Privacy Policy

1. WHO WE ARE

1.1 We are, Aviation Services Company (hereinafter referred to as "Riyadh Air", "we", "us", or "our"), a Saudi national airline providing international and domestic passenger transportation, cargo and other aviation related services.

1.2 We provide services and products through our websites, our mobile applications, other digital platforms and communication channels, which may include, where available, messaging platforms such as WhatsApp, as well as contact centre, chatbot, and customer support tools operated by or on behalf of Riyadh Air (our “Services”). These Services may include both Riyadh Air offerings and services provided by third parties, which may be made available directly on our website, mobile application and digital platforms or via external links (“Platforms”).

1.3 Your privacy is important to us, and we will take all relevant measures to safeguard your personal data in accordance with all applicable laws and regulations. This privacy policy (“Privacy Policy”) together with our website terms of use, cookie policy and any other documents referred to in it, outlines the basis on which we process your personal data, and explains how your personal data is collected, used and protected.

2. OUR COMMITMENT WITH REGARDS TO YOUR PERSONAL DATA

2.1 We respect your privacy and are committed to protecting your personal data by adhering to this Privacy Policy and upholding the highest standards of personal data protection.

2.2 Riyadh Air will ensure that your personal data is processed lawfully, fairly and transparently, that it is collected for specific, explicit and legitimate purposes, and that it is not used in ways that are incompatible with those purposes.

2.3 We will also ensure that only the personal data necessary for these purposes is collected. We take reasonable steps to ensure that such data is accurate and, where necessary, kept up to date. We also provide mechanisms for individuals to correct or delete their data when needed.

3. HOW WE COLLECT YOUR PERSONAL DATA

3.1 We collect personal data through various means, depending on your interactions with Riyadh Air. These include:

(a) Directly from you, such as when you:

(i) visit the website https://www.riyadhair.com/ or our social media pages;

(ii) register, create or modify an online or in-app (i.e. mobile application) account with us, including your Riyadh Air account and loyalty program account (once active);

(iii) book or modify your travel with us;

(iv) purchase third party products or services through our Platforms (when made available);

(v) use one of our mobile applications;

(vi) communicate with us using our digital assistance centre, or via our customer support and assistance channels, including telephone, email, SMS, WhatsApp, chatbots, or other electronic messaging services between you and us; or

(vii) connect to the Wi-Fi in an airport lounge

(b) From third parties, such as:

(i) if you interact with our advertising and mobile applications on third party websites and services;

(ii) our business partners and service providers acting on our behalf based on our instructions;

(iii) travel agencies or authorized booking intermediaries when making or managing bookings on your behalf through our Platforms or other booking channels; or

(iv) other third parties with your consent.

(c) Automatically:

(i) when you navigate our Services, we may collect usage details, IP addresses, and information via cookies and other tracking technologies (see our cookie policy for further information);

(ii) through the use of our mobile applications and digital tools (for example, basic app usage and interaction data); or

(iii) via third party tools, platforms, and software development kits (SDKs) integrated into our mobile applications and communication channels to support customer communications, contact centre operations, chat, messaging and virtual assistance services (including WhatsApp), as well as functions such as fraud detection, performance monitoring, crash reporting, and in-app customer support. These services may involve multiple parties, including messaging platform providers (such as WhatsApp), contact centre and interaction management platforms, artificial intelligence and automation providers (where chat or virtual assistant functionality is enabled), and customer support service providers and agents. These tools may collect device identifiers, IP addresses, usage statistics, contact details, message content, interaction history, metadata associated with the communication, and any personal data you choose to provide during chat interactions.

(d) Through our cargo services, where we process personal data of shippers, consignees, and logistics contacts. This data may be shared with ground handling agents, customs authorities, interline cargo partners, and processed through our cargo and claims management systems.

4. TYPES OF PERSONAL DATA WE COLLECT

4.1 We collect the following types of personal data when you use our Services:

4.1.1 Baggage Data - including any special baggage requirements or lost luggage information;

4.1.2 Booking and Itinerary Data - such as your flight details, booking reference, travel arrangements, booking history, and other information necessary to facilitate your travel;

4.1.3 Business Travel Data - including your job title, employer’s name and whether your travel is sponsored or arranged by your employer;

4.1.4 Communication Data – including records of your interactions with us through customer support, contact centres, messaging platforms (e.g. WhatsApp), chatbots, email, telephone calls, and other assistance channels, such as records of service inquiries and feedback and complaints, message content, and interaction history;

4.1.5 Contact Data - such as postal address, email address and telephone number;

4.1.6 Device and Location Data – including information about the device you use and geographical location;

4.1.7 Identity Data - such as your title, full name, gender, date of birth, nationality and country of residence, visa and passport details, or other government-issued identification;

4.1.8 Third Party Booking Data - if you are, or a third party is, making a booking on your behalf of or on behalf of another individual, whether through our Platforms or other booking channels, the personal data about that individual;

