1. Introduction

This Privacy Policy explains how Locanda Homes (“Locanda Homes,” “we,” “us,” or “our”) collects, uses, shares, stores, and protects personal information when you use https://locanda-homes.com/, our booking tools, customer-support channels, and related services (together, the “Platform”).

This Policy is intended to satisfy the transparency requirements of the Saudi Personal Data Protection Law issued by Royal Decree No. M/19, as amended by Royal Decree No. M/148 (the “PDPL”), its Implementing Regulations, and the Regulation on Personal Data Transfer outside the Kingdom. In this Policy, “personal information” and “personal data” have the same meaning.

For personal information that we determine how and why to process, Locanda Homes is the data controller. Accommodation Providers, payment providers, booking distribution partners, and other third parties may also act as independent controllers for information they receive and process for their own purposes.

2. Information we collect

Depending on how you use the Platform, we may collect the following categories of information.

3. How we use information

We may process personal information to:

• create and manage your account;
• search availability, process and confirm bookings, take payment, issue refunds, and provide booking documents;
• share reservation information with the Accommodation Provider and relevant booking partners;
• coordinate disclosed check-in requirements with the Accommodation Provider, without Locanda Homes collecting or storing identity documents;
• provide customer service, handle requests, resolve complaints, and investigate disrupted stays;
• communicate confirmations, reminders, changes, security alerts, and other service messages;
• personalise search results, remember preferences, and improve usability;
• prevent fraud, payment abuse, account takeover, unlawful activity, and threats to guests, providers, or the Platform;
• maintain, test, secure, troubleshoot, analyse, and improve the Platform;
• comply with accounting, tax, tourism, immigration, law-enforcement, sanctions, court-order, and other legal obligations;
• establish, exercise, or defend legal claims;
• send marketing communications where you have consented or where otherwise permitted by law; and
• measure Platform traffic and performance through Google Analytics, subject to applicable consent requirements.

4. Legal bases for processing

We process personal data only on a legal basis permitted by the PDPL. Depending on the activity, we rely on one or more of the following:

• Consent: where you have given valid consent for a specified purpose, including direct marketing, non-essential cookies, or processing for which Saudi law requires express consent. You may withdraw consent at any time, without affecting processing already carried out lawfully.
• Implementation of an agreement: processing necessary to take steps you request, conclude or perform your booking or another agreement to which you are a party, take payment, support your stay, or issue a refund.
• Law or judicial requirements: processing necessary to comply with tourism, guest-registration, tax, accounting, security, regulatory, court, law-enforcement, or other Saudi legal requirements.
• Legitimate interests: processing necessary for a lawful, specific interest of Locanda Homes, such as platform security, fraud prevention, service improvement, or legal claims, after balancing that interest against your rights and interests. We do not rely on legitimate interests to process sensitive personal data.
• Your actual or vital interests: limited situations where processing serves your actual interests and contacting you is impossible or difficult, or is necessary to protect life or health, as permitted by Saudi law.

5. Information about other travellers

If you provide information about another traveller, you confirm that you are authorised to do so and that you have explained how their information will be used. Where appropriate, please share this Privacy Policy with them.

We may contact a co-traveller directly where needed for the booking, safety, legal compliance, or at their request.

6. When we share information

We may share personal information with:

• Accommodation Providers: to confirm and deliver the stay, manage check-in, respond to requests, comply with guest-registration duties, and resolve problems.
• Booking and inventory partners: including Zaaer where applicable, to search availability, create or modify reservations, receive booking updates, and coordinate support.
• Payment and fraud-prevention providers: to authorise payments, carry out refunds initiated and managed by Locanda Homes, prevent abuse, and handle disputes or chargebacks.
• Technology and business service providers: hosting and cloud infrastructure, security, professional advisers, Google Analytics for website analytics, and WhatsApp for customer-support communications, where applicable.
• Corporate affiliates or transaction parties: where necessary for internal operations, restructuring, financing, merger, acquisition, or sale, subject to appropriate confidentiality and legal safeguards.
• Authorities and other lawful recipients: courts, regulators, tax bodies, tourism or immigration authorities, law enforcement, emergency services, or other parties where required by law or reasonably necessary to protect rights, safety, and security.
• Other parties at your direction: when you ask us to share information or connect a third-party service.

We do not sell personal information. We do not disclose personal information for another party’s independent marketing without a legal basis and any consent required by the PDPL.

7. International transfers

Some third-party services, including analytics, communications, payment, or booking providers, may process information using infrastructure outside Saudi Arabia. The countries and safeguards applicable to a transfer depend on the provider and service used.

Before transferring personal data outside the Kingdom, we will confirm a permitted transfer purpose, limit the data to the minimum necessary, and use a mechanism allowed by the PDPL Transfer Regulation. Depending on the destination and circumstances, this may include a recognised adequate level of protection, Saudi standard contractual clauses, binding common rules, certification, an approved exception, and any required transfer risk assessment or regulatory procedure. We will not make a transfer that prejudices Saudi national security or the Kingdom’s vital interests.

