01 Who we are
In plain terms
Al Fajar Transport decides how your data is used, so we are responsible for it.
Al Fajar Transport is a land transport operator registered in the Kingdom of Saudi Arabia, licensed by the Transport General Authority, with its head office in Makkah. Our commercial registration number is 0000000000 Placeholder.
For the purposes of the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations, Al Fajar Transport is the controller of the personal data described in this notice: we determine what is collected and why.
Questions about this notice, and requests to exercise the rights in section 11, go to privacy@alfajar.com Confirm address or to the postal address in section 16.
02 Who this notice covers
In plain terms
Anyone who books with us, travels with us, works with us as a client, or uses this website.
This notice applies to personal data we process about:
- passengers travelling in our vehicles, whether they booked personally or were booked for;
- people who book transport, including group leaders, family members, travel agents and tour operators;
- staff of corporate, institutional and government clients whose transport we arrange under contract;
- employees whose journeys are arranged by their employer under a staff transport contract;
- people who contact us by phone, WhatsApp, email or the forms on this website;
- visitors to this website; and
- applicants for employment with us.
It does not cover the separate privacy practices of third parties whose services you may use alongside ours, such as airlines, hotels, the Nusuk platform or your bank.
03 What we collect
In plain terms
Names, contact numbers, journey details, and what we need to invoice. For visa work, document details as well. Nothing beyond that.
We collect only what a journey, a contract or an enquiry actually requires. By category:
We do not seek health information, and where a passenger chooses to tell us something about a medical condition or mobility need so that we can plan the journey safely, we record only what is necessary for that purpose and for no longer than the journey requires.
04 Where we get it
In plain terms
Mostly from you. Sometimes from the person or company who booked on your behalf.
Most personal data comes directly from you — when you request a fare, make a booking, message the desk, complete a form on this website, or engage our visa services.
We also receive personal data from:
- a group leader, family member, travel agent or tour operator who books on your behalf;
- an employer arranging staff transport under a contract, who provides the names, boarding points and contact numbers needed to run the routes;
- our own operations records, including the movement log, and the record of what was agreed on a call.
Where someone books for you, they confirm to us that they are authorised to share your details for that purpose and that they have made you aware of this notice.
05 Why we use it, and our legal basis
In plain terms
To run your journey, to invoice it, to meet legal duties, and to improve the service. Marketing only if you ask for it.
Where we rely on consent, it is freely given and may be withdrawn at any time without affecting the service you have already booked. Consent is never a precondition of a service where it is not necessary for that service.
06 What is required and what is optional
In plain terms
A few details are needed to run the journey at all. The rest is optional and only helps us plan better.
The implementing regulations require us to tell you which data is necessary and which is not. For a standard booking:
- Necessary: a name, a contact number, the pickup and destination points, the date and time, and the number of passengers. Without these we cannot perform a journey.
- Necessary where applicable: a flight number for an airport pickup, an invoicing entity where a company is to be billed, and document details where you have engaged our visa services.
- Optional: an email address, language preference, notes about luggage, accessibility or elderly passengers, and anything else you choose to tell us. These improve the arrangement; declining them does not prevent the journey, though some requirements — a wheelchair or a child seat — can only be met if we know about them.
Fields on our forms marked optional are optional. We do not make an unnecessary field mandatory in order to collect it.
07 Who we share it with
In plain terms
The driver on your run, our own desk, and the parties we are legally required or genuinely need to tell. Never sold, never rented, never passed on for someone else's marketing.
We share personal data only where it is necessary, and only to the extent necessary:
- The assigned driver — the name, contact number and pickup details for that duty. A driver receives the list for their own run, not a client’s full staff roster.
- Our own desks — operations, contracts, compliance and accounts, according to what each needs.
- The party who booked — where an employer, operator or group leader arranged the journey, confirmation of the movement they arranged.
- Authorities — the Transport General Authority, law enforcement, courts or other competent bodies, where required by Saudi law or in connection with an incident.
- Insurers and, where necessary, legal advisers — in connection with an incident or a claim.
- Licensed visa channels and official platforms — where you have engaged our visa services, the details required to file the application.
- Service providers acting on our instructions — for example hosting, communications and accounting providers, bound to process data only as we instruct and to protect it.
We do not sell personal data. We do not rent or exchange it. We do not provide it to third parties for their own marketing, and we do not build marketing lists from bookings.
08 Transfers outside the Kingdom
In plain terms
Your data normally stays in the Kingdom. Where a transfer abroad is necessary, the PDPL rules and safeguards apply.
Personal data relating to journeys performed in the Kingdom is ordinarily processed and stored within the Kingdom of Saudi Arabia.
A transfer outside the Kingdom may be necessary in limited cases — for example where an international tour operator or a client’s own head office abroad requires confirmation of the movements arranged for its travellers or staff, or where a service provider processes data on our instructions from outside the Kingdom.