4.1.9 Loyalty Program Data - this includes loyalty membership numbers and status, points and currency balances, redemption history including with partner programs;

4.1.10 Travel Document and Entry Data – such as destination address and other information required for immigration or entry purposes;

4.1.11 Marketing and Communication Preferences - including your preferences for receiving newsletters, promotions, surveys or other communications from us or our partners;

4.1.12 Payment Data - such as payment card details and billing address;

4.1.13 Travel Preferences - such as meal preferences, preferred seating, and special assistance requirements;

4.1.14 Technical Data – such as your IP address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access our Services;

4.1.15 Profile Data – including your username and password (where applicable), SFEER loyalty program preferences, booking history, service preferences, and responses to surveys or feedback requests;

4.1.16 Usage Data – including information about how you interact with us on our Platforms;

4.1.17 Emergency Contact Data – including the name, relationship, and contact details of a person to be contacted in case of emergency;

4.1.18 Government and Regulatory Data – such as visa status, customs declarations, travel bans, or other data required by immigration, border control, or aviation authorities;

4.1.19 Security and Safety Data – including CCTV footage, incident reports, and other data collected for safety, fraud prevention, or regulatory compliance; and

4.1.20 Social Media Data – if you interact with us via social media platforms, we may collect your public profile information and any messages or content you share with us; and

4.1.21 Cargo Data – Identity and contact data of consignor(s) and consignee(s) (including shippers and recipients), cargo booking details, and shipment tracking data.

4.2 Special Categories of personal data

In certain circumstances, we may collect, use, store, process and transfer special categories of personal data. We will only do so where we have a legitimate need and in accordance with applicable data protection laws. This may include providing you with notice and, where required, obtaining your prior, express consent. For more information, see Section 5. These categories may include:

4.2.1 Health Data – such as medical conditions, disability status, pregnancy status, or other health-related information necessary to ensure in-flight safety (e.g. in relation to allocated seating in exit rows) and provide appropriate services (e.g., special assistance, medical clearance, or meal preferences);

4.2.2 Biometric Data - including fingerprint scans or facial recognition data, where such technologies are implemented for identity verification, boarding, or security purposes;

4.2.3 Religious Beliefs – for example, when booking religious travel (such as Hajj or Umrah) or selecting meals that reflect religious dietary requirements; and

4.2.4 Images and Audio – such as CCTV footage recorded in airport lounges or onboard aircraft, audio recordings of customer service calls, and audio messages or voice notes shared via messaging platforms, where applicable.

4.3 We may need to collect personal data to give you access to certain Platforms and/or provide certain Services. Where we allow you to choose not to provide the requested personal data and you still access the Platforms and/or Services (including our social media pages), the Services available to you may be limited and some features may not work.

5. PURPOSES AND LEGAL BASES FOR COLLECTING AND PROCESSING YOUR PERSONAL DATA

5.1 We rely on the following legal bases for processing your personal data:

5.1.1 Performance of a contract: where the processing is necessary to perform a contract we are about to enter into or have entered into with you.

5.1.2 Legitimate interests: where the processing is necessary to pursue our legitimate interests or those of a third party. We consider and balance any potential impact on you and your rights before we process your personal data for legitimate interests.

5.1.3 Legal obligation: where the processing is necessary for compliance with a legal obligation that we are subject to.

5.1.4 Consent: where we have obtained your active agreement to use your personal data for a specified purpose.

5.1.5 Vital interests: where the processing of your personal data is necessary to protect your vital interests, or those of a third party, such as in the event of a medical emergency.

‎

5.2 We have set out below further information on the ways we will use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what the relevant legitimate interests are, where appropriate.