8. Data retention

We keep personal information only for as long as necessary for a disclosed purpose or required by Saudi law. Saudi travel and tourism rules may require Locanda Homes to retain tourist data, reservation contracts, and other required service records for at least one year. Tax, accounting, fraud, chargeback, complaint, and legal-claim records may be retained for longer where a specific legal or operational need applies.

Retention periods vary by data type. In deciding how long to retain information, we consider the booking lifecycle, legal and accounting periods, limitation periods, security needs, active disputes, and regulatory requirements. When information is no longer needed, we delete it, anonymise it, or securely isolate it until deletion is possible.

Locanda Homes does not collect or retain copies of identity documents or biometric verification records.

9. Security

We use reasonable technical and organisational measures designed to protect personal information, including access controls, encryption where appropriate, logging, secure development and hosting practices, vendor controls, staff confidentiality, and incident-response procedures.

If a personal-data breach is likely to harm personal data or affect a person’s rights or interests, we will notify SDAIA within the period required by the PDPL Implementing Regulations, which is generally no more than 72 hours after becoming aware of the incident. We will also notify affected people without undue delay where the law requires it.

No online service can guarantee absolute security. You should use a strong, unique password, keep your devices secure, and contact us immediately if you suspect unauthorised account activity or a fraudulent payment request.

Locanda Homes will not ask you to send full payment-card details or passwords through an unsolicited email, social-media message, or unofficial payment link.

10. Cookies and similar technologies

We use or may use cookies and similar technologies to:

• keep the Platform functioning and secure;
• remember language, currency, dates, and preferences;
• understand Platform traffic and improve performance through Google Analytics.

Strictly necessary technologies may operate on an available legal basis. Google Analytics and other optional technologies must not be activated until any consent required by law has been obtained.

Browser controls may also block cookies, but some Platform features may not function properly. A separate Cookie Notice may provide more detail about the specific technologies and providers used.

11. Marketing choices

We will send marketing communications only when you have subscribed through the relevant marketing form. Each marketing email will identify Locanda Homes and include an unsubscribe link. You may also withdraw consent by contacting us, and we will act on the request promptly.

Even if you opt out of marketing, we may still send service communications about your account, bookings, payments, safety, policy updates, and support requests.

12. Your privacy rights

Subject to the PDPL and its lawful exceptions, you have the right to:

• be informed of the legal basis and purpose for collecting and processing your personal data, whether collection is mandatory or optional, the expected retention period, and the consequences of not providing required data;
• access personal data we hold about you;
• obtain a copy of your personal data in a clear and readable format, without prejudice to the rights of others;
• request correction, completion, or updating of inaccurate personal data;
• request destruction of personal data when the purpose has ended and no lawful retention ground applies;
• withdraw consent at any time where processing is based on consent;
• stop direct marketing; and
• submit a complaint to SDAIA through the National Data Governance Platform.

To exercise a right, contact support@locanda-homes.com. The Operations Manager is responsible for coordinating privacy and personal-data requests. We may need to verify your identity and clarify your request. We will act on a valid request without delay and normally within 30 days. If implementation requires disproportionate effort or you submit multiple requests, we may extend once by up to a further 30 days after notifying you in advance and explaining why. We may refuse a request that is repetitive, manifestly unfounded, or requires disproportionate effort, or limit a right where Saudi law permits, and will explain the reason.

13. Children and minors

The Platform is not intended for people under 18 to create an account or make a booking. A parent, guardian, or authorised adult must make the booking.

We may process limited information about accompanying minors where needed for occupancy, age-based pricing, check-in, safety, or legal guest-registration requirements. Where consent from a guardian or minor is legally required, we will request it through an appropriate process. We do not knowingly use children’s information for behavioural advertising.

14. Automated tools and fraud checks

We may use automated tools to identify suspicious payments, account misuse, duplicate bookings, security threats, or other fraud signals. These tools may delay or flag a transaction for review. We will conduct any assessment required by Saudi law for high-risk or systematic processing and provide meaningful human review where required or reasonably appropriate.

15. Third-party sites and services

Third-party websites, payment methods, maps, social networks, and other integrations have their own privacy practices. This Policy does not govern a third party’s independent collection or use of information. Review the relevant third-party policy before using its service.

16. Changes to this Privacy Policy

We may update this Policy to reflect changes in law, technology, service providers, or our processing activities. We will publish the revised Policy with a new “Last updated” date. If a change materially affects your rights or how we use information, we will provide additional notice where required.

17. Contact us

The controller responsible for this Policy is:

Legal entity

Locanda Homes

Website

https://locanda-homes.com/

National / registered address

Uthman Ibn Affan Road, Al Narjis, Riyadh 13333, Saudi Arabia

Commercial registration number

[COMMERCIAL REGISTRATION NUMBER]

Privacy contact

support@locanda-homes.com

Privacy request coordinator

Operations Manager

Customer support

support@locanda-homes.com / +966 575 555 885

You may submit a complaint to the Saudi Data & AI Authority through the National Data Governance Platform. We encourage you to contact us first so we can address your concern.