Star Taibah Company

Privacy policy

Last updated: 18 October 2026

This policy explains how Star Taibah Company ("Star Taibah", "we", "us") collects, uses and protects your personal data when you use this website or book with us. We are a travel agency based in the Kingdom of Saudi Arabia, Commercial Registration No. 7055099746, Ministry of Tourism licence No. 73219935 (Travel and Tourism Agency).

We process personal data in line with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. For customers outside Saudi Arabia, we also respect the main principles of laws such as the EU General Data Protection Regulation (GDPR).

1. The data we collect

We only ask for what we need to arrange your stay or trip:

  • Account details: your name, email address and a securely hashed password.
  • Booking details: lead guest name, email address, phone number, travel dates, number of guests and rooms, and any special requests you enter.
  • Optional profile details you choose to add: date of birth, gender, address, emergency contact name and phone, and accessibility needs.
  • Messages you send us by email, phone or WhatsApp.
  • Technical data needed to run the site securely, such as your IP address, browser type and the essential cookies described in our cookie policy.

2. Why we use it

We use your personal data to:

  • Create and manage your bookings, and send you booking emails and sign-in codes.
  • Arrange your accommodation, transport, Umrah or Ziyarah services with hotels and other providers.
  • Answer your questions and provide customer support.
  • Keep the site and your account secure and prevent fraud.
  • Meet our legal, tax, accounting and tourism-regulation duties.

3. Legal basis

We process your data because it is necessary to provide the booking or service you ask for, to comply with our legal obligations, and for our legitimate interest in running a safe and reliable service. Where we rely on your consent (for example, optional profile details), you can withdraw it at any time.

4. Who we share it with

We never sell your personal data. We share it only where needed:

  • Hotels, transport companies and other service providers that deliver the parts of your booking.
  • Government authorities where the law requires it, for example in response to official requests.
  • Our technology providers, who process data for us under contract: Cloudflare (website hosting, database and file storage) and our email server, which sends booking emails and sign-in codes.
  • Professional advisers such as accountants or lawyers, under a duty of confidentiality.

5. Transfers outside Saudi Arabia

Some of our providers, such as Cloudflare, may process data on servers outside the Kingdom. Where data is transferred abroad, we do so only as the PDPL allows and with appropriate safeguards to keep it protected.

6. How long we keep it

We keep booking records for as long as needed to provide the service and to meet our legal, tax and accounting duties, which may require us to keep certain records for several years. Account and profile details are kept until you delete your account or ask us to delete them. Sign-in codes expire after 10 minutes and are removed automatically.

7. How we protect it

Your data is sent over encrypted connections (HTTPS). Passwords are stored only as secure hashes, sign-in uses one-time email codes, and access to booking data is limited to authorised staff. No system is completely secure, but we work to protect your data and will act promptly if a breach occurs, including notifying you and the authorities where the law requires.

8. Your rights

Subject to the law, you have the right to:

  • Be informed about how we process your data (this policy).
  • Access a copy of your personal data.
  • Correct data that is inaccurate or incomplete. You can update most profile details yourself in your account.
  • Ask us to delete your data when we no longer need it, unless we must keep it by law.
  • Withdraw your consent where we rely on it.
  • Complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe your data has been mishandled.

9. Children

Bookings must be made by an adult. We only collect information about children when a parent or guardian provides it as part of a family booking.

10. Cookies

We use only essential cookies that the site needs to work, such as keeping you signed in and remembering your language. We do not use advertising or analytics cookies. See our cookie policy for the full list.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make significant changes, we will let you know on the site or by email.

Contact us about your data

To exercise any of your rights or ask about this policy, email us. We will reply within the time the law allows.

Email: info@startaibah.com.sa

We use only essential cookies to keep the site working, such as remembering your language and keeping you signed in. No tracking or advertising. Cookie policy