Purpose for Processing	Category of Personal Data	Legal Basis
To process and manage your booking and travel with us, whether made directly or by a third party through the Platforms, including payment, ticketing, check-in, and in-flight services	Identity Data, Contact Data, Booking and Itinerary Data, Payment Data, Third Party Booking Data, Baggage Data, Business Travel Data, Loyalty Program Data, Travel Document and Entry Data, and Travel Preferences	Performance of a contract Legal obligation
To register and manage your participation in the SFEER loyalty program, including account creation, profile updates and redemption of benefits	Identity Data, Contact Data, Profile Data, Loyalty Program Data	Performance of a contract Legitimate interests – to manage account and administer loyalty benefits
To respond to and resolve your queries, complaints, and feedback about our Services or products	Identity Data, Contact Data, Communication Data, Baggage Data, Booking and Itinerary Data, Business Travel Data, Loyalty Program Data	Legitimate interests – to manage and improve customer support
To enable your participation in promotional campaigns, contests, and competitions through our Platforms	Social Media Data, Contact Data, Identity Data, Profile Data	Consent; Legitimate interest – to run promotions and contests
To facilitate access to lounges and flight-related premium services, including identity verification and access control	Booking and Itinerary Data, Business Travel Data Identity Data, Contact Data, Profile Data	Performance of a contract; Legitimate interest – to offer premium Services
To manage and facilitate air cargo Services, including shipment processing, payment, and customs clearance	Identity Data, Contact Data, Cargo Data, Payment Data	Performance of a contract; Legal obligation
To provide appropriate support in emergency situations, including medical attention or notification of emergency contacts	Identity Data, Booking and Itinerary Data, Health Data, Emergency Contact Data	Vital interests; Legal obligation
To collect and analyze information from cookies and similar technologies to enhance functionality, performance, and user experience across our digital platforms	Device and Location Data, Technical Data, Usage Data	Consent (where required); Legitimate interest – to enhance user experience
To collect and enrich your profile with data from third party platforms for a more personalized experience	Identity Data, Social Media Data, Marketing and Communication Preferences	Consent; Legitimate interest – to supplement customer profile
To manage our interactions with you across channels, including preferences, Services history, and communications	Identity Data, Contact Data, Communication Data, Profile Data	Legitimate interests – to manage and maintain customer relationships
To send marketing communications and measure engagement, based on your stated preferences and behaviours	Identity Data, Contact Data, Marketing and Communication Preferences, Usage Data	Consent
To use biometric information for identity verification and access facilitation, such as during boarding or entry to secure areas	Identity Data, Biometric Data	Consent; Legal obligation (if required by law)
To investigate, manage and resolve legal claims or disputes involving you or third parties	Identity Data, Contact Data, Communication Data, Security and Safety Data	Legitimate interests – to enable us to effectively manage and defend these claims and disputes Legal obligation
To comply with legal, regulatory and governmental requirements, including aviation, customs, tax, and safety obligations	Identity Data, Travel Document and Entry Data, Government and Regulatory Data	Legal obligation
To protect and secure our Platforms, Services and/or business against security threats	Baggage Data, Booking and Itinerary Data, Business Travel Data, Communication Data, Contact Data, Device and Location Data, Identity Data, Third Party Booking Data, Loyalty Program Data, Travel Document and Entry Data, Technical Data, Usage Data, Emergency Contact Data, Government and Regulatory Data, Security and Safety Data, Cargo Data.	Legitimate interests – to protect our business, staff, customers and others who work with us
To arrange and deliver special assistance you request, including mobility aid, medical support, or other accommodations	Identity Data, Health Data, Travel Preferences	Consent

5.3 To the extent permitted by applicable law, we may anonymise, aggregate or otherwise deidentify your personal data to generate statistical, analytical, or industrial insights (“Aggregated Data”). This Aggregated Data may be used by us or shared with third parties for purposes such as improving our services, conducting research, or supporting marketing and business development activities.

5.4 Aggregated Data is derived from your personal data but is not considered personal data under applicable law if it does not directly or indirectly identify you. If we combine or connect Aggregated Data with your personal data in a way that could identify you, we will treat the combined data as personal data and handle it in accordance with this Privacy Policy.

‎

5.5 We do not make any significant decisions about you based solely on the automated processing of personal data without meaningful human involvement. We will inform you by updating this policy, if this position changes.

6. WHO DO WE SHARE YOUR PERSONAL DATA WITH

6.1 Where it is reasonably necessary to do so, we may regularly disclose and share your personal data as described in Section 4, as relevant, with:

government authorities, including, customs, border control, security agencies, anti-terrorism, and immigration authorities, as required by law;
airport authorities and ground handling agents, to facilitate your travel and ensure operational efficiency;
other airlines, including codeshare and interline partners, for booking, check-in, and travel continuity;
travel agents, booking platforms, and loyalty program partners (once active), to support your travel arrangements and benefits;
cargo and freight service providers, logistics partners, customs brokers, and other entities involved in the handling, transportation, and delivery of cargo shipments, where such sharing is necessary to fulfil contractual or regulatory obligations;
insurance providers, for travel-related coverage and claims;
digital assistance and contact centre teams, messaging platform providers (such as WhatsApp), customer support providers (including outsourced contact centre agents), and technology partners (such as contact centre platforms and AI service providers) so that they can help us manage your interactions, preferences, and service history to deliver a personalized and seamless travel experience;
contractors, service providers and vendors, so that they can support our business operations, including IT infrastructure, analytics, payment processing, and customer service;
co-promotion and marketing partners, where you provided consent for such disclosure, to conduct marketing and promotional initiatives;
legal advisors, auditors, consultants, and other professional advisors, where necessary for us to obtain professional advice, and/or where necessary for compliance, dispute resolution, or regulatory obligations;
purchaser or potential purchaser, where necessary in connection with a corporate transaction, where personal data may be part of transferred assets; or
third parties whose products or services are offered on our Platforms, to allow them to market their offering to you, only if you have provided your consent.

6.2 Our legal basis for our sharing of your personal data with: (i) third parties whose products or services are offered on our Platforms; and (ii) co-promotion and marketing partners is ‘Consent’.

