Privacy Policy

The data controller responsible for your personal information is:

• Entity: SIMAK LABS LTD
• Company number: 17449816 (England and Wales)
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Privacy & data enquiries: support@seemadinah.com

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant international data protection laws, including the Saudi Personal Data Protection Law (PDPL).

We only collect personal information that is necessary to facilitate, confirm, and fulfill your transport booking:

• Passenger Contact Details: First name, last name, mobile phone number (with WhatsApp capability), and email address.
• Journey & Itinerary Data: Scheduled pickup date, pickup time, pickup hotel or residential address in Madinah, selected vehicle class, and any passenger assistance notes (e.g. wheelchair, pushchair, or child seat requests).
• Payment & Transaction Details: Amount paid, currency, timestamp, payment method type (e.g. Apple Pay, card last 4 digits), and transaction references. We do not store your raw credit or debit card numbers on our servers; payments are processed securely via Stripe.
• Communication History: Records of booking confirmations, driver dispatch updates, and customer support communications conducted over WhatsApp or email.

Under Article 6 of the UK GDPR, we process your data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): To process your booking, collect payment, transmit dispatch instructions to the assigned licensed Saudi Transport Operator, send your driver details over WhatsApp, coordinate hotel pickup, and process eligible cancellations or refunds.
• Legal Obligation (Article 6(1)(c)): To maintain mandatory corporate, accounting, and tax records under UK company law.
• Legitimate Interests (Article 6(1)(f)): To maintain the security and operational integrity of our website, verify anti-fraud indicators, resolve customer inquiries, and ensure high standards of transport fulfillment.

We do not sell your personal data. We share your data solely with vetted third parties required to execute your booking:

• Licensed Saudi Transport Operators & Drivers: We provide your passenger name, WhatsApp number, hotel address, and special notes to the TGA-licensed Saudi commercial transport company assigned to your booking and their designated driver strictly for the purpose of meeting you and fulfilling your ride.
• Payment Gateway (Stripe Inc.): Payment card transactions are tokenized and processed via Stripe under strict PCI-DSS Level 1 compliance.
• Communication Infrastructure (Meta WhatsApp Cloud API): Used to send automated, high-priority booking confirmations and driver details directly to your mobile device.
• Cloud & Hosting Infrastructure: Secure servers located within high-security data centers operating under encrypted transmission protocols.

To fulfill your journey in Madinah, your passenger details must be transferred to the Kingdom of Saudi Arabia (where your ride takes place) and to Meta Platforms for WhatsApp message delivery.

Under Chapter V of the UK GDPR, transfers of personal data to our Saudi Transport Partners are carried out pursuant to Article 49(1)(b) of the UK GDPR, which authorizes international transfers where the transfer is strictly necessary for the performance of a contract between the individual and the data controller.

All data transmitted to Saudi partners is handled in compliance with the Saudi Personal Data Protection Law (PDPL). Our partner contracts strictly prohibit operators and drivers from retaining passenger contact details, using passenger data for unsolicited marketing, or sharing customer numbers with unauthorized third parties.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking and customer service records are maintained for 6 years following completion of the journey in order to comply with statutory UK accounting, tax, and dispute-resolution requirements.
• Temporary driver completion tokens and automated dispatch tokens are automatically hashed and expired upon trip completion.

Subject to certain legal limitations, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure: Request deletion of your personal data where retention is no longer legally required.
• Restriction & Objection: Restrict or object to the processing of your data under certain conditions.
• Data Portability: Receive a structured, machine-readable copy of the data you provided to us.

To exercise any of these rights, please contact us at support@seemadinah.com.

You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.