Any such transfer is made only where permitted by the Personal Data Protection Law and its implementing regulations, limited to the minimum necessary, and protected by appropriate safeguards including contractual obligations on the recipient, access controls and encryption in transit. Details of transfers relevant to you are available on request.
09 How long we keep it
In plain terms
Accounting records for as long as Saudi law requires. Everything else only as long as it is useful, then deleted.
When a retention period ends, records are deleted or anonymised. Anonymised operational data — journey times, punctuality, route performance with no personal identifiers — may be kept to improve the service.
10 How we protect it
In plain terms
Access is limited to the people running your job, systems are protected, and our people are trained on what they may and may not pass on.
- Access is granted by role. Operations sees live movements, accounts sees invoicing data, drivers see their own duty list.
- Accounts are individual, protected and withdrawn when a person leaves or changes role.
- Data in transit is encrypted, and systems are kept current.
- Our people are trained on confidentiality and on what may never be passed on — a passenger’s itinerary, a client’s staff list, a traveller’s documents.
- Providers processing data on our behalf are bound by contract to protect it and to act only on our instructions.
- Access to passenger data is logged, so a question about who saw a record can be answered.
11 Your rights
In plain terms
You can ask what we hold, get a copy, have it corrected or deleted, withdraw consent, and complain to the regulator. It is free and we answer within thirty days.
Under the Personal Data Protection Law you have the right to:
- Be informed — to know what we collect, why, and on what basis. That is the purpose of this notice.
- Access — to ask what personal data we hold about you and to be told what it is.
- Obtain a copy — to receive your personal data in a readable, commonly used format.
- Correction — to have inaccurate, incomplete or out-of-date data corrected or completed.
- Deletion — to have your personal data destroyed where it is no longer necessary for the purpose it was collected for, subject to records we are legally required to keep.
- Withdraw consent — at any time, where we rely on consent, without affecting anything done before the withdrawal.
- Complain — to the Saudi Data & Artificial Intelligence Authority (SDAIA), whether or not you have raised the matter with us first.
How to exercise a right
Write to privacy@alfajar.com Confirm address, or to the address in section 16, telling us which right you wish to exercise. We may ask for enough information to satisfy ourselves that the request comes from you — ordinarily the booking reference or the contact number used at booking — because releasing a passenger’s data to the wrong person is itself a breach.
There is no charge. We respond within thirty days of receiving a valid request. If a request is unusually complex we will tell you within that period what is happening and when to expect the answer, and if we cannot act on a request we will tell you why and what you can do next.
12 Marketing and consent
In plain terms
We do not add you to a mailing list because you booked a transfer. If you opt in, one click takes you off again.
We send marketing or service updates only to people who have asked to receive them. Booking a journey does not subscribe you to anything, and we do not build marketing lists from booking records.
Where you have consented, every message carries a simple way to stop receiving them, and withdrawing consent takes effect promptly. Withdrawal has no effect on the service you receive.
Operational messages are different: the driver’s name and vehicle plate, a delay notification, a booking confirmation or an invoice are part of performing the journey rather than marketing, and are sent regardless of marketing preferences.
13 Cookies and this website
In plain terms
The site needs a few basic cookies to work. Anything beyond that runs only if you allow it.
You can refuse or withdraw consent for non-essential cookies at any time through the banner or your browser settings. Refusing them does not restrict access to any part of this site.
Our server keeps standard technical logs, including IP address and the pages requested, for security and diagnostics for a limited period.
14 Children
In plain terms
We carry children, but we deal with the adult arranging the journey.
Children travel with us regularly, as part of a family or a group. We do not collect personal data directly from children, and bookings are made by the responsible adult arranging the journey.
Where details about a child are provided — a first name and an age, so that the correct child seat is fitted — they are used only for that journey and are not retained beyond it.
15 If something goes wrong
In plain terms
If data is exposed, we notify the regulator within 72 hours and tell you where you could be affected.
We maintain procedures for detecting, reporting and investigating a personal data breach.
Where a breach occurs, we notify the Saudi Data & Artificial Intelligence Authority without undue delay and no later than seventy-two hours after becoming aware of it, as the implementing regulations require.
Where a breach is likely to cause serious harm to you, we will notify you directly, in plain language: what happened, what data was involved, what we have done, and what you should do.
16 Changes, and how to reach us
In plain terms
We date every version. Write to us about anything in this notice, or complain to SDAIA.
We may update this notice as our services or the law change. The effective date and version number are shown at the top of this page, and material changes affecting contract clients are notified to them directly.
- Data contact
- privacy@alfajar.com Confirm address
- General contact
- info@alfajar.com Placeholder
- Telephone
- +966500000000
- Postal address
- Al Fajar Transport, Makkah, Kingdom of Saudi Arabia Street address
- Regulator
- Saudi Data & Artificial Intelligence Authority (SDAIA), which supervises the Personal Data Protection Law and receives complaints
You are entitled to complain to SDAIA at any time. We would appreciate the chance to put something right first, but that is your choice rather than a condition.
