1. Introduction

First Grand Hotel (“we”, “our”, “us”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Saudi Personal Data Protection Law (PDPL) (Royal Decree No. M/19 dated 09/02/1443H corresponding to 16/09/2021G) and other applicable regulations. This policy applies to all users of our website, guests staying at First Grand Hotel, and individuals who interact with our services.

2. What Personal Data We Collect

We collect only the minimum necessary personal data required to provide our services and ensure a seamless guest experience. This may include:

• Information Provided by You: Name, ID/Iqama number, nationality, address, contact numbers, email, booking information, payment details (bank account or credit card numbers), preferences, and special requests.
• Communications Data: Any information shared via phone, email, online forms, social media, feedback, or complaints.
• Website Data: Information collected through cookies and similar technologies such as your IP address, browser details, and login information.
• Images and Video: CCTV recordings for security purposes within hotel premises.

We will not process sensitive personal data except with your explicit consent or as permitted by applicable law.

3. Purpose, Legal Basis, and Retention

We process your personal data for the following purposes:

• To manage reservations and guest check-ins/check-outs
• To provide hospitality services and fulfill contractual obligations
• To process payments and issue invoices
• To respond to inquiries, feedback, and complaints
• To enhance guest experience and tailor our services
• To ensure the safety and security of guests, staff, and property
• To comply with legal and regulatory requirements

Legal Basis for Processing:

• Consent: Where we rely on your consent (e.g., for marketing communication), you may withdraw it at any time.
• Legitimate Interest: For hotel operations, security, and service improvement.
• Legal Obligation: Where processing is required under Saudi law.

Retention Period:

We retain personal data only for as long as necessary to fulfill the above purposes or as required by law. Upon expiry of retention, data will be securely deleted or anonymized.

4. How We Collect Personal Data

• Directly from You: When you book a stay, check in, complete online forms, call us, or interact with our staff.
• Indirectly: From travel agents, booking platforms, or business partners you use to book our services.
• Automatically: Through cookies and analytics tools when you visit our website.
• From Public or Authorized Sources: As permitted by Saudi law.

5. Data Storage and Security

Your personal data is stored securely on servers located within the Kingdom of Saudi Arabia and protected in compliance with the National Cybersecurity Authority’s standards. We implement appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, or loss.

6. Data Sharing

We do not sell or rent personal data. However, we may share your data with:

• Authorized employees who need access to fulfill their job duties
• Trusted third-party service providers (IT, payment processors, booking engines) under strict confidentiality obligations
• Government authorities when required by law

7. Data Subject Rights

You have the following rights under the Saudi PDPL:

• Right to be Informed about how your data is used
• Right to Access and obtain a copy of your personal data
• Right to Rectification of inaccurate or incomplete data
• Right to Request Deletion of your personal data, subject to legal obligations
• Right to Withdraw Consent for processing (where applicable)

To exercise your rights, please contact us at privacy@firstgrandhotel.com.

8. Cookies Policy

Our website uses cookies to improve your browsing experience. You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may limit website functionality.

9. Children’s Privacy

Our website and services are intended for individuals aged 18 years and above. We do not knowingly collect personal data from children.

10. Legal Disclaimer

By using our website or services, you acknowledge and agree to this Privacy Policy. Your continued use of our website constitutes acceptance of any changes to this policy.

11. Complaints and Contact

If you have concerns about how we process your data, you may contact our Data Privacy Officer at privacy@firstgrandhotel.com. If you are unsatisfied with our response, you may escalate the matter to the Saudi Data & Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform (dgp.sdaia.gov.sa).