain advertising communications following a prior relationship, where permitted by law).
Profiling and analytics
Personal Data Collected
Provided data. Behavioral data (website/app usage). Demographic data. Third-party/public data.
How is Data Collected?
Automatically via cookies and tracking technologies. From user interactions. From third-party/public sources.
Purpose of Processing
To analyze behavior, personalize content, improve services, conduct research and development, and support analytics-driven decision-making.
Legal Basis
Consent (for direct marketing). Legitimate interests (for certain advertising communications following a prior relationship, where permitted by law).
Participation as a volunteer
Personal Data Collected
Identification and contact details. Next-of-kin details. Identification numbers (ID/Iqama). Health and accessibility data. Biometric data. Employment and education history. Public social media data.
How is Data Collected?
Directly from user via application forms. From publicly available sources (where permitted).
Purpose of Processing
To evaluate applications, manage volunteer participation, ensure safety and suitability, and administer volunteer programs.
Legal Basis
Contract performance. Legitimate interests (to evaluate and manage your volunteer application and participation). Explicit consent (for sensitive personal data, where required).
Participation as a business partner
Personal Data Collected
Identification and contact details. Passport and visa details. Bank account details (IBAN). Executive/management details. Photographs.
How is Data Collected?
Directly from business partners via communications or onboarding processes.
Purpose of Processing
To manage business relationships, process transactions, and fulfill contractual obligations.
Legal Basis
Contract performance.
Legal and regulatory compliance
Personal Data Collected
Any relevant personal data required for investigations or compliance (may include sensitive data where applicable).
How is Data Collected?
From internal records. From regulatory requests. From third parties (courts, authorities).
Purpose of Processing
To prevent fraud, comply with legal obligations, respond to regulatory requests, and protect business interests.
Legal Basis
Legal obligations. Explicit consent for sensitive personal data (where required by law).
Additional information requests
Personal Data Collected
Any additional personal data requested depending on context.
How is Data Collected?
Directly from user upon request with explanation.
Purpose of Processing
To support specific services, personalization, or processing activities as communicated at the time of collection.
Legal Basis
Contract performance.
Automatic collection, analytics, and limited website personalization
Personal Data Collected
IP address. Device identifiers. Browser type. Pages visited. Approximate location. Cookie identifiers.
How is Data Collected?
Automatically via cookies, pixel tags, local storage, and similar technologies.
Purpose of Processing
To analyze usage, improve website performance, enhance security, conduct research, and enable limited functional personalization.
Legal Basis
Legitimate interests (for essential cookies, security, service improvement, analytics and the limited functional personalization described above). Consent (for non-essential cookies, direct marketing and tailored advertising, where required).
Information about dependents and related persons
Personal Data Collected
Identification and contact details of dependants/next of kin or related persons (as provided by the user).
How is Data Collected?
Indirectly from the user who provides the data of related persons.
Purpose of Processing
To maintain emergency contact information or support related services, relying on user responsibility to inform data subjects and obtain consent where required.
Legal Basis
Legitimate interests (to maintain emergency contact details and manage services effectively).
Collection of data from minors
Personal Data Collected
Personal data of minors (only where permitted and with parental/guardian consent).
How is Data Collected?
Directly from parent/legal guardian. Indirectly from minors with verified consent.
Purpose of Processing
To provide services where lawful, ensure compliance with legal age requirements, and protect minors by verifying parental/guardian consent.
Legal Basis
Explicit consent of parent or legal guardian (primary basis). Legal obligation (to comply with age-related restrictions and verification requirements).
4. How We Share Information with Others
- We work closely with a number of trusted partners with whom we may need to share your personal data for the purposes (and in strict accordance with applicable laws and regulations), including our affiliates and advisors, banks and payment providers, to authorise and complete payments, and third parties who help manage our business and deliver services.
- From time to time, we may share information about you with government organisations and agencies, including international organisations, to comply with applicable laws, regulations and rules, and legitimate requests from law enforcement, regulatory and other governmental or international agencies, or when to do so is in our legitimate interests, even if we are not compelled to share that information by applicable law.
- In all cases when we share your personal data, we implement necessary technical, organisational, administrative and security measures to safeguard it. We only share your personal data to the minimum extent necessary to achieve the purposes of processing set out in this privacy notice and in accordance with applicable law.
- Our websites and applications may link you to other websites, including those of our partners, advertisers, and affiliates. We are not responsible for how third-party websites operate or how they process any personal data you provide to them. You should always read their privacy policies and terms of use.
- From time to time, we may partner with advertising networks and other online advertising providers to deliver advertisements on our behalf or on behalf of other non-affiliated parties on our websites and across the internet. These advertisements may be shown based on products and services the advertising providers think are relevant to your interests, inferred from your browsing behaviour across our websites and other sites or apps over time. Where required under applicable laws, including the Saudi Personal Data Protection Law (PDPL), we will obtain your consent before engaging in targeted advertising or processing personal data for marketing purposes. You will also have the ability to manage your preferences and withdraw consent at any time through the available mechanisms.
- Information you post in public areas of Diriyah Company websites or elsewhere on the internet may be seen and used by anyone, including Diriyah Company. Please be cautious before posting such information.
- For more information on how we use cookies and similar tracking technologies, please refer to our Cookie Policy.
5. Transferring Personal Data Internationally
We store and process your personal data in the Kingdom of Saudi Arabia. Your personal data may also be shared with and processed by other entities outside the Kingdom of Saudi Arabia or the country from which your personal data was collected, in accordance with applicable laws.