6.3 Our legal basis for our sharing of your personal data with: (i) government authorities; (ii) cargo and freight service providers, logistics partners, customs brokers; and (iii) legal advisors, auditors, consultants, and other professional advisors, in circumstances where this is required in order for us to comply with law or a regulatory requirement underpinned by statute, is ‘Legal obligation’.

‎

6.4 In other cases set out above our legal basis for the sharing is our ‘Legitimate interests’ in fulfilling each of the purposes stated in Section ‎6.1

‎

6.5 We may also disclose your personal data:

to comply with any court order, applicable law, or legal process, including to respond to any government or regulatory request;
to enforce or apply our terms of use and other agreements, including for billing and collection purposes; or
if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Riyadh Air, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction
‎

6.6 Our legal basis for the sharing of your personal data described in Section ‎6.5 is our ‘Legitimate interests’ in fulfilling each of the stated purposes.

‎

6.7 When we disclose and share your personal data, we ensure that the recipient applies appropriate data protection measures, and we implement additional safeguards to maintain the confidentiality, integrity and security of your personal data.

7. HOW WE STORE YOUR PERSONAL DATA

7.1 Your personal data is stored and processed using secure cloud infrastructure provided by third party vendors, including Microsoft Azure, Amazon Web Services (“AWS”), Adobe Cloud (hosted on Microsoft Azure) and Google Cloud. These data centres are currently located in:

Europe (Ireland, Netherlands) for storing and managing your travel preferences, loyalty program details, marketing communications, customer service interactions and consent records.
Kingdom of Saudi Arabia for sending notifications (such as email, SMS, or WhatsApp) and processing customer orders. The use of third-party messaging platforms (such as WhatsApp) may involve processing or transient routing of data by those providers in accordance with their own infrastructure and applicable laws.

7.2 We plan to migrate all personal data to data centres located within the Kingdom of Saudi Arabia once local infrastructure by Microsoft Azure and AWS becomes operational. When this migration occurs, we will update this Privacy Policy and notify you through appropriate channels, as required under the applicable laws.

7.3 We apply appropriate technical and organisational security safeguards to protect your personal data against accidental or deliberate manipulation, loss, deletion or unauthorised access. These safeguards include:

Restricting access to systems and networks.
Training our staff on proper handling of personal data.
Applying strict controls over the storage locations of your personal data.
Deleting or anonymising personal data when it is no longer needed.

8. TRANSFER OF YOUR PERSONAL DATA

8.1 We may transfer your personal data to countries outside your country of residence as part of providing our Services. Where we transfer your personal data to countries not recognised as adequate, we will implement appropriate safeguards to ensure your personal data remains protected in accordance with applicable data protection laws.

8.2 Where your personal data is transferred outside the Kingdom of Saudi Arabia, we will ensure that such transfers are permitted under applicable data protection laws, including by transferring it to countries recognised by the Saudi Data and Artificial Intelligence Authority (“SDAIA”) as providing an adequate level of protection for personal data. Where we transfer your personal data to countries not recognised as adequate by SDAIA, we will implement appropriate safeguards to ensure your personal data remains protected. These may include Standard Contractual Clauses approved by SDAIA, or other legally approved mechanisms.

8.3 Further jurisdiction‑specific information on international data transfers (including transfers from the UK and the European Economic Area (“EEA”)) is set out in Schedule 1 (Jurisdiction‑Specific Supplements).

8.4 If you would like further details on the safeguards we apply to international transfers, or a copy of the relevant Standard Contractual Clauses (“SCCs”) please email us at privacy@riyadhair.com.

9. HOW LONG DO WE KEEP YOUR PERSONAL DATA

9.1 We will only keep your personal data for as long as is necessary for us to fulfil the purposes for which your personal data has been collected as specified in this Privacy Policy, including to handle claims and complaints, unless a longer period is required by applicable laws.

9.2 To determine the appropriate retention period for personal data, we consider the amount, nature, sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data and whether those purposes can be achieved through other means, as well as applicable legal requirements.

9.3 We will destroy or anonymise your personal data as soon as the purpose for collecting it, or the legal requirement to retain it, has expired.

10. YOUR RIGHTS IN RELATION TO OUR PROCESSING OF YOUR PERSONAL DATA

10.1 In accordance with applicable laws, you have certain rights in connection with the personal data we collect from you, which are as follows:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold that relates to you and to check that we are lawfully processing it (subject to certain lawful rights to redact or withhold certain information).
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain scenarios.
Request the transfer of your personal data to you or to a third party. In certain circumstances, we may be able to provide you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.
Object to processing of your personal data: (i) at any time where it is used for direct marketing (including profiling); or (ii) in certain other situations e.g. where we use your personal data on the legal basis of ‘Legitimate interests’, unless there are compelling legitimate grounds for the processing to continue, or continued processing is required for the establishment, exercise or defence of legal claims.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent or any processing which is not based on your consent.

