Privacy Policy

The data controller responsible for your personal information is:

• Entity: SIMAK LABS LTD
• Company number: 17449816 (England and Wales)
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Privacy & data enquiries: support@seemadinah.com

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant international data protection laws, including the Saudi Personal Data Protection Law (PDPL).

We only collect personal information that is necessary to facilitate, confirm, and fulfill your transport booking:

• Passenger Contact Details: First name, last name, mobile phone number (with WhatsApp capability), and email address.
• Journey & Itinerary Data: Scheduled pickup date, pickup time, pickup hotel or address in Madinah, drop-off point for one-way journeys, selected vehicle class, whether you added a guide and in which language, and any passenger assistance notes (e.g. wheelchair, pushchair, or child seat requests).
• Payment & Transaction Details: Amount paid, currency, timestamp, card type and last 4 digits, and transaction references. We do not store your card numbers on our servers; payments are processed by Stripe.
• Communication History: Records of booking confirmations, driver dispatch updates, and customer support communications conducted over WhatsApp or email.
• Journey Feedback: If you answer the feedback request we send after your journey, your star rating, your answers to our questions about the journey, any comments you write, and, if you agree to be quoted, the name you choose to be shown with your quote.

Under Article 6 of the UK GDPR, we process your data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): To process your booking, collect payment, send the journey details to the local partner carrying it out, send your booking confirmation and driver details over WhatsApp and email, coordinate hotel pickup, and process eligible cancellations or refunds.
• Legal Obligation (Article 6(1)(c)): To maintain mandatory corporate, accounting, and tax records under UK company law.
• Legitimate Interests (Article 6(1)(f)): To maintain the security and operational integrity of our website, verify anti-fraud indicators, resolve customer inquiries, and ensure high standards of transport fulfillment. This includes asking once, after your journey, how it went, and using your answers to follow up on problems and to assess the quality of the local partners we work with. Answering is optional.
• Consent (Article 6(1)(a)): To publish a quote from your feedback on our website. We only do so if you tick the box agreeing to it, and only after we have read it. You can withdraw that consent at any time by writing to support@seemadinah.com, and we will remove the quote.

We do not sell your personal data. We share your data solely with vetted third parties required to execute your booking:

• Local Partners, Drivers & Guides: We give your passenger name, WhatsApp number, pickup and drop-off points, and special notes to the Saudi transport company that accepts your booking, and to the driver and any guide it assigns, only so they can meet you and carry out your journey. Before a partner accepts, we share the journey details without your name or number.
• Stripe (payments): Stripe processes your card payment and refunds. Card details go directly to Stripe and are handled under PCI DSS.
• WhatsApp (messages): We send booking messages from our WhatsApp business number, using software we run on our own server. WhatsApp, a Meta service, delivers them to your phone.
• Plunk (email): Plunk delivers our booking, cancellation, refund and feedback emails.
• Hosting: Our website, booking system and database run on a server rented from Contabo GmbH in a data centre in France.

To carry out your journey in Madinah, your passenger details must be sent to the Kingdom of Saudi Arabia, where your journey takes place. WhatsApp (Meta), Stripe and Plunk may also process your details outside the UK.

Under Chapter V of the UK GDPR, transfers of personal data to our Saudi partners are made under Article 49(1)(b) of the UK GDPR, which allows a transfer that is necessary for the performance of a contract between you and us.

Data sent to Saudi partners is handled in line with the Saudi Personal Data Protection Law (PDPL). Our partner agreement forbids partners, drivers and guides from keeping passenger contact details after the journey, using them for marketing, or sharing them with anyone else.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking and customer service records are maintained for 6 years following completion of the journey in order to comply with statutory UK accounting, tax, and dispute-resolution requirements.
• The link a driver uses to confirm a completed trip works once and expires after 7 days. The accept or decline link sent to a partner stops working once it is answered, expires or the booking is assigned. Only a hash of each link is stored.
• Feedback links are single-use: the link stops working once you answer, or 14 days after it is sent. Your feedback is kept with your booking record.

Subject to certain legal limitations, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure: Request deletion of your personal data where retention is no longer legally required.
• Restriction & Objection: Restrict or object to the processing of your data under certain conditions.
• Data Portability: Receive a structured, machine-readable copy of the data you provided to us.

To exercise any of these rights, please contact us at support@seemadinah.com.

You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.