About Us
شركة مساكن عنبر العقارية, operating under the Amber Hospitality brand (“Amber”, “we”, “us”, or “our”), provides short-term accommodation services in the Kingdom of Saudi Arabia.
This Privacy Policy applies to our guests, prospective guests, website visitors, and corporate clients.
We are committed to protecting Personal Data in accordance with the Saudi Personal Data Protection Law (“PDPL”), its Implementing Regulations, and other applicable laws and regulations in the Kingdom of Saudi Arabia.
This Privacy Policy explains how we collect, use, process, store, disclose, transfer, retain, and protect Personal Data.
Contact Details
Effective Date and Last Update
We may update this Privacy Policy from time to time to reflect changes in our services, systems, business practices, regulatory requirements, or applicable laws.
The latest version will be published on the Amber Hospitality website together with the revised “Last Updated” date.
What Personal Data Do We Collect?
Depending on your interaction with Amber, we may collect and process the following Personal Data:
Identification Information
- Full name
- National ID, Iqama, or passport information
- Nationality
- Date of birth
Contact Information
- Mobile number
- Email address
Reservation and Stay Information
- Reservation and booking details
- Check-in and check-out information
- Stay history
- Guest preferences
Payment and Financial Information
- Payment and transaction information
- Invoice and billing information
Payments may be processed through third-party payment providers. Amber does not intentionally store complete payment-card numbers or card security codes where such information is processed directly by the payment provider.
Security and Property Information
- CCTV footage
- Vehicle information and license plate numbers
Technical and Website Information
- IP address
- Browser type
- Device information
- Operating system
- Website usage information
- Cookies and similar technologies
Communications and Service Information
- WhatsApp and other chat communications with Amber
- Telephone call recordings with Amber, where applicable
- Complaints
- Guest enquiries
- Customer-service requests
- Housekeeping and maintenance requests
We collect only Personal Data that is reasonably necessary for the relevant purposes described in this Privacy Policy.
How Do We Collect Your Personal Data?
Information Collected Directly From You
We may obtain Personal Data directly from you when you interact with Amber through channels including:
- Our website
- Online booking forms
- Telephone
- Payment links
- Guest portal
- Reservation and accommodation processes
- Customer-service communications
We collect this information for purposes including creating and managing reservations, communicating with you, processing payments, providing accommodation services, responding to requests, providing guest support, and complying with applicable legal requirements.
Information Collected Indirectly
We may also receive Personal Data from third parties, including:
- Booking.com
- Airbnb
- Agoda
- Expedia
- Travel agents
- Corporate clients making reservations on behalf of guests
- Payment service providers
The information received may include identification details, contact information, reservation information, payment status, stay information, and other information necessary to provide the booked accommodation or related services.
We use Personal Data received from such sources only for legitimate and specified purposes connected with our accommodation services and other purposes permitted by applicable law.
How Do We Use Your Personal Data?
We may use Personal Data for the following purposes:
- Creating, confirming, modifying, and managing reservations
- Managing check-in and check-out
- Verifying guest identity
- Providing accommodation and guest services
- Communicating with guests before, during, and after their stay
- Processing and confirming payments
- Issuing invoices and maintaining transaction records
- Responding to guest questions, complaints, and service requests
- Managing housekeeping and maintenance requests
- Protecting guests, employees, visitors, and Amber properties
- Preventing fraud, misuse, unauthorized activity, and security incidents
- Performing operational and service analytics
- Improving our properties, services, website, and guest experience
- Maintaining appropriate financial and operational records
- Meeting applicable legal and regulatory requirements
- Sending WhatsApp marketing communications where the recipient has provided the required consent
We will not use Personal Data for purposes that are incompatible with the purposes for which it was collected unless permitted by applicable law.
Required Information
Certain Personal Data is necessary for Amber to provide accommodation and reservation services.
If required Personal Data is not provided, we may be unable to:
- Create or confirm a reservation
- Verify a guest's identity
- Process or confirm a payment
- Complete check-in
- Provide certain accommodation or guest services
- Meet applicable regulatory requirements
Marketing Communications
Amber may send marketing or promotional communications through WhatsApp.
Where consent is required, marketing communications will only be sent after obtaining the appropriate consent.
You may withdraw your marketing consent at any time by following the available opt-out method or contacting:
Withdrawal of marketing consent will not affect Personal Data processing that is carried out under another lawful basis.
Legal Basis for Collecting and Processing Personal Data
Amber processes Personal Data only where an appropriate legal basis exists under applicable law.
Depending on the processing activity, we may rely on one or more of the following bases:
Contractual Necessity
We may process Personal Data where processing is necessary to enter into or perform our accommodation or reservation relationship with you.