10.2 If you would like to exercise any of these rights, please send us your request via privacy@riyadhair.com. We will endeavour to get back to you as soon as possible. In the event your request is particularly complex, we will notify you and keep you updated.

10.3 We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

10.4 If you feel that we do not comply with applicable data protection and privacy rules, you may also lodge a complaint with the competent data protection authority in your country or where the infringement occurred. For Saudi Arabia, the competent authority is SDAIA and complaints can be submitted via the National Data Governance Platform: dgp.sdaia.gov.sa. For information on the competent data protection authorities in other jurisdictions in which we operate, please refer to Schedule 1 (Jurisdiction‑Specific Supplements).

11. THIRD PARTY LINKS AND FEATURES

11.1 Riyadh Air Services may include links to third party websites or services for your convenience. Please note that these websites are not operated or controlled by Riyadh Air, and we are not responsible for their content, privacy practices or security measures.

‎

11.2 We do not endorse, approve, or make any representations about third party websites, and this Privacy Policy does not apply to any personal data you choose to provide directly to them. We encourage you to review the privacy policies of those third parties before sharing your personal data.

12. MARKETING COMMUNICATIONS

12.1 We retain your personal data for marketing communications as long as you have given your consent to receive them. You may withdraw your consent any time by contacting us privacy@riyadhair.com. Once we receive your request, we will immediately stop sending marketing communications, in accordance with applicable data protection laws.

12.2 Please note that we may continue to retain certain personal data if required by law or for legitimate business purposes that do not relate to marketing or personalisation.

13. MINOR PASSENGERS

13.1 In certain circumstances, we may need to process personal data relating to minor passengers (i.e. an individual under the age of 18 or under the applicable age of majority in their place of residence, whichever is higher). For example, this may occur when a flight booking is made for a minor. This is necessary to perform the contract of carriage and to pursue our legitimate interests in operating our Services.

13.2 If you are providing personal data of a minor, you must be their parent or legal guardian (a “Guardian”) and have the legal authority to provide such data and consent on their behalf.

13.3 If you are a Guardian and believe that a minor has provided personal data without your knowledge and consent, or you would like to review, modify, or request the deletion of a minor’s information, please contact us at privacy@riyadhair.com or the address listed in Section 16 below. We will take appropriate steps to address your request in accordance with applicable data protection laws.

14. LOCAL PERSONAL DATA REQUIREMENTS

14.1 While this Privacy Policy outlines Riyadh Air’s general approach to personal data protection, we recognise that local data protection laws may impose additional or more stringent requirements in certain jurisdictions. Where applicable, we will comply with local laws and regulations, including the Saudi Personal Data Protection Law and any other relevant national or regional data protection frameworks.

14.2 In jurisdictions where local laws require enhanced protections, disclosures, or user rights, we will apply those standards in addition to the practices described in this Privacy Policy. In the event of a conflict between this Privacy Policy and local legal requirements, the applicable local law will take precedence.

‎

14.3 Jurisdiction‑specific information applicable to individuals located in certain countries is set out in Schedule 1 (Jurisdiction‑Specific Supplements), which forms part of this Privacy Policy and provides additional local disclosures and information where required under applicable laws

15. WHAT HAPPENS IF YOU DO NOT PROVIDE US WITH YOUR PERSONAL INFORMATION

Where we are required by applicable law, or under the terms of contract we have with you, to collect personal data and you fail to provide data when requested, we may not be able to perform the contract we have entered into or are attempting to enter into with you. In such cases, we reserve the right to cancel or refuse to accept your booking, and we will inform you if it is the case at the relevant time.

16. HOW TO GET IN TOUCH WITH US

16.1 If you have any questions or complaints about this Privacy Policy or our privacy practices, or if you wish to issue a request to exercise your rights described in Section 10, please contact us using the information below:

Address:

Data Protection Officer

Aviation Services Company (Riyadh Air)General Authority of Civil Aviation

General Authority of Civil Aviation

Building 4075

P.O. Box 8427

Riyadh 13443

the Kingdom of Saudi Arabia

Email address: privacy@riyadhair.com

17. CHANGES TO THIS PRIVACY POLICY

17.1 This Privacy Policy is effective from 1^st January 2025.

17.2 We may update this Privacy Policy from time to time to reflect changes in legal requirements, our business operations, or the way we process personal data. Any updates will be posted on this webpage and in the privacy sections of relevant platforms. The date of the latest revision will be indicated in this Section.

17.3 If we make material changes to this Privacy Policy, we will seek to notify you through appropriate means, such as a notice on our Platforms or via email.

17.4 We encourage you to regularly review this Privacy Policy to stay informed about how we protect your personal data. You are responsible for ensuring that we have your current and deliverable email address and for checking this page periodically for updates.

‎

‎

18. LANGUAGE

18.1 This Privacy Policy is written in both the Arabic and English languages. In the event of any conflict between the two versions and any translation thereof, the English version shall prevail.

