Privacy Policy

This policy explains how myvisa Travel Services Co. (Commercial Registration No. [CR number]), based in Riyadh, Kingdom of Saudi Arabia, collects, uses and protects your personal data. We are the controller responsible for processing your data for the purposes of this policy.

We comply with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations issued by the Saudi Data and Artificial Intelligence Authority (SDAIA). This policy applies to our website, app and all channels through which we communicate with you.

We collect data you give us directly, data generated when you use our services, and updates we receive from the embassy or visa centre about your application. The main categories are listed below.

Some embassies require information that the law classifies as sensitive, such as credit or health data. We only request it where the embassy requires it, and we handle it with additional safeguards.

• Identity and passport data: name, date of birth, nationality, national ID or iqama number, and passport details.
• Personal photos required for the application.
• Contact details: mobile number, email address and postal address.
• Travel details: destination, dates, bookings, and employment or study details where needed.
• Financial documents: such as bank statements and salary certificates.
• Payment metadata: such as transaction amount, date and the last digits of your card. Card data is handled by a licensed, PCI-DSS compliant payment gateway, and we never store full card numbers.
• Technical data: such as device type, browser and login records, for security and service improvement.

We use your data only for the following specific purposes, and we will not use it for an incompatible purpose without telling you and obtaining your consent where required:

• Preparing and submitting your visa application, booking appointments, and following up with the embassy or visa centre.
• Meeting legal obligations, such as issuing e-invoices under the requirements of the Zakat, Tax and Customs Authority (ZATCA).
• Communicating with you about your order via SMS, WhatsApp and email.
• Preventing fraud and protecting your account and our services.
• Improving our services and user experience, using aggregated data wherever possible.

We process your data on one of the legal bases listed below.

You can withdraw your consent at any time; this does not affect processing carried out before withdrawal. However, we may be unable to complete your application if you withdraw consent for data it requires.

• Your consent: for example sharing your data with the embassy, processing sensitive data, and analytics cookies.
• Performance of a contract: to deliver the service you requested and meet our obligations to you.
• Legal obligation: such as e-invoicing and tax requirements and requests from competent authorities.

We never sell or rent your personal data. We share it only as far as necessary with the parties listed below.

Our service providers are bound by contracts requiring them to protect your data and not use it for any other purpose.

• Embassies, consulates and visa centres (such as VFS, TLS and BLS) to submit your application.
• Our licensed payment gateway to process payments.
• Approved courier companies to deliver passports and documents.
• Messaging, cloud hosting and technical support providers.
• Competent government authorities where the law requires us to.

By the nature of visa services, submitting your application requires transferring your data to the embassy of your destination country or its authorised visa centre, and this data may be processed outside the Kingdom. We only do this with your explicit consent, given when you create your order.

Once received by the embassy, the data is subject to that country's privacy laws. For any other transfers, we follow the safeguards set out in the PDPL and its regulations, and transfer only the minimum data necessary.

We delete application documents (such as passport copies, photos and bank statements) 90 days after your order is closed, unless you choose to save them to your encrypted vault for future applications. You can delete them from your vault at any time.

We keep invoices and financial transaction records for the period required by tax laws, and your account data for as long as your account is active. When it is no longer needed, we securely destroy the data or anonymise it.

We apply technical and organisational measures to protect your data from unauthorised access, loss or alteration, including those listed below.

If a data breach affects your data, we will notify the competent authority and you as required by law, and take the necessary steps to limit its impact.

• Encryption of data at rest and in transit.
• Access controls limiting access to staff who need it for their work.
• Audit logs recording access to and changes in data.
• Staff confidentiality obligations and data-protection training.

The PDPL gives you the following rights, which you can exercise by contacting us. They are listed below.

We will respond within the period set by law and may first ask you to verify your identity. We may be unable to delete certain data if the law requires us to keep it (such as invoices) or if it has already been submitted to the embassy. If you are not satisfied with our response, you have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

• The right to be informed about how your data is collected and processed.
• The right to access your data and obtain a copy of it.
• The right to correct inaccurate data or complete it.
• The right to request deletion or destruction of your data when it is no longer needed.
• The right to withdraw your consent at any time.
• The right to data portability, receiving your data in a clear, machine-readable format.

We use essential cookies to run the website, for example to keep you signed in, remember your language and secure your session. These cannot be turned off, as the site does not work without them.

We only use analytics cookies, which help us understand and improve how the site is used, with your consent, and you can change your choice at any time in the cookie settings.

We do not provide our services directly to anyone under 18. When applying for a child's visa, the parent, guardian or legal representative provides the child's data and consents to its processing on the child's behalf, and we handle it with the same care as all other data.

For any question or request about your personal data, contact us at privacy@myvisa.sa, or write to us at: myvisa Travel Services Co., Riyadh, Kingdom of Saudi Arabia.

We may update this policy from time to time. We will publish the updated version with its last-updated date and notify you of material changes before they take effect. If there is any difference between the Arabic and English texts, the Arabic text prevails.