This includes processing required for:
- Reservations
- Check-in and check-out
- Guest communications related to a stay
- Payments
- Accommodation services
- Housekeeping and maintenance requests
- Customer support related to your booking or stay
Legal or Regulatory Obligations
We may process and retain Personal Data where required to comply with applicable Saudi laws, regulations, accounting requirements, tax requirements, tourism requirements, lawful government requests, or other regulatory obligations.
Consent
We may rely on your consent where required by law, including for certain marketing communications and other optional processing activities.
Where processing is based on consent, you may withdraw your consent at any time, subject to applicable legal requirements.
Legitimate Interests
Where permitted under applicable law, Amber may process Personal Data where necessary to achieve a legitimate interest, provided that the processing does not prejudice your rights and interests.
Such purposes may include:
- Fraud prevention
- Information and system security
- Protection of Amber properties
- Service improvement
- Operational analytics
- Protecting Amber's legitimate business interests
Vital Interests
Where permitted under applicable law, we may process Personal Data where necessary to protect the life, health, or safety of an individual, including in emergency circumstances.
Payment Information
Payments may be processed through secure third-party payment processing systems.
Amber does not intentionally receive or store complete debit or credit card details, including complete card numbers or card security codes, where payment details are entered directly into the payment provider's systems.
We may receive limited transaction information necessary to:
- Confirm payment
- Reconcile transactions
- Process refunds
- Resolve payment issues
- Maintain financial records
CCTV
Amber properties may use CCTV in common areas and security-sensitive areas for:
- Guest and employee safety
- Property security
- Prevention and investigation of unauthorized access
- Prevention and investigation of security incidents
- Protection of guests, visitors, employees, and property
CCTV is not used in private guest areas where individuals have a reasonable expectation of privacy.
CCTV recordings are generally retained for 30 days.
Recordings may be retained for a longer period where reasonably necessary in connection with an incident, investigation, legal proceeding, regulatory requirement, or lawful request from a competent authority.
How Do We Disclose Personal Data?
Amber does not sell, rent, or trade Personal Data.
Where necessary for the purposes described in this Privacy Policy, Personal Data may be disclosed to or processed by:
Payment Service Providers
For processing payments, refunds, transaction confirmations, and related financial services.
Property Management System Provider
For managing reservations, guest records, accommodation operations, communications, and related hospitality services.
Booking Platforms
Including online travel agencies and booking platforms where necessary to create, manage, modify, or reconcile reservations.
IT Service Providers
For website operation, system support, hosting, cybersecurity, technical maintenance, communications, and related technology services.
We may also disclose Personal Data where required by applicable law or in response to a lawful request from an authorized government, judicial, regulatory, or law-enforcement authority.
Where third parties process Personal Data on our behalf, appropriate contractual, technical, administrative, and organizational safeguards will be applied as required by applicable law.
International Transfer and Hosting of Personal Data
Certain guest Personal Data processed through Amber's Property Management System may be hosted outside the Kingdom of Saudi Arabia using Amazon Web Services (AWS) infrastructure through our PMS provider.
Amber has entered into a Data Processing Agreement with the relevant service provider covering the processing and protection of Personal Data.
Any transfer or disclosure of Personal Data outside the Kingdom will be carried out subject to the requirements of the Saudi PDPL, its Implementing Regulations, applicable regulations governing international transfers of Personal Data, and any other applicable requirements.
Where required, Amber will apply appropriate contractual, organizational, and technical safeguards to protect Personal Data transferred or processed outside the Kingdom.
Amber will seek to ensure that international transfers are limited to Personal Data reasonably necessary for the relevant processing purpose.
How Do We Store and Protect Personal Data?
Personal Data may be stored electronically within Amber's systems and within systems operated by authorized service providers.
Guest and reservation information processed through our Property Management System may be hosted outside Saudi Arabia using AWS infrastructure through the PMS provider, subject to applicable data protection requirements and contractual safeguards.
Amber applies appropriate technical, administrative, and organizational security measures designed to protect Personal Data from:
- Unauthorized access
- Unauthorized disclosure
- Accidental or unlawful loss
- Misuse
- Alteration
- Destruction
- Other unauthorized processing
Access to Personal Data is limited to authorized persons who require access for legitimate operational, technical, contractual, or legal purposes.
How Long Do We Keep Personal Data?
Amber retains Personal Data only for as long as reasonably necessary to achieve the purpose for which it was collected or for any longer period required under applicable law.
Our general retention periods are:
Reservation and Stay Records
Generally retained for 5 years after checkout, unless a different period is required by applicable law or is necessary in connection with a legal claim, investigation, or dispute.
National ID, Iqama, and Passport Information
Retained only for the period necessary to fulfill guest verification and applicable legal or regulatory requirements, after which the data will be securely deleted or anonymized unless further retention is legally required.
Payment, Invoice, and Financial Records
Retained for the period required under applicable Saudi accounting, tax, commercial, and other regulatory requirements.