‎

‎

‎

‎

‎

‎

SCHEDULE 1 – JURISDICTION-SPECIFIC SUPPLEMENTS

This Schedule sets out supplemental information and additional provisions that apply where the data protection or privacy laws of the jurisdictions listed below are applicable to our processing of your personal data. These jurisdiction‑specific supplements form part of this Privacy Policy and should be read together with the main policy. In the event of any inconsistency between the main body of this Privacy Policy and this Schedule, the relevant provisions of this Schedule shall apply to the extent of the inconsistency.

Part 1 – United Kingdom (UK)

‎

This Part 1 applies where individuals are located in the UK or where the UK data protection law (including the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025) applies to our processing of your personal data.

‎

1. LEGALLY RECOGNIZED LEGITIMATE INTERESTS

‎

1.1 Where UK law applies, we may also choose to process your personal data (described in Section ‎4 of the Privacy Policy) on the basis that this is necessary for specific legitimate interests that are recognised in law and based on public interests. These legitimate interests are as follows:

‎

1.1.1 Public task disclosure requests: where it is necessary for us to share your personal data with a third party (on request by the third party) because they need the personal data for purposes that are in the public interest or for a task carried out in the exercise of official authority, and set out in law. In practice, this will apply where we share your personal data with a public authority, or organisation, because they have sent us a request, which says that the disclosure is needed so that they can fulfil their public tasks or official functions (laid down in law).

1.1.2 National security, public security and defence: where our processing of your personal data is necessary: (a) for the purposes of safeguarding national security, (b) for the purposes of protecting public security, or (c) for defence purposes. In practice, this could apply (particularly part (b)) when we need to process your personal data to protect our business, website, systems and/or assets against security threats and risks, like cyber-attacks, and to respond to such threats and risks.‎

1.1.3 Emergencies: where our processing of your personal data is necessary to respond quickly to certain types of emergency events or situations, such as extreme weather events, pandemics, chemical spills, and/or war and acts of terrorism that threaten serious damage to the security of the UK.

1.1.4 Detecting, investigating and preventing crime: where our processing of your personal data is necessary for the purpose of (a) detecting, investigating or preventing crime, or (b) apprehending or prosecuting offenders. This may include where we need to process your personal data to detect, investigate or prevent crimes like money laundering, terrorist financing, fraud, and/or social engineering (and scams).

1.1.5 Safeguarding vulnerable individuals: where our processing of your personal data is necessary for the purposes of safeguarding a vulnerable individual (being (a) a child, or (b) an adult who is at risk).

‎

1.2 The table below sets out further information on the ways personal data may be processed in the UK and the legal bases relied upon in those circumstances.

‎

Purpose for Processing	Category of Personal Data	Legal Basis
To provide appropriate support in emergency situations, including medical attention or notification of emergency contacts	Identity Data, Booking and Itinerary Data, Health Data, Emergency Contact Data	Vital interests; Legal obligation; Legally recognised legitimate interests relating to: (i) emergencies; and/or (ii) safeguarding vulnerable individuals (as described in more detail in Section 2 below).
To protect and secure our Platforms, Services and/or business against security threats	Baggage Data, Booking and Itinerary Data, Business Travel Data, Communication Data, Contact Data, Device and Location Data, Identity Data, Third Party Booking Data, Loyalty Program Data, Travel Document and Entry Data, Technical Data, Usage Data, Emergency Contact Data, Government and Regulatory Data, Security and Safety Data, Cargo Data	Legitimate interests – to protect our business, staff, customers and others who work with us Legally recognised legitimate interests relating to: (i) national security, public security and defence; and/or (ii) detecting, investigating and preventing crime (as described in more detail in Section 2 below)
To arrange and deliver special assistance you request, including mobility aid, medical support, or other accommodations	Identity Data, Health Data, Travel Preferences	Consent; Legally recognised legitimate interests relating to: safeguarding vulnerable individuals (as described in more detail in Section 2 below)

‎

2. SHARING OF PERSONAL DATA

‎

2.1 In addition to Section 6.4 of the Privacy Policy, where UK data protection law applies, our legal basis for the sharing of personal data may include any of the Legally Recognised Legitimate Interests explained in Section 2 above, as applicable.

‎

2.2 In addition to Section 6.6 of the Privacy Policy, where UK data protection law applies, our legal basis for the sharing of your personal data described in Section 6.5 of the Privacy Policy may include any of the Legally Recognised Legitimate Interests explained in Section 2 above, as applicable.