We only share your personal data with entities that provide an adequate and equivalent level of protection to your personal data, or where we are otherwise permitted to do so by applicable law.
In the absence of an adequacy decision, we only transfer your personal data to jurisdictions that afford the same standard of protection as in the Kingdom of Saudi Arabia, or where we are otherwise permitted to do so (for example, where the transfer is necessary to perform a contract with you, to comply with legal obligations, to protect your vital interests, or where we have implemented appropriate safeguards). These safeguards may include:
- Standard contractual clauses approved by the competent regulatory authority
- Binding common rules approved by the competent regulatory authority
- Documented transfer risk assessments
In all cases, we implement appropriate measures to safeguard your personal data when we transfer it outside the Kingdom of Saudi Arabia or to another jurisdiction, and we only share the minimum amount needed.
6. How We Protect and Store Your data
- We take necessary steps required by applicable laws and regulations to protect your personal data, including appropriate technical, organizational and administrative security measures. This includes physical, electronic and administrative procedures to protect personal data against loss, misuse, unauthorized access, deletion, disclosure, alteration and destruction.
- When you disclose information to us using our mobile app, please ensure that your device remains safe. We cannot be held responsible for data misuse arising from unauthorised access to your device.
- Where we have given you (or where you have chosen) a password to access certain parts of our websites or apps, you are responsible for keeping this password confidential and following any other security procedures we notify you of. Please do not share your password with anyone.
- We store your personal data only for as long as necessary for the purposes for which it was collected, as explained in this privacy notice, and any permissible related purpose(s).
- In some circumstances, we may need to store personal data for longer, for example to meet legal, reporting, regulatory and accounting requirements or in the event of complaints, challenges or potential litigation. If you would like more detail on how long we keep different categories of data, please contact us using the details in section 9.
- Once personal data is no longer required, it will be securely deleted, destroyed, or anonymized using appropriate methods designed to prevent unauthorized access or recovery.
- Below is the table includes some technical, organisational, administrative, and security measures that we use:
Technical Measures
Encryption of personal data at rest and in transit. Role-based access control (RBAC) and authentication mechanisms. Secure APIs and application-level protections. Data masking and pseudonymization. Backup and disaster recovery systems.
Security Measures
Network security controls (firewalls). Endpoint protection (anti-malware). Security monitoring and logging. Vulnerability management (scanning and penetration testing). Incident detection and response capabilities. Data breach management mechanisms.
Administrative Measures
Employee training and awareness programs (privacy and security). Confidentiality agreements. Employee onboarding/offboarding procedures. Disciplinary procedures for policy violations. Documentation and record keeping (e.g., RoPA, DPIA). Risk assessments and internal reporting processes.
Organizational Measures
Information security and data protection policies and procedures. Governance structure (e.g., DPO, committees). Defined roles and responsibilities. Vendor and third-party risk management. Data classification and handling standards. Privacy by design and by default implementation. Data retention and secure disposal policies. Internal audits and compliance monitoring.
7. Your Rights
You have certain rights in relation to your personal data processed under this privacy notice. These rights may vary depending on where you are located and which data protection laws apply to you, and may be subject to exemptions.
In all cases, we comply with and respect data subject rights granted under applicable laws and regulations, and we have implemented measures to support the exercise of those rights, including rights of access, deletion, information and correction (as applicable).
To exercise your rights or to obtain more information, please contact us using the details in section 9. We will check your entitlement and respond in most cases within 30 days.
We will also seek to ensure that your personal data is accurate. To help us with this, please notify us of any changes to your personal data by contacting us using the details in section 9.
For residents in the Kingdom of Saudi Arabia, and subject to applicable limitations, your rights include:
Right to be informed
To be informed about processing that affects your personal data, including the purpose and legal basis.
Right of access to Personal Data
To access your personal data in a clear and readable format.
Right to Request Access to Personal Data
To request a copy of your personal data in a readable and clear format.
Right to Withdrawal the Consent
To withdraw consent for processing that relies on consent. To opt out of receiving marketing communications.
Right to Request Correction of Personal Data
To request correction, completion or updating of your personal data.
Right to Request Destruction of Personal Data
To request destruction of personal data which Diriyah Company no longer requires and does not need to retain to comply with legal obligations.
8. Limitation of Liability
Under no circumstances shall Diriyah Company be liable for any direct or indirect, special, incidental or consequential damages that may arise from a claim of breach of this privacy notice, except to the extent such limitation is not permitted under applicable law. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages. In such jurisdictions, our liability is limited to the greatest extent permitted by applicable law.
9. Contact Us
If you have any questions, concerns or complaints regarding our compliance with this privacy notice and applicable laws, if you wish to withdraw your explicit consent, or if you want to exercise your rights, please contact us at:
Email: [email protected]
We will review and respond to your requests within a period not exceeding 30 days. This period may be extended if the implementation requires disproportionate effort or if Diriyah Company receives multiple requests from you. Any extension will not exceed an additional 30 days and you will be notified in advance, with reasons. If you are dissatisfied with our handling of your personal data or our response to your rights, you may contact the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA), via: https://sdaia.gov.sa/en/Contact/Pages/ContactUs.aspx
We encourage you to seek to resolve any issues with Diriyah Company first before contacting the regulator.
10. Updates to this policy
This Privacy Notice was last updated in May 2026.
Diriyah Company reserves the right to update or amend this Privacy Notice at any time to ensure ongoing compliance with applicable laws and regulatory requirements, including the Saudi Personal Data Protection Law (PDPL).
In the event of material changes affecting the processing of personal data, the Company will provide appropriate notice to data subjects through this page.