CCTV Recordings
Generally retained for 30 days, unless longer retention is necessary for an investigation, security incident, legal proceeding, regulatory requirement, or lawful request.
Customer-Service and Communication Records
WhatsApp messages, customer-service communications, complaints, and similar records may generally be retained for 3 years after the last relevant interaction, unless longer retention is required for legal, regulatory, security, or dispute-resolution purposes.
Marketing Information
Marketing consent and associated information may be retained until consent is withdrawn or for up to 2 years following inactivity, subject to applicable legal requirements.
Website Logs
Technical website logs may generally be retained for up to 12 months.
Cookies
Cookies may generally remain active for up to 12 months, depending on the type and purpose of the cookie, unless a shorter period applies.
Destruction of Personal Data
When Personal Data is no longer required and there is no legal basis requiring further retention, Amber will take reasonable measures to dispose of it securely.
Depending on the nature of the data and system involved, this may include:
- Secure electronic deletion
- Removal from active systems
- Anonymization so that the information can no longer identify an individual
Where deletion from a backup system cannot occur immediately for technical reasons, access to such data will remain restricted until it is securely removed through the applicable backup lifecycle.
Cookies and Technical Information
Our website may use cookies and similar technologies for purposes including:
- Website functionality
- Security
- Reservation functionality
- Performance monitoring
- Analytics
- Improving user experience
Technical information collected may include:
- IP address
- Browser type
- Device type
- Operating system
- Access date and time
- Website usage information
Where consent is legally required for particular cookies or similar technologies, Amber will seek the appropriate consent.
Your Rights Regarding Your Personal Data
Subject to the Saudi PDPL, its Implementing Regulations, and applicable legal limitations, you may have the following rights:
Right to Be Informed
You have the right to know how Amber collects and processes your Personal Data, including the purposes of collection, applicable legal basis, storage, retention, destruction, and disclosure.
This Privacy Policy is intended to provide this information.
Right of Access
You may request access to Personal Data that Amber holds about you.
Requests can be submitted to:
Amber may request appropriate information to verify your identity before providing access to Personal Data.
Right to Obtain Your Personal Data
You may request a copy of Personal Data held by Amber in a readable and clear format, where technically feasible and subject to applicable legal requirements.
Requests may be submitted to:
Right to Request Correction
You may request the correction, completion, or updating of Personal Data that you believe is inaccurate, incomplete, or outdated.
Requests may be submitted to:
Once the request has been verified, Amber will review and process it within the applicable legal timeframe.
Right to Request Destruction
You may request the destruction of Personal Data where the conditions for destruction under applicable law are satisfied.
Amber may be required to retain certain Personal Data despite such a request where retention is required or permitted by applicable law.
Right to Withdraw Consent
Where Personal Data is processed based on your consent, you may withdraw that consent at any time by contacting:
Withdrawal of consent does not affect processing performed before withdrawal and does not affect processing carried out under another valid legal basis.
Processing of Data Subject Requests
Requests relating to your Personal Data rights should be submitted to:
Amber may take reasonable steps to verify the identity of the person submitting the request before responding.
We will generally respond to requests concerning rights under the PDPL within 30 days from receipt of a valid request.
Where permitted under applicable law and where additional or unexpected effort is required or multiple requests have been received from the same individual, the response period may be extended by up to an additional 30 days. Where applicable, we will notify the requester of the extension and the reasons for it.
No fee will ordinarily be charged for exercising rights under the PDPL unless otherwise permitted by applicable law.
Certain rights may be subject to restrictions, exceptions, or other requirements established under applicable law.
Privacy Contact
Amber has designated its IT Department and IT Manager as the internal contact responsible for coordinating privacy enquiries and Personal Data requests.
This designation should not be interpreted as representing that a statutory Data Protection Officer has been appointed unless Amber formally makes such an appointment in accordance with applicable requirements.
Complaints and Objections
If you have a concern or complaint regarding the collection, use, disclosure, storage, protection, or other processing of your Personal Data, you may first contact Amber's IT Department.
Please provide sufficient information to allow us to understand and investigate your complaint.
Amber will seek to respond to privacy complaints within 30 days from the date on which a valid complaint is received.
Complaints to the Competent Authority
If you are not satisfied with Amber's handling of your privacy complaint, or where you otherwise have the right to do so under applicable law, you may submit a complaint concerning the application of the Personal Data Protection Law to the Saudi Data & AI Authority (SDAIA) or the competent authority designated under applicable Saudi law.
Information regarding Personal Data protection and available complaint services can be obtained through the official channels of the competent authority.
Contact Us
For questions regarding this Privacy Policy, Personal Data processing, exercising your privacy rights, withdrawing consent, or filing a privacy complaint, please contact:
شركة مساكن عنبر العقارية
Amber Hospitality