‎

3. INTERNATIONALS TRANSFERS

‎

3.1 If, in the course of our operations, your personal data is transferred to a country outside of your country of residence (including outside the UK) we will ensure that such transfers are conducted in compliance with applicable data protection and privacy laws, as follows:

‎

‎ ‎ ‎ 3.1.1 UK adequacy regulations: in the case of transfers of personal data from the UK, where the UK government has decided the particular country ensures an adequate level of protection of personal data (by issuing ‘adequacy regulations’). A list of countries the UK currently has adequacy regulations in relation to is available here. We currently rely on adequacy regulations for our transfer of personal data from the UK to: (i) Microsoft Azure, Amazon Web Services (AWS), Adobe Cloud (hosted on Microsoft Azure) and Google Cloud; and (ii) other third parties listed in 6 above, where these third parties are based in one of those listed countries.‎

‎ ‎ ‎ 3.1.2 Standard contractual clauses (SCCs): in cases where there are no applicable UK adequacy regulations, where we have entered into standard data protection clauses with the recipient, provided that the level of protection for your personal data following the transfer based on the SCCs will meet the standards set under UK data protection laws. We rely on standard contractual clauses, for transfers of personal data to third parties listed in 6 above, where these third parties are based in locations such as Saudi Arabia and the United States.

‎ ‎ ‎ 3.1.3 Derogations: we may also transfer your personal data outside of the UK where a specific derogation applies under relevant data protection law in the circumstances. However, we do not routinely rely on derogations in respect of overseas transfers of personal data.

‎

3.2 Further information regarding applicable transfer safeguards may be obtained by contacting privacy@riyadhair.com.

‎

4. MINOR PASSENGERS

‎

4.1 Riyadh Air’s Services are not directed at minors. Individuals under the age of 18 are currently not entitled to register as Sfeer loyalty members or purchase tickets.

‎

5. COMPLAINTS

‎

5.1. Individuals located in the UK have the right to lodge a complaint with the UK data protection authority, the Information Commissioner’s Office. Contact details are set out: https://ico.org.uk/make-a-complaint.

‎

5.2 Riyadh Air also encourages individuals to contact Riyadh Air directly in the first instance so that concerns can be addressed promptly

‎

6. CONTACT DETAILS

‎

6.1 As we are based outside of the UK, we have appointed CMS Cameron McKenna Nabarro Olswang LLP as our UK representative under the UK GDPR. You can contact CMS on the details below:

‎

‎ ‎ ‎ 6.1.1 Email address: RXUKRep@cms-cmno.com

‎ ‎ ‎ 6.1.2 Postal address: Head of Data Protection, CMS Cameron McKenna Nabarro Olswang LLP, 78 Cannon Street, London EC4N 6AF

‎ ‎

6.2 When we receive a data protection complaint that we have not complied with the UK GDPR, we will:

‎

‎ ‎ ‎ 6.2.1 Acknowledge receipt no later than 30 days from receiving it.

‎ ‎ ‎ 6.2.2 Take appropriate steps to respond without undue delay, which will include:

(a) making enquiries into the subject matter of the complaint (to the extent appropriate); and

(b) keeping you informed about our progress in handling the complaint.

‎ ‎ ‎ 6.2.3 Inform you of the outcome without undue delay.

‎

Part 2 – European Economic Area (EEA) / EU

‎

This Part 2 applies where individuals are located in the EU or where the EU data protection law (including the EU GDPR) applies to our processing of your personal data.

‎

7. INTERNATIONAL TRANSFERS

‎

7.1 If, in the course of our operations, your personal data is transferred to a country outside of your country of residence (including outside the EEA) we will ensure that such transfers are conducted in compliance with applicable data protection and privacy laws, as follows:

‎

‎ ‎ ‎ 7.1.1 EU adequacy decisions: in the case of transfers of personal data from the EEA, where the European Commission has decided that the particular country ensures an adequate level of protection for personal information (known as an “adequacy decision”). A list of countries the European Commission has currently made adequacy decisions in relation to is available here. We rely on adequacy decisions for transfers of personal data from the EEA to third parties listed in 6 above, where these third parties are based in one of those listed countries.

‎ ‎ ‎ 7.1.2 Standard contractual clauses (SCCs): in cases where there are no applicable EU adequacy decisions, where we have entered into standard data protection clauses with the recipient, provided that the level of protection for your personal data following the transfer based on the SCCs will meet the standards set under EU data protection laws. We rely on standard contractual clauses, for transfers of personal data to third parties listed in 6 above, where these third parties are based in locations such as Saudi Arabia and the United States.

‎ ‎ ‎ 7.1.3 Derogations: we may also transfer your personal data outside of the EEA where a specific derogation applies under relevant data protection law in the circumstances. However, we do not routinely rely on derogations in respect of overseas transfers of personal data.

‎

7.2 Further information regarding applicable transfer safeguards may be obtained by contacting privacy@riyadhair.com.

‎

8. COMPLAINTS

‎

8.1 Individuals located in the EEA have the right to lodge a complaint with the relevant Member State data protection authority. Contact details are set out at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

‎

8.2 Riyadh Air also encourages individuals to contact Riyadh Air directly in the first instance so that concerns can be addressed promptly.

