1. GENERAL

1.1 This Onboard Wi-Fi Privacy Notice (“Notice”) sets out how and when Aviation Services Company, a company registered in the Kingdom of Saudi Arabia (“Riyadh Air”, “we”, “us”, or “our”) collect, use, process and protect your personal data in connection with the provision of wireless internet connectivity inflight (“Onboard Wi-Fi Service”).

1.2 By using the Onboard Wi-Fi Service, you confirm that you have read this Notice and understand how we collect, use and process your personal data when you use our Onboard Wi-Fi Service.

1.3 We may update this Notice from time to time so please check this Notice periodically for updates.

2. WHO IS RESPONSBILE FOR YOUR PERSONAL DATA?

2.1 We are the data controller of your personal data, for the purposes of the Onboard Wi-Fi Service.

2.2 To deliver the Onboard Wi-Fi Service, we may engage third-party service providers who act as data processors on our behalf. These providers are contractually obligated to process your personal data only under our instructions and in compliance with applicable privacy laws and this Notice. Please refer to Section ‎6 for further information.

3. ACCESSING THE ONBOARD WI-FI SERVICE

3.1 The Onboard Wi-Fi Service is provided to loyalty members free of charge.

3.2 Each time you log on to the Onboard Wi-Fi Service, you will be asked to provide your email address or mobile number, your date of birth (if using a mobile number), and your password.

4. WHAT WE COLLECT

4.1 The types of personal data that we may collect and process include the following:

(a) Device Information: We collect details about the device you use to connect to the Onboard Wi-Fi Service, including your device's MAC address (a unique identifier), browser type and version, and operating system. This helps us identify devices on the network and ensure compatibility and security;

(b) Usage Data: We monitor general network usage to maintain performance. This includes your session times (when you connected and disconnected), the amount of data used, and whether you attempted to access websites that are either blocked or allowed under our policies. We do not monitor the content of your communications;

(c) Form Data: If you enter information on the Onboard Wi-Fi Service portal such as your email address, mobile number and date of birth, we collect that data to authenticate your eligibility and support your access to the service;

(d) Flight and Service Data: To deliver and optimise connectivity, we collect technical data such as the aircraft ID, flight route (origin and destination), estimated arrival time, and service performance metrics such as the number of connected users or bandwidth use; and

(e) Portal Interaction Data: We do not track how you interact with the Onboard Wi-Fi Service portal. However, this may change in the future as we may decide to collect such data, including clicks, navigation behaviour, session cookies and any linked loyalty account information, for the purposes of improving usability and troubleshooting issues.

4.2 We do not collect aggregated data. However, this may change in the future as we may decide to collect, use, and share aggregated data (e.g., statistical data). Aggregated data is derived from your personal data but does not reveal your identity once aggregated. If, however, aggregated data can be combined with your data such that you can be identified, we will handle such combined data as personal data in accordance with this Notice.

4.3 Where we request personal data from you, it will typically be mandatory. If the personal data is optional, we will clearly inform you at the time of the request. If you fail to provide mandatory personal data, we may be unable to provide Onboard Wi-Fi Service or fulfill the requests you expect from us.

5. HOW WE PROCESS YOUR PERSONAL DATA

5.1 We will process your personal data outlined in Section ‎4 above for the following purposes:

(a) to verify your eligibility as a loyalty program member and grant you access to the Onboard Wi-Fi Service;

(b) to operate, maintain, and improve the reliability and quality of the Onboard Wi-Fi Service;

(c) to identify and resolve technical issues;

(d) to analyse trends that help us improve user experience and network performance; and

(e) to comply with any legal, regulatory, or aviation security obligations.

6. LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

6.1 We process your personal data on the following legal bases:

(a) Contractual Necessity: We need to process your personal data to fulfill a contract with you or to provide the Onboard Wi-Fi Service you have requested. Without this personal data, we may not be able to provide the Onboard Wi-Fi Service;

(b) Legal Obligation: We may be required by law to process your personal data. This includes complying with regulatory and legal requirements, responding to legal requests from government or law enforcement authorities, or fulfilling obligations related to tax or other legal duties. In such cases, processing your personal data is necessary to comply with our legal obligations; and

(c) Legitimate Interests: We may process your personal data based on our legitimate interests, provided that these interests do not override your rights and freedoms. For example, we may use your personal data to improve Onboard Wi-Fi Service, enhance customer experience or for internal business purposes. We ensure that any such processing is done in a way that is balanced and respects your privacy.

(d) Vital Interests: In certain emergency situations, we may process your Personal Data to protect your vital interests or the safety of others. For example, in the event of a health emergency or other urgent circumstances, we may need to use your personal data to ensure your wellbeing or to protect public health and safety.

(e) Public Interest: We may process your personal data when necessary for activities carried out in the public interest, such as complying with government regulations, ensuring compliance with transport and security regulations.

7. DISCLOSING YOUR PERSONAL DATA

7.1 We may share your personal data within the Riyadh Air, including with internal departments and related companies, for the purposes of managing and supporting the Onboard Wi-Fi Service. This may include IT operations, compliance and service improvement functions. Some of these internal recipients may be located outside the Kingdom of Saudi Arabia, where permitted under applicable privacy laws.

7.2 We may also share your personal data with third-party service providers who support the delivery, operation and maintenance of the Onboard Wi-Fi Service. These providers may include:

(a) onboard Wi-Fi technology partners;

(b) cloud hosting and data center operators;

(c) cybersecurity and technical support services; and

(d) analytics providers (for performance and usage insights).