‎

9. CONTACT US

‎

9.1 As we are based outside of the EEA, we have appointed CMS Cameron McKenna Nabarro Olswang LLP Hungarian Branch Office as our EU representative under the EU GDPR. You can contact CMS on the details below:

‎

‎ ‎ ‎ 9.1.1 Email address: gdpreurepresentative@cms-cmno.com

‎ ‎ ‎ 9.1.2 Postal address: CMS Cameron McKenna Nabarro Olswang LLP Hungarian Branch Office Károlyi utca 12., 1053 Budapest, Hungary

‎

Part 3 – Egypt

‎

This Part 3 applies where individuals are located in Egypt or where Egypt’s Personal Data Protection Law No. 151 of 2020 (“PDPL”) applies to our processing of your personal data.

‎

1. COMPLAINTS

‎

Individuals located in Egypt have the right to lodge a complaint with Egypt’s data protection authority, the Personal Data Protection Centre (“PDPC”).

Riyadh Air also encourages individuals to contact Riyadh Air directly in the first instance so that concerns can be addressed promptly.

‎

2. INTERNATIONAL TRANSFERS

‎

2.1 If, in the course of our operations, your personal data is transferred to a country outside of your country of residence (including outside Egypt) we will ensure that such transfers are conducted in compliance with the PDPL.

‎

2.2 In particular, transfers of personal data outside Egypt will only be made where the destination country provides a level of protection not below that required under the PDPL, or with your direct consent in limited circumstances. Your personal data may be transferred to locations such as Saudi Arabia, EEA, UK and the United States.

‎

2.3 Further information regarding applicable transfer safeguards may be obtained by contacting privacy@riyadhair.com.

‎

3. LAWFUL BASIS

‎

3.1 Where Section 5.2 in this privacy policy refers to refers to "vital interests" as a legal basis for processing your personal data, please note that this ground is not recognised as a standalone legal basis under the PDPL. Accordingly, where Egyptian law applies to the processing of your personal data, and where processing would otherwise be described as relying on “vital interests”, we will instead rely on one or more of the following legal bases, as appropriate:

‎

Purpose for Processing	Category of Personal Data	Legal Basis
To provide appropriate support in emergency situations, including medical attention or notification of emergency contacts	Identity Data, Booking and Itinerary Data, Health Data, Emergency Contact Data	Legal obligation; Consent; Legitimate Interests

‎‎

‎

Part 4 – India

‎

This Part 4 applies where individuals are located in India or where India’s data protection laws including (i) the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) and (ii) The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) apply to our processing of your personal data.

‎

1. COMPLAINTS

‎

1.1 Under the incoming DPDP Act, individuals located in India have the right to lodge a complaint with India’s data protection authority, the Data Protection Board of India (“DPBI”), here: dpdpa-grievance.gov.in.

‎

1.2 Our Grievance Redressal Officer, Ayman Alshafai, can be contacted at: privacy@riyadhair.com.

‎

1.3 Riyadh Air also encourages individuals to contact Riyadh Air directly in the first instance so that concerns can be addressed promptly.

‎

2. DATA SUBJECT RIGHTS

‎

2.1 Where individuals are located in India or where India’s data protection laws apply to our processing of your personal data, you may have certain additional rights in connection with the personal data we collect from you which are as follows:

‎

‎ ‎ ‎ 2.1.1 Right of grievance redressal: the right to have your grievances addressed by us, as the data controller (referred to as “Data Fiduciary” under Indian data protection law)‎;

‎ ‎ ‎ 2.1.2 Right to nominate: the right to nominate one or more individuals to exercise your data protection rights on your behalf in the event of your death or incapacity.

‎

2.2 Please note that the right to request the transfer of your personal data to you or to a third party (commonly known as “data portability”), as described in Section 10.1 of this Privacy Policy, is not available under India's data protection laws.

‎

3. INTERNATIONAL TRANSFERS

‎

3.1 If, in the course of our operations, your personal data is transferred to a country outside of your country of residence (including outside India) we will ensure that such transfers are conducted in compliance with India’s data protection laws.

‎

3.2 Under the incoming DPDP Act, your personal data will only be transferred to jurisdictions that are not restricted by the Central Government of India. Where a transfer involves personal data being made available to a foreign state or any entity under the control of a foreign state, any additional conditions prescribed by the Central Government will be observed

‎

Part 5 – United Arab Emirates (UAE)

‎

This Part 5 applies where individuals are located in the UAE or where the UAE Federal Decree Law No. 45/2021 on the Protection of Personal Data (“UAE PDPL”) applies to our processing of your personal data.

‎

1. LAWFUL BASIS

‎

1.1 Where Section 5.2 in this Privacy Policy refers to “legitimate interests” as a legal basis for processing your personal data, please note that this ground is not available under the UAE data protection framework. Accordingly, for individuals whose personal data is processed under UAE law, we will instead rely on your consent or the necessity of processing for the performance of a contract to which you are a party, as applicable.