7.3 These third parties act as data processors and are contractually required to process your personal data only under our instructions and in compliance with applicable privacy laws.

7.4 We may disclose your personal data to government authorities, regulators, or law enforcement agencies if required by law, regulation, or court order, and in accordance with the applicable laws.

8. INTERNATIONAL TRANSFERS

8.1 We may transfer your personal data to third parties in other countries outside the Kingdom of Saudi Arabia whose data protection laws may not be as extensive as those in the Kingdom of Saudi Arabia.

8.2 When transferring your personal data, we will ensure that the country where we send your personal data is providing an adequate level of protection for personal data as approved by the Saudi Data and Artificial Intelligence Authority (SDAIA), or the transfer is required or authorised by applicable law or in connection with any legal proceedings (as applicable) in the relevant country.

8.3 In the absence of an adequate level of protection of personal data, we will ensure that the third party to whom your personal data is transferred has provided appropriate safeguards to ensure the security of your personal data, in line with applicable laws and, in any event, the third party to whom the data is transferred shall ensure that it has maintained reasonable security practices and procedures as required by applicable law.

9. COOKIES

9.1 When you access the Onboard Wi-Fi Service, small data files known as cookies may be stored on your device. These cookies help us recognise your device, manage your login session and enhance your experience by providing personalized services.

9.2 We use both session cookies (which expire when your session ends) and persistent cookies (which remain stored for a limited time). These may contain basic information such as your loyalty membership number, email or login status to ensure smooth access to the Onboard Wi-Fi and related services.

9.3 We may also use third-party tools to help us understand general usage patterns. This data does not personally identify you but helps us improve the service based on trends and preferences.

9.4 Disabling cookies may impact the functionality of the Onboard Wi-Fi Service. Most browsers allow you to manage cookie preferences through their settings, including blocking new cookies or deleting existing ones.

10. YOUR RIGHTS AND CHOICES

10.1 You have certain rights and choices in connection with the personal data we collect from you. To make a request to exercise any of these rights, please contact us at privacy@riyadhair.com. Please note that certain information may be exempt from such requests, for example if we need to keep it to comply with our legal obligations, or to establish, exercise or defend legal claims. Please also note that we may not be obligated or able to fulfill your request if you are located in a country where the law does not require us to do so.

10.2 Right to Be Informed: You are entitled to be informed about how we collect your personal data, the legal basis for collection and processing, how such personal data is processed, stored, destroyed, and to whom it will be disclosed. You can access such details through this Notice or by contacting us at a privacy@riyadhair.com.

10.3 Right of Portability: You are entitled to receive your personal data in a readable and clear format, if technically feasible and where available the right to request the transfer of your personal data to a third party.

10.4 Right to Access Data Your Personal Data: You have the right to request access to your personal data.

10.5 Right to Request Correction of Your Personal Data: You are entitled to request correction of your personal data that you believe is inaccurate, incorrect or incomplete. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

10.6 Right to Request Destruction of Your Personal Data: You are entitled to request destruction of your personal data in certain circumstances. Please note that we cannot delete your Personal Data except by also deleting your user account. To request deletion of your personal data, please contact us at privacy@riyadhair.com.

10.7 Right to Object: You have the right to object when the processing of your personal data is based on legitimate interest or when your data is processed for public interest.

10.8 Right to Withdraw Your Consent for Processing Your Personal Data: You are entitled to withdraw your consent for processing your personal data at any time unless there are legal bases that require otherwise. You can do this by contacting us at privacy@riyadhair.com.

10.9 Right to Lodge a Complaint with Your Local Supervisory Authority: You are entitled to lodge a complaint with the Saudi Data & AI Authority.

11. STORAGE AND RETENTION

11.1 We will keep your personal data only for as long as is necessary for us to fulfill the purposes for which your personal data has been collected as outlined in this Notice (unless a longer period is required or permitted by law, such as tax, accounting, or other legal requirements).

11.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve such purposes through other means, and the applicable legal requirements.

11.3 We will destroy or anonymise your personal data as soon as the purpose of collecting it, or the legal requirement for which are required to keep the personal data, has expired.

12. SECURITY

12.1 We take security issues seriously. We have implemented appropriate organisational and technical measures designed to secure your Personal Data from accidental destruction, loss or unauthorised use and disclosure.

12.2 Given the nature of the Onboard Wi-Fi Services we cannot assure or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to overcome our security and improperly collect, access, steal, or modify your personal data. Therefore, we cannot ensure the security of your personal data transmitted from you to us.

12.3 The safety and security of your personal data also depends on you. Where we have given you (or where you have chosen) a password for access to the Onboard Wi-Fi Service, you are responsible for keeping this password confidential. You should not share your password with anyone.

12.4 If you suspect any misuse or loss of or unauthorised access to your personal data, please contact us at privacy@riyadhair.com.

13. CONTACT US

13.1 If you have queries or concerns about this Notice or our handling of data, please reach out to us using the following contact details:

General Authority of Civil Aviation
Building 4075
P.O. Box 8427
Riyadh 13443
the Kingdom of Saudi Arabia
Email: privacy@riyadhair.com

13.2 When contacting us, please include a reference to this Notice in your communication.

14. LANGUAGE

14.1 This Notice is written in both the Arabic and English languages. In the event of any conflict between the two versions and any translation thereof, the English version shall prevail.